CVE-2024-36278

in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion...

WordPress Basil theme <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Unknown in WordPress Theme Basil versions = 2.0.4...

CVE-2024-5938

The Boot Store theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter within the theme's Button shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

WordPress Motors plugin <= 1.4.9 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Krzysztof Zając in WordPress Plugin Motors versions = 1.4.9...

WordPress Newsmatic theme <= 1.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Newsmatic versions = 1.3.1...

WordPress Elementor Header & Footer Builder plugin <= 1.6.35 - Contributor+ DOM-Based Cross Site Scripting (XSS) vulnerability

Contributor+ DOM-Based Cross Site Scripting XSS vulnerability discovered by wcraft Patchstack Alliance in WordPress Plugin Ultimate Addons for Elementor - Lite versions = 1.6.35...

WordPress Mega Elements plugin <= 1.2.2 - Contributor+ Cross Site Scripting (XSS) vulnerability

Contributor+ Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Mega Elements versions = 1.2.2...

WordPress Beaver Builder Addons by WPZOOM plugin <= 1.3.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Beaver Builder Addons by WPZOOM versions = 1.3.5...

WordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ngô Thiên An ancorn from VNPT-VCI, Phan Trong Quan - VNPT Cyber Immunity Patchstack Alliance in WordPress Plugin Ultimate Addons for Elementor versions = 1.36.31...

WordPress Pagerank Tools plugin <= 1.1.5 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Bob Matyas in WordPress Plugin Pagerank Tools versions = 1.1.5...

WordPress Animated AL List plugin <= 1.0.6 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Bob Matyas in WordPress Plugin Animated AL List versions = 1.0.6...

WordPress Benevolent theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Benevolent versions = 1.3.4...

GO-2024-2931 Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider in github.com/rancher/rancher

Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

CVE-2024-5662

The Ultimate Post Kit Addons For Elementor – Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the Social Count Static widget in all versions up to, and...

WordPress Mesmerize theme <= 1.6.120 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Mesmerize versions = 1.6.120...

WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Newspack Blocks versions = 3.0.8...

WordPress Newspack Blocks plugin <= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerability

Contributor+ Arbitrary Directory Deletion vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Newspack Blocks versions = 3.0.8...

PYSEC-2024-268

A Server-Side Request Forgery SSRF vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions = ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attackers to send crafted requests from the vulnerable server to internal or external resources, potential...

WordPress PDF Embedder plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by m3ez Patchstack Alliance in WordPress Plugin PDF Embedder versions = 4.7.1...

WordPress PDF Viewer for Elementor plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin PDF Viewer for Elementor versions = 2.9.3...