CVE-2024-9882 Salon Booking System < 10.9.4 - Admin+ Stored XSS

The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses WordPress plugin before 1.9.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml...

CVE-2024-9765

The CVE-2024-9765 entry concerns the WordPress plugin EKC Tournament Manager (versions before 2.2.2). Affected component: EKC Tournament Manager plugin. Description from multiple sources indicates an admin-level vulnerability where a logged-in administrator can download system files outside the W...

CVE-2024-9765 EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability

The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory...

CVE-2024-9838 Auto Affiliate Links < 6.4.7 - Admin+ SQL Injection

The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-9663 CYAN Backup < 2.5.3 - Admin+ Stored XSS via Remote Storage Settings

The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9711

The CVE relates to the WordPress EKC Tournament Manager plugin prior to version 2.2.2. Affected component: the plugin’s settings update workflow. Root cause: absence of CSRF protection when updating settings, enabling a logged-in attacker to alter settings via a CSRF attack. Impact stated across ...

CVE-2024-9233 GS Logo Slider < 3.7.1 - Settings Update via Cross-Site Request Forgery

The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8082 Widgets Reset <= 0.1 - Settings Update via CSRF

The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8031

The CVE-2024-8031 vulnerability affects the Secure Downloads WordPress plugin (versions before 1.2.3). Root cause: the plugin does not properly restrict which files can be downloaded, enabling authenticated attackers with admin-level access to download arbitrary files (e.g., wp-config.php). Impac...

CVE-2024-8031 Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download

The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded. This makes it possible for authenticated attackers, with admin-level access and above, to download arbitrary files that may contain sensitive information like wp-config.php...

CVE-2024-6478

The CVE-2024-6478 entry covers the WordPress plugin “CTT Expresso para WooCommerce” prior to version 3.2.13. The issue arises from insufficient sanitisation/escaping of certain settings, allowing high-privilege users (e.g., admins) to perform Stored XSS, even when unfiltered_html is disallowed (s...

CVE-2024-6584 Jetpack Boost < 3.4.7 - Admin+ SSRF

The 'wpajaxboostproxyig' action allows administrators to make GET requests to arbitrary URLs...

CVE-2024-13053 Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS via Theme Title

The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-11269 AHAthat Plugin <= 1.6 - Admin+ SQL Injection

The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks...

CVE-2024-11269 AHAthat Plugin <= 1.6 - Admin+ SQL Injection

The AHAthat Plugin WordPress plugin through 1.6 does not sanitize and escape a parameter before using it in a SQL statement, allowing Admin to perform SQL injection attacks...

CVE-2024-11190

CVE-2024-11190 covers the jwp-a11y WordPress plugin (versions

CVE-2024-11221 Full Screen (Page) Background Image Slideshow <= 1.1 - Admin+ Stored XSS

The Full Screen Page Background Image Slideshow WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-10475 Lead Form Builder < 1.9.8 - Admin+ Stored XSS

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin before 1.9.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed f...

CVE-2024-10475

The CVE-2024-10475 entry concerns the WordPress plugin Lead Form Builder / Responsive Contact Form Builder & Lead Generation Plugin, affected in versions prior to 1.9.8. The root cause is inadequate sanitisation/escaping of certain plugin settings, enabling Stored Cross-Site Scripting by high-pri...

CVE-2024-10009 Website File Changes < 2.1.0 - Admin+ Authenticated SQL Injection

The Melapress File Monitor WordPress plugin before 2.1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...