12918 matches found
CVE-2024-13814
CVE-2024-13814 concerns the Global Gallery – WordPress Responsive Gallery plugin. All versions up to and including 9.1.5 are affected due to a flaw that allows values to be passed to do_shortcode without proper validation, enabling arbitrary shortcode execution. An attacker with Subscriber-level ...
CVE-2024-13601 Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.5 via the 'exportusereraserequest' function due to missing validation on a user controlled key. This makes i...
CVE-2024-13769
The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'themeoptionsajaxpostaction' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for...
CVE-2024-13658
The NGG Smart Image Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hrSISnextgensearchbox' shortcode in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...
CVE-2024-12164
The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwpresetsettings function in all versions up to, and including, 1.6. This makes it possible for authenticated...
CVE-2024-13654
CVE-2024-13654 concerns the WordPress theme ZoxPress (
CVE-2024-13665
The CVE CVE-2024-13665 affects the Admire Extra WordPress plugin (versions up to 1.6). It is a Stored XSS via the space shortcode due to insufficient input sanitization/output escaping for authenticated users with Contributor+ privileges. Impact: arbitrary script injection on pages viewed by user...
CVE-2024-13656 Click Mag - Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion
The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanelofajaxcallback function in all versions up to, and including, 3.6.0. This makes it...
CVE-2024-13653 ZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backupoptions' and 'restoreoptions' functions in all versions up to, and including, 2.12.0. Thi...
CVE-2024-12164 WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwpresetsettings function in all versions up to, and including, 1.6. This makes it possible for authenticated...
CVE-2024-11746
CVE-2024-11746 affects the WordPress plugin “Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin” up to version 1.3.2. The issue is a Stored XSS via the product_brand shortcode due to insufficient input sanitization and output escaping on user-supplied at...
CVE-2024-13769 Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'themeoptionsajaxpostaction' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for...
CVE-2024-13769
CVE-2024-13769 – Puzzles theme (WP Magazine / Review with Store WordPress Theme + RTL) Vulnerability: Stored Cross-Site Scripting due to a missing capability check on the theme_options_ajax_post_action AJAX action. Affected versions: all versions up to and including 4.2.4. Impact: Authenticated a...
CVE-2024-13541
The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the adqsdeletelisting function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with...
CVE-2024-13701
CVE-2024-13701 concerns the Liveticker (by stklcode) WordPress plugin. The vulnerability is a stored cross-site scripting (XSS) via the plugin’s liveticker shortcode, caused by insufficient input sanitization and output escaping on user-supplied attributes. Affected are all versions up to and inc...
CVE-2024-13701 Liveticker (by stklcode) <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Liveticker by stklcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
PT-2025-6430 · Stklcode · The Liveticker
Name of the Vulnerable Software and Affected Versions: The Liveticker by stklcode plugin for WordPress versions up to, and including, 1.2.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'liveticker' shortcode due to insufficient input sanitization and output...
PT-2025-6468 · WordPress · Rise Blocks
Name of the Vulnerable Software and Affected Versions: Rise Blocks – A Complete Gutenberg Page Builder plugin for WordPress versions up to, and including, 3.6 Description: The issue is related to Stored Cross-Site Scripting via the titleTag parameter due to insufficient input sanitization and...
CVE-2024-0179
CVE-2024-0179 is an SMM Callout vulnerability in the AmdCpmDisplayFeatureSMM UEFI module that could allow locally authenticated attackers to overwrite SMRAM and execute arbitrary code. Root cause: insufficient input/data validation in the SMM callout mechanism. Impact: potential kernel- or ring-0...