CVE-2024-11775

CVE-2024-11775 (Particle Background) affects the WordPress plugin Particle Background, vulnerable to stored XSS via the plugin shortcode ‘particleground’ in all versions up to 1.0.2. Documented impact: authenticated attackers with contributor-level access or higher can inject scripts that execute...

CVE-2024-11776 PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PCRecruiter Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode in all versions up to, and including, 1.4.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-55342

A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF in their web browser, leading to a XSS...

WordPress Back Button Widget Plugin < 1.6.4 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpfactory:backbuttonwidget"; if description...

CVE-2024-12331

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajaxinstallplugin' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2024-12560

The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btnblockduplicatepost' function. This makes it possible for authenticated attackers, with Contributor-leve...

CVE-2024-12121

The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the 'moblcchecklink' function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to...

CVE-2024-12121

CVE-2024-12121 affects the Broken Link Checker | Finder plugin for WordPress. Connected Red Hat advisory confirms an authenticated Blind SSRF via moblc_check_link, allowing Author level (and higher) attackers to trigger web requests from the app to internal or external locations. Impact described...

CVE-2024-10548

CVE-2024-10548 affects the WordPress plugin WP Project Manager (Task, team, and project management) and is due to a Sensitive Information Exposure vulnerability in the REST endpoint "/wp-json/pm/v2/projects/1/task-lists". The issue is exploitable by authenticated users with Subscriber+ privileges...

PT-2024-17752 · Arista · Arista Ng Firewall

Name of the Vulnerable Software and Affected Versions: Arista NG Firewall affected versions not specified Description: This issue allows remote attackers to create arbitrary files and disclose sensitive information on affected installations of Arista NG Firewall. Authentication is required to...

CVE-2024-11926 Traveler <= 3.1.6 - Missing Authorization in Several AJAX Actions

The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'stPartnerCreateServiceRental', 'stdeleteorderitem', 'stpartnerapprovebooking', 'saveorderitem', and 'userDenyEachInfo' functions in all versions up t...

CVE-2024-11926

CVE-2024-11926 (Travel Booking WordPress Theme) in Travel Booking WordPress Theme (Trav eler) is a capability check bypass vulnerability. The issue arises from missing capability checks on functions: __stPartnerCreateServiceRental, st_delete_order_item, _st_partner_approve_booking, save_order_ite...

CVE-2024-12340

The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 'render' function in widgets/content-slider.php and widgets/tabs.php. This makes it possible for authenticated attackers, with...

CVE-2024-12340

CVE-2024-12340 affects the Animation Addons for Elementor WordPress plugin. The vulnerability is a Sensitive Information Exposure via the render function in widgets/content-slider.php and widgets/tabs.php, allowing authenticated attackers with Contributor+ privileges to extract private, pending, ...

CVE-2024-12340 Animation Addons for Elementor <= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template

The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 'render' function in widgets/content-slider.php and widgets/tabs.php. This makes it possible for authenticated attackers, with...

CVE-2024-12340 Animation Addons for Elementor <= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template

The Animation Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the 'render' function in widgets/content-slider.php and widgets/tabs.php. This makes it possible for authenticated attackers, with...

CVE-2024-12449

The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperplayerhtml' shortcode in all versions up to, and including, 2.6.30 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-12061

The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naeventselementortemplate shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, wi...

CVE-2024-12061 Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure

The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naeventselementortemplate shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, wi...

CVE-2024-12596 LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llmsdeletecert' action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with...