Nation-State Attackers Exploiting Ivanti CSA Flaws for Network Infiltration

A suspected nation-state adversary has been observed weaponizing three security flaws in Ivanti Cloud Service Appliance CSA as zero-days to perform a series of malicious actions. That's according to findings from Fortinet FortiGuard Labs, which said the vulnerabilities were abused to gain...

WordPress Forms for Mailchimp by Optin Cat plugin <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters vulnerability

Authenticated Editor+ Stored Cross-Site Scripting via Form Color Parameters vulnerability discovered by mike harris in WordPress Plugin Forms for Mailchimp by Optin Cat versions = 2.5.7...

WordPress Powerpress plugin <= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Jack Taylor in WordPress Plugin PowerPress Podcasting versions = 11.9.18...

WordPress Marketing and SEO Booster plugin <= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Francesco Carlucci in WordPress Plugin Marketing and SEO Booster versions = 1.9.10...

WordPress Sirv plugin <= 7.2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Sirv versions = 7.2.9...

WordPress Rank Math SEO plugin <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Leo in WordPress Plugin Rank Math SEO versions = 1.0.228...

WordPress Aggregator Advanced Settings plugin <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Aggregator Advanced Settings versions = 1.2.1...

WordPress Memberful plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting vulnerability

Authenticated contributor+ Stored Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Memberful - Membership Plugin versions = 1.73.7...

CVE-2024-46658

Syrotech SY-GOPON-8OLT-L3 v1.6.0240629 was discovered to contain an authenticated command injection vulnerability...

WordPress Ajax Load More plugin <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via buttonlabel Parameter vulnerability discovered by Robert DeVore in WordPress Plugin Ajax Load More versions = 7.1.2...

WordPress WP Hotel Booking plugin <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Truoc Phan in WordPress Plugin WP Hotel Booking versions = 2.1.2...

WordPress QS Dark Mode Plugin plugin <= 2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin QS Dark Mode versions = 2.9...

WordPress WP Easy Gallery plugin <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter vulnerability

Authenticated Contributor+ SQL Injection via key Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin WP Easy Gallery versions = 4.8.5...

WordPress UltraPress theme <= 1.2.1 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Theme UltraPress versions = 1.2.1...

CVE-2024-8633 Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

WordPress 012 PS Multi Languages plugin <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by mohamed hamadou zero in WordPress Plugin 012 PS Multi Languages versions = 1.6...

WordPress Elementor Addons by Livemesh plugin <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via piechartsettings Parameter vulnerability discovered by stealthcopter in WordPress Plugin Livemesh Addons for Elementor versions = 8.5...

WordPress Daily Prayer Time plugin <= 2024.08.26 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin Daily Prayer Time versions = 2024.08.26...

WordPress OneElements – Best Elementor Addons plugin <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin OneElements – Best Elementor Addons versions = 1.3.7...

WordPress WP Easy Gallery plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Lucio Sá in WordPress Plugin WP Easy Gallery versions = 4.8.5...