CVE-2024-11332

The HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hipaatizer' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on...

CVE-2024-11408

The Slotti Ajanvaraus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slotti' shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-11387

The Easy Liveblogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elbliveblog' shortcode in all versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-11426 AutoListicle: Automatically Update Numbered List Articles <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The AutoListicle: Automatically Update Numbered List Articles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-list-number' shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-11426

CVE-2024-11426: AutoListicle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the auto-list-number shortcode in all versions up to 1.2.3. The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, enabling authenticated attackers wi...

CVE-2024-10606

CVE-2024-10606 — WP Travel Engine (WordPress) vuln: All versions up to 6.2.1 are affected by a missing capability check in wpte_onboard_save_function_callback(), allowing authenticated attackers with contributor-level access or higher to modify settings. Impact statements in sources include poten...

CVE-2024-11332

CVE-2024-11332 : Stored XSS in the WordPress plugin “HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents” (versions up to 1.3.4) via the hipaatizer shortcode. Exploitation requires authenticated access at contributor level or higher; payloads execute when users view in...

CVE-2024-10886

The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tributetestimonialsslider' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user...

CVE-2024-10116

The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-10116 Twitter Follow Button <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter

The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

CVE-2024-10537

CVE-2024-10537: The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check in validate_user_meta_key() across versions up to and including 2.9.11. This allows authenticated attackers with Subscriber-leve...

CVE-2024-10886

The CVE CVE-2024-10886 concerns the Tribute Testimonials – WordPress Testimonial Grid/Slider plugin (vulnerable through the tribute_testimonials_slider shortcode). All versions up to and including 1.0.4 are affected due to insufficient input sanitization and output escaping on user-supplied attri...

CVE-2024-38645

A server-side request forgery SSRF vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to read application data. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later...

CVE-2024-38645

CVE-2024-38645 affects QNAP Notes Station 3. The issue is a server-side request forgery (SSRF) that could allow remote authenticated attackers to read application data. Public details confirm the vulnerability exists in Notes Station 3 versions prior to 3.9.7 and that 3.9.7 and later versions inc...

CVE-2024-38646

The CVE-2024-38646 entry affects Notes Station 3. An incorrect permission assignment for a critical resource could allow local authenticated attackers with administrator access to read or modify the resource. Remediation: vulnerability fixed in Notes Station 3 version 3.9.7 and later. Impact deta...

CVE-2024-11355

The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getsetting function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-11381

The Control horas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'chregistro' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-10666

The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via the etf shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from...

CVE-2024-11381 Control horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Control horas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'chregistro' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-47142

AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue with insufficiently protected credentials, which may allow a network-adjacent authenticated attacker to perform unintended operations...