CVE-2024-13556

CVE-2024-13556 affects the WordPress plugin “Affiliate Links: WordPress Plugin for Link Cloaking and Link Management.” The vulnerability is a PHP Object Injection via deserialization of untrusted input from a file export, affecting all versions up to 3.0.1. An unauthenticated attacker could injec...

CVE-2024-12274

The Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions prior to 1.1.23 ) is vulnerable to an unauthenticated export file download . The root cause is that the export settings functionality saves data to a public folder using an easily guessable filename. This allows...