CVE-2023-47782

CVE-2023-47782 pertains to Thrive Theme Builder prior to version 3.24.0 and is an authenticated privilege-escalation vulnerability. Public documentation confirms that an authenticated user with Subscriber privileges could elevate their access due to improper privilege management in Thrive Theme B...

CVE-2023-47683

The CVE-2023-47683 entry concerns the miniOrange WordPress Social Login and Register plugin (Discord, Google, Twitter, LinkedIn). The root cause is improper privilege management that allows authenticated users with Subscriber access to escalate to Administrator. Affected versions are up to 7.6.6;...

CVE-2023-46205

CVE-2023-46205 : Local File Inclusion in the WordPress plugin Ultimate Addons for WPBakery Page Builder. Affected versions: up to 3.19.14. Root cause: improper limitation of a pathname to restricted directories (path traversal) leading to PHP Local File Inclusion. Impact (per CVE metrics): potent...

CVE-2023-45652

CVE-2023-45652: WordPress Remote Content Shortcode

CVE-2024-24874

CVE-2024-24874 affects WordPress plugin CP Polls up to version 1.0.71, where unauthenticated content injection is possible due to insufficient validation of poll answers. The vulnerability is categorized as Content Injection with a low CVSS (5.3) and is mitigated by upgrading to version 1.0.72, w...

CVE-2023-41956

The CVE-2023-41956 entry concerns WordPress Simple Membership (smp7) with an Improper Authentication flaw that allowed an authenticated user to takeover accounts via the password reset flow. Affected versions are Simple Membership up to 4.3.4; patched in 4.3.5. Reports from NVD/Red Hat/Wordfence ...

CVE-2023-41955

CVE-2023-41955 is an Improper Privilege Management vulnerability in the WordPress plugin Essential Addons for Elementor (WPDeveloper). The flaw enables Privilege Escalation for authenticated users (Contributor/above) across versions up to 5.8.8 . The NVD entry lists a CVSS v3.1 base score of 8.8 ...

CVE-2023-41665

CVE-2023-41665 is a WordPress GiveWP plugin vulnerability: Privilege Escalation due to improper/insufficient privilege checks for updating default roles, enabling an authenticated Give Manager to elevate privileges up to administrator. Affected versions: GiveWP

CVE-2023-39163

CVE-2023-39163 (Phlox Shop) is an Unauthenticated Local File Inclusion in Averta Phlox Shop WordPress plugin, affecting versions up to 2.0.0. The issue arises from a path traversal vulnerability that allows local file inclusion. CVSS v3.1 score is 8.6 (High) with Network attack vector and no user...

CVE-2023-37888

CVE-2023-37888 affects the WordPress plugin Shortcodes and extra features for Phlox theme . It is a Path Traversal (PHP Local File Inclusion) vulnerability that allows unauthenticated attackers to include local files. Affected versions are up to and including 2.14.0; the vendor/maintainer fixed i...

CVE-2023-25050

CVE-2023-25050 affects WordPress Shortcodes Ultimate (versions n/a through 5.12.6). The vulnerability is an Improper Limitation of a Pathname to a Restricted Directory (path traversal) that enables Absolute Path Traversal. Public sources (Patchstack; CVE records; Red Hat advisory) confirm the iss...

CVE-2023-23872

CVE-2023-23872 affects the WordPress plugin GMace (

CVE-2022-44581

CVE-2022-44581 affects the WordPress Defender Security plugin (WPMU DEV Defender Security) with versions up to 3.3.2. Multiple connected sources describe insecure storage of sensitive information and note that screen temporary files may expose sensitive data. Patchstack frames the issue as Broken...

CVE-2023-43040

Summary: CVE-2023-43040 affects IBM Spectrum Fusion HCI (Ceph RGW) and Ceph RGW in IBM Storage Ceph, with versions 2.5.2–2.7.2 vulnerable to unauthorized actions in RGW due to improper bucket access. An unprivileged user can write to any bucket accessible by the signed key when a POST form-data b...

CVE-2024-27280

CVE-2024-27280 describes a buffer-overread in StringIO. The ungetbyte/ungetc methods can read past end, causing StringIO.gets to return memory values. Affected: Ruby 3.0.x up to 3.0.6 and 3.1.x up to 3.1.4; fixed in Ruby 3.0.x by stringio 3.0.1.1 for 3.0 users, and in Ruby 3.1.x by stringio 3.0.1...

CVE-2024-1438

The CVE-2024-1438 entry concerns the WordPress plugin Rolo Slider (PressFore Ro lo Slider). Technical details in connected docs show a Missing Authorization vulnerability that allows unauthorized changes to settings in Rolo Slider versions up to and including 1.0.9. Public sources consistently de...

CVE-2022-40218

The CVE-2022-40218 entry concerns the WordPress plugin ThemeHunk Advance Product Search (WordPress TH Advance Product Search Plugin), affecting versions 1.1.4 and earlier. The root cause is a missing authorization check that allows an unauthenticated user to change plugin settings, enabling impac...

CVE-2023-41651

CVE-2023-41651 corresponds to a WordPress plugin vulnerability in the Multi-column Tag Map plugin (versions

CVE-2024-23710

CVE-2024-23710 affects Google Android: a logic error in InstallPackageHelper.java (assertPackageWithSharedUserIdIsPrivileged) could allow local elevation of privilege by executing arbitrary code as a privileged app, without extra privileges or user interaction. Impact is described as high (CVE-20...

CVE-2024-23704

CVE-2024-23704 is an elevation-of-privilege vulnerability in Android’s WifiDialogActivity.onCreate that bypasses DISALLOW_ADD_WIFI_CONFIG due to a missing permission check. Exploitation requires local access with no user interaction; no remote vector is described. Multiple connected sources (NVD,...