CVE-2024-2243

CVE-2024-2243 affects the csmock component used with OSH (OAuth? Kerberos-based) in Tencent/TencentOS and Fedora/RHEL packaging. The vulnerability allows a regular OSH-service user (anyone with a Kerberos ticket) to disclose the confidential Snyk authentication token and to run arbitrary commands...

CVE-2024-2428

The Ultimate Video Player For WordPress plugin (version

CVE-2023-6385

CVE-2023-6385 affects the WordPress Ping Optimizer plugin up to version 2.35.1.3.0. The vulnerability stems from missing CSRF checks in certain areas, enabling an attacker to cause logged-in users to perform unwanted actions (e.g., clearing logs) via CSRF. Several trusted sources (NVD, CVE feeds,...

CVE-2024-1412

CVE-2024-1412 concerns the WordPress Memberpress plugin. Connected sources confirm a reflected Cross‑Site Scripting (XSS) vulnerability in the plugin’s handling of the message and error parameters, affecting all versions up to 1.11.26. The vulnerability is unauthenticated and could allow an attac...

CVE-2024-2138

CVE-2024-2138 concerns the WordPress plugin JetWidgets For Elementor. The Red Hat and Wordfence entries describe a stored cross-site scripting (XSS) vulnerability in the Animated Box widget, affecting all versions up to and including 1.0.15. The issue arises from insufficient input sanitization a...

CVE-2024-2957

CVE-2024-2957 is a duplicate of CVE-2024-1983. The linked Red Hat/NVD details show Simple Ajax Chat for WordPress (before 20240223) suffers a stored XSS via the name field, reflecting unsanitized input to other users. This confirms the vulnerability context, affected component, and root cause; CV...

CVE-2024-2347

CVE-2024-2347 concerns the Astra WordPress theme. It is a Stored Cross-Site Scripting (XSS) via a user’s display name in all versions up to and including 4.6.8, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher...

CVE-2024-2341

CVE-2024-2341 refers to the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments (plugin) with SQL Injection via the keys parameter in all versions up to 1.6.7.7, allowing authenticated subscribers to append queries and potentially exfiltrate data. Red Hat and NVD entries ...

CVE-2024-1984

CVE-2024-1984 affects the WordPress Graphene theme (versions ≤ 2.9.2). The issue allows unauthenticated users to access post contents of password-protected posts via a meta tag in the page source, indicating a missing authorization check (low-severity info exposure). Reported by Krzysztof Zając a...

CVE-2024-1812

CVE-2024-1812 affects the Everest Forms plugin for WordPress, enabling Server-Side Request Forgery via the font_url parameter in all versions up to and including 2.0.7. This allows unauthenticated attackers to issue web requests from the vulnerable site to internal or arbitrary locations, potenti...

CVE-2024-2344

CVE-2024-2344 (Avada Theme for WordPress) : SQL Injection via the 'entry' parameter affects all versions up to 7.11.6. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Exploitation requires editor-level access or higher (authenticated). Impact ...

CVE-2024-2504

CVE-2024-2504 affects Page Builder: Pagelayer (WordPress plugin) up to version 1.8.4. The vulnerability is a stored XSS via the attr parameter caused by insufficient input sanitization/output escaping. Impact: authenticated users with Contributor+ can inject scripts that execute when any user loa...

CVE-2024-2222

CVE-2024-2222 (Advanced Classifieds & Directory Pro for WordPress) : Vulnerability due to a missing capability check in ajax_callback_delete_attachment across all versions up to 3.0.0. This allows authenticated users with subscriber+ access to delete arbitrary media uploads, i.e., unauthorized da...

CVE-2024-2623

The CVE-2024-2623 entry concerns the WordPress plugin “Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders.” Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability in the countdown widget’s message parameter caused by insufficient i...

CVE-2024-2305

CVE-2024-2305 concerns the WordPress plugin Cards for Beaver Builder. The vulnerability is described as a Stored Cross-Site Scripting (XSS) via the BootstrapCard link in versions up to and including 1.1.2, caused by insufficient input sanitization and output escaping on user-supplied attributes. ...

CVE-2024-1893

CVE-2024-1893 affects the Easy Property Listings WordPress plugin. Time-based SQL Injection is possible in all versions up to 3.5.2 due to insufficient escaping of the property_status shortcode parameter and inadequate query preparation. Authenticated attackers with Contributor+ privileges can in...

CVE-2024-2507

CVE-2024-2507 affects JetWidgets For Elementor plugin for WordPress. All versions up to and including 1.0.16 are vulnerable to Stored Cross-Site Scripting via the widget button URL due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authen...

CVE-2024-2335

CVE-2024-2335 concerns the Elements Plus! WordPress plugin. Affected: Elements Plus! up to version 2.16.2. Issue: Stored Cross-Site Scripting via multiple widget link URLs caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers wi...

CVE-2024-2871

CVE-2024-2871 affects the Media Library Assistant plugin for WordPress. It enables SQL Injection via shortcode parameters in all versions up to 3.13 due to insufficient escaping and lack of proper query preparation, allowing authenticated attackers with contributor access or higher to append addi...

CVE-2024-1465

The CVE-2024-1465 entry concerns the Elementor Addons by Livemesh plugin for WordPress (versions up to and including 8.3.4). It describes a Stored Cross-Site Scripting vulnerability in the Posts Carousel widget via the carousel_skin attribute, arising from insufficient input sanitization and outp...