CVE-2024-0826

CVE-2024-0826 affects Qi Addons For Elementor for WordPress. The vulnerability is a Stored Cross‑Site Scripting (XSS) in widget attributes caused by insufficient input sanitization and output escaping, allowing authenticated users with contributor-level or higher permissions to inject scripts tha...

CVE-2024-1960

CVE-2024-1960 is a Stored Cross-Site Scripting vulnerability affecting the ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules (WordPress plugin, formerly WooLentor) up to version 2.8.1. The issue arises from insufficient input sanitization and output escaping on user-supplied ...

CVE-2024-3093

CVE-2024-3093 is a duplicate of CVE-2024-1752 for the Font Farsi WordPress plugin. Connected sources indicate the issue affects Font Farsi

CVE-2024-2423

CVE-2024-2423 affects the WordPress plugin UsersWP – Front-end login form, User Registration, User Profile & Members Directory . It is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode attributes in all versions up to and including 1.2.6, due to insufficient input sanitization ...

CVE-2024-2261

CVE-2024-2261 affects the Event Tickets and Registration plugin for WordPress (all versions up to 5.8.2). The exposure is via RSVP functionality, enabling authenticated users with contributor access or higher to retrieve sensitive data (emails, street addresses). Remediation noted in connected so...

CVE-2024-2226

CVE-2024-2226 affects the Otter Blocks – Gutenberg Blocks plugin for WordPress. The vulnerability is stored XSS in the google-map block via the id parameter, present in all versions up to 2.6.4, due to insufficient input sanitization and output escaping. Exploitation requires an authenticated att...

CVE-2024-1641

CVE-2024-1641 affects the WordPress Accordion plugin. Vulnerability: missing capability check in the accordions_duplicate_post_as_draft function, affecting all versions up to 2.2.96. Impact: authenticated users with Contributor+ access can duplicate arbitrary posts, potentially exposing contents ...

CVE-2024-2033

CVE-2024-2033 affects the Video Conferencing with Zoom plugin for WordPress (versions

CVE-2024-2187

CVE-2024-2187 : The Beaver Builder Addons by WPZOOM for WordPress is exposed to Stored Cross-Site Scripting via the Testimonials widget in all versions up to and including 1.3.4. The root cause is insufficient input sanitization and output escaping, enabling authenticated attackers with contribut...

CVE-2024-1664

CVE-2024-1664 affects the WordPress plugin Responsive Gallery Grid (versions prior to 2.3.11). The vulnerability arises from insufficient sanitisation/escaping of several settings, which could allow high-privilege users (e.g., administrators) to perform Stored XSS, including in multisite configur...

CVE-2024-0082

CVE-2024-0082 (NVIDIA ChatRTX for Windows) affects NVIDIA ChatRTX for Windows, describing a vulnerability in the UI that allows an attacker to cause improper privilege management by sending open file requests to the application, potentially enabling local privilege escalation, information disclos...

CVE-2023-7164

BackWPup WordPress plugin before 4.0.4 exposes a directory listing vulnerability in its temporary backup folder, allowing unauthenticated attackers to download site backups (database files). Root cause: lack of access restrictions on the backup directory. Impact: potential data exposure of backup...

CVE-2024-22189

The CVE concerns quic-go prior to v0.42.0 where an attacker can cause memory exhaustion on the peer by flooding with NEW_CONNECTION_ID frames that retire old connection IDs. The receiver is expected to reply with RETIRE_CONNECTION_ID frames for each retirement; an attacker can prevent most of the...

CVE-2024-22360

CVE-2024-22360 (IBM Db2 on Cloud Pak for Data) is a denial-of-service issue triggered by a specially crafted query on certain columnar tables. Affected products include IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data, with versions listed as v3.5 through various refresh leve...

CVE-2024-25046

CVE-2024-25046 affect IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data. Authenticated user can trigger a denial of service via a specially crafted query against Db2 components (versions 3.5 through latest refresh). The issue has a remediation path: upgrade to the latest Cloud...

CVE-2024-25030

CVE-2024-25030 affects IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data (v3.5–refresh 10, v4.0–refresh 9, v4.5–refresh 3, v4.6–refresh 6, v4.7–refresh 4, v4.8–refresh 4). The issue is that 11.1 releases store potentially sensitive information in log files readable by a local ...

CVE-2024-25918

CVE-2024-25918 affects the WordPress plugin InstaWP Connect (InstaWP) Suite. The vulnerability is described as Unrestricted Upload of File with Dangerous Type, enabling remote code execution (RCE). Affected versions: InstaWP Connect from n/a through 0.1.0.8. Public writeups/reports in connected d...

CVE-2024-27191

CVE-2024-27191 concerns the WordPress plugin Slivery Extender (Inpersttion Slivery Extender). Public sources describe an "ImpropER Control of Generation of Code (Code Injection)" vulnerability that enables an authenticated attacker (Contributor+) to execute arbitrary code via the plugin’s shortco...

CVE-2024-27951

CVE-2024-27951 pertains to WordPress Multiple Page Generator Plugin (MPG) with versions up to 3.4.0. The issue is an Unrestricted Upload of a Dangerous File, enabling an attacker with Editor+ privileges to upload a web shell and achieve Remote Code Execution. The vulnerability is confirmed as exp...

CVE-2024-2322

CVE-2024-2322 affects the WordPress plugin WooCommerce Cart Abandonment Recovery prior to version 1.2.27. The vulnerability stems from missing CSRF protection in the plugin’s bulk actions, enabling CSRF attackers to cause logged-in admins to delete arbitrary email templates and to delete/unsubscr...