CVE-2024-3200

The CVE-2024-3200 entry concerns the wpForo Forum WordPress plugin. Affected software: wpForo Forum plugin for WordPress, versions up to and including 2.3.3. Root cause: insufficient escaping of the slug parameter in the wpforo shortcode and inadequate SQL query preparation, enabling SQL injectio...

CVE-2024-5348

The Elements For Elementor plugin (WordPress) is affected by CVE-2024-5348: Local File Inclusion in all versions up to 2.1 via multiple widget attributes (beforeafter_layout, eventsgrid_layout, marquee_layout, postgrid_layout, woocart_layout, woogrid_layout). Authenticated attackers with Contribu...

CVE-2024-3821

CVE-2024-3821 concerns the WordPress plugin wpDataTables (Premium) up to version 6.3.2. Root cause: missing capability check in wdt_ajax_actions.php, enabling unauthorized access and data table manipulation by unauthenticated users. A fix is noted in version 6.4 (patched). Provided Connected docu...

CVE-2024-4958

CVE-2024-4958 concerns the WordPress plugin “User Registration – Custom Registration Form, Login Form, and User Profile” up to version 3.2.0.1. The flaw is a missing capability check in the import_form_action function which allows authenticated users with contributor-level permissions and above t...

CVE-2024-2295

The CVE-2024-2295 entry concerns the WordPress plugin Contact Form Manager. Affected versions are all up to and including 1.6.1, where insufficient input sanitization and output escaping on the [xyz-cfm-form] shortcode attributes allows Stored Cross-Site Scripting (XSS). Exploitation requires aut...

CVE-2024-1324

CVE-2024-1324 affects QQWorld Auto Save Images (WordPress)

CVE-2024-2506

The Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin’s Custom JS functionality in all versions up to 4.2.7, due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires at least Contributor-level ...

CVE-2024-4087

CVE-2024-4087 affects the WordPress plugin Royal Elementor Addons and Templates. It enables authenticated users with contributor access and above to trigger a Stored XSS via the Back to Top widget in versions up to and including 1.3.975. Impact is that injected scripts could execute on pages acce...

CVE-2024-4342

CVE-2024-4342 affects the Royal Elementor Addons and Templates plugin for WordPress. It enables Stored Cross-Site Scripting in multiple widgets (image hotspot, image accordion, off canvas, woogrid, product mini cart) in all versions up to and including 1.3.975 due to insufficient input sanitizati...

CVE-2024-5501

CVE-2024-5501 affects the Supreme Modules Lite plugin family for WordPress (Divi Theme, Extra Theme and Divi Builder). It is a Stored Cross-Site Scripting (XSS) vulnerability via the button_one_id parameter in all versions up to 2.5.51. Exploitation requires Contributor+ privileges on an authenti...

CVE-2023-6382

CVE-2023-6382 refers to the Master Slider – Responsive Touch Slider WordPress plugin. Affected versions are up to 3.9.9 and the flaw is a Stored Cross-Site Scripting in the ms_slide shortcode due to insufficient input sanitization and output escaping of the css_class attribute. Exploitation requi...

CVE-2024-3564

CVE-2024-3564 concerns the WordPress plugin Content Blocks (Custom Post Widget). Public sources confirm a Local File Inclusion vulnerability via the content_block shortcode in all versions up to 3.3.0, exploitable by authenticated attackers with contributor+ privileges to include and execute arbi...

CVE-2024-3565

CVE-2024-3565 affects Content Blocks (Custom Post Widget) for WordPress. It is a Stored XSS via the content_block shortcode in all versions up to 3.3.0 due to insufficient input sanitization and output escaping on user attributes. Exploitation requires authenticated access at contributor level or...

CVE-2024-4711

CVE-2024-4711 affects the WordPress plugin WordPress Infinite Scroll – Ajax Load More. The vulnerability is a Stored Cross-Site Scripting (XSS) in the ajax_load_more shortcode, due to insufficient input sanitization and output escaping, exploitable by authenticated users with contributor-level pe...

CVE-2024-2933

CVE-2024-2933 affects the Page Builder Gutenberg Blocks – CoBlocks WordPress plugin. It is a Stored Cross-Site Scripting (XSS) vulnerability via the Social Profiles widget present in all versions up to 3.1.9, caused by insufficient input sanitization and output escaping on user-supplied attribute...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Checkpoint Quantum_Spark_Firmware

Exploit for CVE-2024-24919 Description This Python script...

CVE-2024-5138

The CVE-2024-5138 issue affects the snapd component snapctl. The root cause is improper parsing/validation of command-line arguments in snapctl, allowing an unprivileged user to trigger an authorised action on behalf of snapd that would normally require administrator privileges. This could lead t...

CVE-2024-34009

The CVE-2024-34009 issue is described across multiple sources as a vulnerability in Moodle where insufficient checks for ReCAPTCHA enablement allow bypassing checks on the login page, with no impact to other pages. Connected documents identify Moodle 4.3.x installations (prior to 4.3.4) as affect...

CVE-2024-34008

Moodle CSRF risk in analytics management of models: description repeatedly states missing CSRF token in admin tools for analytics models, enabling potential unauthorized admin actions. Root cause: lack of CSRF protection in the analytics-models admin interface. Documented across CVE-2024-34008 en...

CVE-2024-34007

The CVE-2024-34007 vulnerability concerns Moodle’s MFA logout functionality (admin/tool/mfa/auth.php) where the logout flow does not include a required CSRF token, exposing users to CSRF logout. Multiple connected sources (OSV, GHSA/GitHub advisories, Nessus/NVD, Ubuntu OSV) corroborate a CSRF ri...