CVE-2024-4039

CVE-2024-4039 affects Orders Tracking for WooCommerce (WordPress). Unauthenticated attackers can exploit arbitrary shortcode execution via an action that calls do_shortcode without proper validation, impacting all versions up to 1.2.10. A partial patch arrived in 1.2.10 and a full patch in 1.2.11...

CVE-2024-4277

CVE-2024-4277 affects LearnPress – WordPress LMS Plugin. Affected: all WordPress versions up to and including 4.2.6.5. Root cause: insufficient input sanitization and output escaping in the layout_html parameter. Impact: authenticated attackers with contributor-level access can store scripts that...

CVE-2024-34818

CVE-2024-34818 : CSRF vulnerability in WebinarPress (WordPress plugin wp-webinarsystem) affecting versions up to 1.33.17. Connected sources confirm the CSRF issue but do not provide technical exploitation details, root-cause analysis, or a remediation/patch. No further specifics are available in ...

CVE-2024-34816

CVE-2024-34816 is a CSRF vulnerability in the Revmakx WPCal.Io – Easy Meeting Scheduler WordPress plugin (WPCal.io) versions

CVE-2024-34817

CVE-2024-34817 is a CSRF vulnerability in the Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms WordPress plugin. Affected versions are up to 1.2.0 (exact start version not provided). The vulnerability allows unauthorized cross-site actions due to CSRF, with the CVSS/a...

CVE-2024-31113

CVE-2024-31113 is a CSRF vulnerability in Easy Digital Downloads (WordPress plugin) affecting versions up to 3.2.11. The connected Red Hat page repeats this description. Public technical details (exploit method, affected files, precise root cause) are not provided in the documents; remediation st...

CVE-2024-34823

CVE-2024-34823 affects the Kiboko Labs Arigato Autoresponder and Newsletter WordPress plugin. Public data confirms a Cross-Site Request Forgery (CSRF) vulnerability for Arigato Autoresponder and Newsletter releases from before or equal to version 2.7.2.3. The entry specifies the affected product ...

CVE-2024-34828

CVE-2024-34828 is a Cross-Site Request Forgery (CSRF) vulnerability in the Church Admin WordPress plugin. Multiple sources confirm the issue affects Church Admin up to version 4.1.32. The Red Hat entry and Wordfence vulnerability data describe the vulnerability as CSRF/CSRF-like, and the Church A...

CVE-2024-3547

CVE-2024-3547 affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates) on WordPress. The vulnerability is a Reflected Cross-Site Scripting via the google_connect_error parameter in all versions up to 1.5.102, caused by insufficient input sanitization and output escaping. This al...

CVE-2024-3828

Technical details about CVE-2024-3828 are not publicly provided in the supplied documents. No additional specifics on affected versions beyond 1.1.5, root cause, or fixes are available here; monitor for updates.

CVE-2024-30802

The vulnerability CVE-2024-30802 affects Vehicle Management System version 7.31.0.3_20230412. The issue is a privilege escalation originating from the login.html component, as described in multiple sources (NVD/Red Hat/CVE records). The root cause details are not explicitly provided beyond the lo...

CVE-2024-0087

CVE-2024-0087 refers to a vulnerability in NVIDIA Triton Inference Server for Linux where a user can set the logging location to an arbitrary file; if that file exists, logs are appended to it. This can lead to code execution, denial of service, privilege escalation, information disclosure, and d...

CVE-2024-32985

Stellar-core prior to v20.4.0 is affected by a race-condition in a 3rd-party library that could cause core nodes to crash randomly. The issue is mitigated by a code fix included in Stellar-core v20.4.0. Public descriptions note the impact is limited because crashed nodes recover quickly; no explo...

CVE-2024-4686

CVE-2024-4686 affects Campcodes Complete Web-Based School Management System 1.0. The issue is a cross-site scripting vulnerability in the grade parameter of the /view/emarks_range_grade_update_form.php script. The flaws arise from manipulation of the grade argument and may be exploited remotely; ...

CVE-2024-2785

CVE-2024-2785 affects The Plus Addons for Elementor (WordPress). The issue is a Stored Cross-Site Scripting (XSS) in the Age Gate widget due to insufficient input sanitization and output escaping of user-supplied attributes. Affected versions are ≤ 5.4.2. Exploitation requires contributor-level a...

CVE-2024-4193

CVE-2024-4193: Testimonial Slider WordPress plugin is vulnerable to Stored XSS via the testimonialcategory shortcode in versions up to 1.3.2. Authenticated attackers with contributor+ privileges can inject scripts that execute in pages viewed by users. Connected sources confirm the vulnerability ...

CVE-2024-2846

The CVE is for the Visual Footer Credit Remover WordPress plugin. It describes a Stored XSS via the selector parameter in all versions up to 2, caused by insufficient input sanitization and output escaping. The vulnerability requires authenticated, administrator-level access and affects multisite...

CVE-2024-3915

CVE-2024-3915 affects the Swift Framework WordPress plugin (versions up to and including 2.7.31). The root cause is a missing capability check in sf_edit_directory_item(), enabling unauthenticated attackers to modify arbitrary posts/content. Impact per available data is limited to integrity (LOW)...

CVE-2024-4542

CVE-2024-4542 is rejected and not used; please refer to CVE-2024-3548 instead.

CVE-2024-3680

CVE-2024-3680 affects the WordPress plugin Enter Addons – Ultimate Template Builder for Elementor. It is a Stored XSS via the Animation Title widget img tag in all versions up to 2.1.5, requiring authenticated access with Contributor or higher. The vulnerability allows injecting arbitrary scripts...