CVE-2024-33594

CVE-2024-33594 affects Leaky Paywall for WordPress. Connected docs confirm a Missing Authorization vulnerability that enables price manipulation of memberships in versions up to 4.20.8. The root cause is lack of authorization control over the price field, allowing unauthenticated manipulation. No...

CVE-2024-33595

Technical details (exploit, impact, fixed version) for CVE-2024-33595 are not provided in the connected documents; the initial entry notes a missing authorization issue affecting Master Addons for Elementor up to 2.0.5.4.1. Monitor for updates.

CVE-2024-33597

Technical details for CVE-2024-33597 are not provided in the connected documents. The available sources do not disclose product/version/root cause/impact. Monitor official disclosures for updates and remediation information.

CVE-2024-33538

Technical details about CVE-2024-33538 are not provided in the supplied documents. The materials mention sensitive information exposure in the Assistant – Everyday Productivity Apps plugin but lack root cause, affected versions, or fixes. Monitor for official advisories.

CVE-2024-33584

CVE-2024-33584 describes an Open Redirect vulnerability in the Video Conferencing with Zoom WordPress plugin. It affects the plugin from n/a up to and including version 4.4.4. The CVSS 3.1 score is 4.7 (Medium) with network attack vector, low complexity, no privileges, but user interaction requir...

CVE-2024-33553

CVE-2024-33553 is a Deserialization of Untrusted Data vulnerability affecting 8theme XStore Core (from n/a to 5.3.5). Root cause: PHP object injection via deserialization of untrusted data. Impact: per sources, high/critical risk with potential full compromise (CIA: High; network vector; no user ...

CVE-2024-3196

CVE-2024-3196 affects MailCleaner up to version 2023.03.14, impacting the SOAP Service’s dumpConfiguration path (getStats/Services_silentDump/Services_stopStartMTA/Config_saveDateTime/Config_hostid/Logs_StartGetStat). The underlying issue is an OS command injection in the SOAP Service, with local...

CVE-2024-3195

The CVE-2024-3195 entry concerns MailCleaner, affecting the Admin Endpoints component. A path traversal vulnerability exists that can be exploited remotely, with details publicly disclosed. The issue is described as critical, and a patch is recommended to remediate. Specific affected versions are...

CVE-2024-3191

CVE-2024-3191 affects MailCleaner up to version 2023.03.14. The issue arises from a vulnerability in the Email Handler, enabling remote OS command injection. The exploit is publicly disclosed and may be used. A patch is advised to fix the issue. Connected documents confirm vulnerability details a...

CVE-2024-33559

CVE-2024-33559 describes an unauthenticated SQL injection in the WordPress XStore Theme. Affected versions are

CVE-2024-33681

The CVE-2024-33681 entry concerns the WordPress plugin Regenerate post permalink (versions n/a through 1.0.3). The connected documents describe a CSRF vulnerability that enables Cross-Site Scripting (XSS) due to missing or incorrect nonce validation on a function. Unauthenticated attackers could ...

CVE-2024-2505

CVE-2024-2505 affects the GamiPress WordPress plugin prior to version 6.8.9. The vulnerability is a broken access control flaw that allows Authors to manipulate requests and extend access to lower-privilege users (e.g., Subscribers) despite configuration limits. The connected documents confirm th...

CVE-2024-33686

CVE-2024-33686 is a Missing Authorization vulnerability affecting multiple Extend Themes products (Pathway until 1.0.15; Hugo WP until 1.0.8; Althea WP until 1.0.13; Elevate WP until 1.0.15; Brite until 1.0.11; Colibri WP until 1.0.94; Vertice until 1.0.7). The CVE has a CVSSv3.1 base score of 4....

CVE-2024-4302

CVE-2024-4302 describes a Cross-site Scripting (XSS) in the Super 8 Live Chat platform where unauthenticated remote attackers can inject JavaScript into chat messages due to inadequate input filtering. The recipient viewing the message can execute the injected script in their browser. Connected s...

CVE-2024-33537

The CVE-2024-33537 entry describes a Stored XSS in WP Portfolio (Theme Horse WP Portfolio) affecting WP Portfolio versions up to 2.4. Root cause is improper neutralization of input during web page generation. The CVSS vector indicates Network access, Low attack complexity, and user interaction re...

CVE-2024-33548

CVE-2024-33548 affects WooCommerce Amazon Affiliates (WooZone) WordPress plugin

CVE-2024-33554

CVE-2024-33554 : Reflected XSS in 8theme XStore Core due to improper input neutralization during web page generation. Affected: XStore Core from n/a up to 5.3.5. Consequences include potential script execution in a victim’s browser when interacting with vulnerable pages. Connected sources (e.g., ...

CVE-2024-33571

CVE-2024-33571 is a Reflected XSS vulnerability in VOD Infomaniak (Infomaniak Staff VOD) for WordPress. The vulnerability affects VOD Infomaniak versions from n/a up to 1.5.6 and is triggered via improper input handling during web page generation. The connected Wordfence/KV data confirms the exis...

CVE-2024-33640

CVE-2024-33640 is a stored XSS in the Pretty Google Calendar WordPress plugin (LBell Pretty Google Calendar) affecting versions up to 1.7.2. Root cause: improper neutralization of user input during web page generation, enabling stored cross-site scripting. Impact per CVSS: low confidentiality, in...

CVE-2024-33645

CVE-2024-33645 refers to an “Improper Neutralization of Input During Web Page Generation” in the Easy Set Favicon WordPress plugin (affected: Easy Set Favicon, up to version 1.1, has n/a as lower bound). The vulnerability enables a Reflected XSS as stated in the CVE description. Core details from...