CVE-2024-32728

CVE-2024-32728 is a CSRF vulnerability in Cozmoslabs Paid Member Subscriptions (WordPress). The entry states: Cross-Site Request Forgery vulnerability affecting Paid Member Subscriptions from n/a through 2.11.0, but the provided documents do not disclose the exact root cause, affected actions wit...

CVE-2024-32947

CVE-2024-32947 is a Cross-Site Request Forgery (CSRF) vulnerability in WP ADA Compliance Check Basic (AlumniOnline Web Services LLC) for WordPress, affecting versions up to 3.1.3. The CVSS base score is 4.3 (Medium); attack vector is network with user interaction required. The available documents...

CVE-2024-32958

CVE-2024-32958 is a CSRF vulnerability in the WordPress plugin Slash Admin that allows Cross‑Site Scripting (XSS). Affected versions are Slash Admin

CVE-2023-25785

CVE-2023-25785 describes a Missing Authorization vulnerability in the WordPress plugin Shoaib Saleem WP Post Rating , enabling functionality misuse for WP Post Rating versions through 2.5. Public sources in the connected documents consistently identify this as an unauthenticated access issue lead...

mdanter/ecc affected by timing vulnerability in cryptographic side-channels

phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library. Paragon Initiative Enterprises hard-forked...

CVE-2022-45852

CVE-2022-45852 is a path traversal vulnerability in the WordPress WP-FormAssembly plugin affecting versions n/a through 2.0.5. It arises from improper limitation of a pathname to a restricted directory, allowing traversal to sensitive files. Documented impacts include (per sources) potential unau...

CVE-2024-32954

CVE-2024-32954 is an Unrestricted Upload of File with Dangerous Type vulnerability in Tribulant Newsletters (WordPress Newsletters plugin). Connected sources confirm the issue affects Newsletters versions up to 4.9.5 and describe it as an unrestricted file upload flaw that could allow an attacker...

CVE-2024-32789

CVE-2024-32789 is a CSRF-to-XSS vulnerability in the Seers WordPress plugin (Seers – GDPR & CCPA Cookie Consent & Compliance). The issue affects Seers versions up to 8.1.0 and has been publicly discussed in Red Hat and Wordfence sources. The vulnerability is described as CSRF that enables XSS, wi...

CVE-2024-32772

CVE-2024-32772 is an Authorization Bypass through a user-controlled key vulnerability in the WordPress plugin ProfileGrid (ProfileGrid – User Profiles, Groups and Communities). The vulnerability affects versions up to and including 5.7.9 . The Red Hat entry confirms the issue title and affected p...

CVE-2024-32702

CVE-2024-32702 is a Reflected XSS in ARForms (WordPress). Affected ARForms versions are up to and including 6.4; patched in 6.4. Exploitation details are not provided in the sources; the vulnerability arises from improper input neutralization during web page generation. Remediation per sources: u...

CVE-2024-32791

CVE-2024-32791 affects Premium Addons for Elementor (LeaP13 Premium Addons for Elementor) with a Stored XSS in versions up to 4.10.25 due to improper input neutralization during web page generation. Affected product: Premium Addons for Elementor. Root cause: insufficient escaping/validation of sh...

CVE-2024-32801

Technical details for CVE-2024-32801 are not provided in the connected documents. No specifics on affected product/version/root cause/fix are given beyond the initial XSS description. Monitor for updates.

CVE-2024-32834

CVE-2024-32834 involves a Stored XSS in the WebToffee WooCommerce Shipping Label plugin. Affected: WooCommerce Shipping Label (plugin) from n/a through 2.3.8. Root cause per description: Improper neutralization of input during web page generation. Impact is Cross‑Site Scripting, with Confidential...

CVE-2024-32710

CVE-2024-32710 describes an unauthenticated SQL Injection in the WP-Recall plugin for WordPress (WP-Recall) up to version 16.26.5, caused by improper neutralization of SQL elements. The description and Red Hat advisory confirm the issue and indicate the affected product/version range is WP-Recall

CVE-2024-28976

Dell Repository Manager is affected by a Path Traversal vulnerability in the API module, impacting versions prior to 3.4.5. The root cause is path traversal that could allow a local attacker with low privileges to gain unauthorized write access to files on the server filesystem with the web appli...

CVE-2024-32716

CVE-2024-32716 affects StreamWeasels Twitch Integration for WordPress (StreamWeasels Twitch Integration). Impact: information exposure to unauthenticated actor; affected versions range up to 1.7.8. CVSS 3.1 base score 5.3 (Network attack vector, Low confidentiality impact, No integrity/availabili...

CVE-2024-32726

Technical details about CVE-2024-32726 are not provided in the connected documents. The initial description lacks specifics beyond a general exposure claim. Monitor for official advisories and vendor patches for updates.

CVE-2024-32780

Technical details about CVE-2024-32780 are not provided in the supplied documents; no information on affected versions, impact, or fixes is available here. Monitor for official advisories/patches.

CVE-2024-32782

CVE-2024-32782 concerns an Information Exposure vulnerability in the HasThemes HT Mega plugin for WordPress, with HT Mega versions listed as affected up to 2.4.7. The Red Hat entry mirrors this description, stating an Exposure of Sensitive Information to an Unauthorized Actor vulnerability affect...

CVE-2024-32788

CVE-2024-32788 concerns FG Joomla to WordPress (a FG Joomla to WordPress plugin) and is described as an Insertion of Sensitive Information into Log File vulnerability. Affected versions are FG Joomla to WordPress: all until 4.20.2. The CVSS data indicates a network-vector issue with low confident...