CVE-2024-3313

CVE-2024-3313 concerns vulnerabilities in third-party components used by SUBNET PowerSYSTEM Server 2021 and Substation Server 2021 (versions 4.07.00 and earlier). The root cause is reliance on an insufficiently trustworthy third-party component. The issue has been assigned CVE-2024-3313 with CVSS...

CVE-2024-3521

The CVE-2024-3521 case covers Byzoro Smart S80 Management Platform (versions up to 20240317). The root cause is in /useratte/userattestation.php where the web_img parameter enables unrestricted upload, enabling a remote attacker to upload arbitrary content. Documents indicate the vulnerability is...

CVE-2024-1412

CVE-2024-1412 concerns the WordPress Memberpress plugin. Connected sources confirm a reflected Cross‑Site Scripting (XSS) vulnerability in the plugin’s handling of the message and error parameters, affecting all versions up to 1.11.26. The vulnerability is unauthenticated and could allow an attac...

CVE-2024-2866

CVE-2024-2866 is a placeholder entry that has been superseded by CVE-2024-2509 for the Kadence Blocks WordPress plugin. Connected data show that CVE-2024-2509 details a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks by Kadence Blocks plugin prior to version 3.2.26 , where...

CVE-2024-2138

CVE-2024-2138 concerns the WordPress plugin JetWidgets For Elementor. The Red Hat and Wordfence entries describe a stored cross-site scripting (XSS) vulnerability in the Animated Box widget, affecting all versions up to and including 1.0.15. The issue arises from insufficient input sanitization a...

CVE-2024-2957

CVE-2024-2957 is a duplicate of CVE-2024-1983. The linked Red Hat/NVD details show Simple Ajax Chat for WordPress (before 20240223) suffers a stored XSS via the name field, reflecting unsanitized input to other users. This confirms the vulnerability context, affected component, and root cause; CV...

CVE-2024-1352

CVE-2024-1352 affects the Classified Listing plugin for WordPress (Classified Listing – Classified ads & Business Directory Plugin) up to version 3.0.4. The root cause is a missing capability check in rtcl_import_location() and rtcl_import_category(), enabling authenticated users with subscriber-...

CVE-2024-2347

CVE-2024-2347 concerns the Astra WordPress theme. It is a Stored Cross-Site Scripting (XSS) via a user’s display name in all versions up to and including 4.6.8, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access at contributor level or higher...

CVE-2024-2341

CVE-2024-2341 refers to the WordPress plugin Appointment Booking Calendar — Simply Schedule Appointments (plugin) with SQL Injection via the keys parameter in all versions up to 1.6.7.7, allowing authenticated subscribers to append queries and potentially exfiltrate data. Red Hat and NVD entries ...

CVE-2024-1984

CVE-2024-1984 affects the WordPress Graphene theme (versions ≤ 2.9.2). The issue allows unauthenticated users to access post contents of password-protected posts via a meta tag in the page source, indicating a missing authorization check (low-severity info exposure). Reported by Krzysztof Zając a...

CVE-2024-1458

CVE-2024-1458 : Elementor Addons by Livemesh for WordPress is vulnerable to stored XSS via the Animated Text widget’s text_alignment attribute in all versions up to and including 8.3.4 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level acc...

CVE-2024-1461

Elementor Addons by Livemesh (WordPress) contains a Stored XSS in Team Members widget via the style attribute in all versions up to 8.3.4 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor+ access can inject scripts that execute for users visiting...

CVE-2023-6486

CVE-2023-6486 (Spectra – WordPress Gutenberg Blocks) Stored Cross‑Site Scripting via the Custom CSS metabox in Spectra. Affected: all versions up to 2.10.3. Root cause: insufficient input sanitization and output escaping in the metabox. Impact: authenticated attackers with contributor level or hi...

CVE-2024-1812

CVE-2024-1812 affects the Everest Forms plugin for WordPress, enabling Server-Side Request Forgery via the font_url parameter in all versions up to and including 2.0.7. This allows unauthenticated attackers to issue web requests from the vulnerable site to internal or arbitrary locations, potenti...

CVE-2024-2344

CVE-2024-2344 (Avada Theme for WordPress) : SQL Injection via the 'entry' parameter affects all versions up to 7.11.6. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Exploitation requires editor-level access or higher (authenticated). Impact ...

CVE-2024-2504

CVE-2024-2504 affects Page Builder: Pagelayer (WordPress plugin) up to version 1.8.4. The vulnerability is a stored XSS via the attr parameter caused by insufficient input sanitization/output escaping. Impact: authenticated users with Contributor+ can inject scripts that execute when any user loa...

CVE-2024-1424

CVE-2024-1424 affects GiveWP – Donation Plugin and Fundraising Platform for WordPress. All versions up to 3.5.1 are vulnerable to Stored Cross-Site Scripting via shortcode attributes due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-l...

CVE-2024-1587

CVE-2024-1587 affects the WordPress Newsmatic theme up to version 1.3.0. It enables Sensitive Information Exposure via the newsmatic_filter_posts_load_tab_content, allowing unauthenticated users to view draft posts and post content. The CVSS v3.1 base score is 5.3 (Medium) with network attack vec...

CVE-2024-2222

CVE-2024-2222 (Advanced Classifieds & Directory Pro for WordPress) : Vulnerability due to a missing capability check in ajax_callback_delete_attachment across all versions up to 3.0.0. This allows authenticated users with subscriber+ access to delete arbitrary media uploads, i.e., unauthorized da...

CVE-2024-2325

CVE-2024-2325 concerns the WordPress Link Library plugin. Affected versions up to and including 7.6.6 are vulnerable to a Reflected Cross‑Site Scripting (XSS) flaw via the searchll parameter, caused by insufficient input sanitization and output escaping. This can enable unauthenticated attackers ...