CVE-2023-47150

CVE-2023-47150 affects IBM Common Cryptographic Architecture (CCA) versions 7.0.0 through 7.5.36. The vulnerability allows a remote attacker to cause a denial of service due to incorrect data handling for certain AES operations. The issue is documented in IBM advisories for the IBM 4769 Developer...

CVE-2024-29881

TinyMCE is affected by an XSS vulnerability (CVE-2024-29881) in its handling of external SVG content loaded via object/embed during content loading/insertion. The root cause is improper validation of user-supplied input via SVGs, allowing a payload to execute in the context of the hosting site. T...

CVE-2024-29203

TinyMCE contains a cross-site scripting (XSS) vulnerability in its content insertion code that can allow iframe elements to execute malicious scripts. The issue is mitigated by upgrading to TinyMCE v6.8.1 or newer; multiple advisories also note that patches and later versions (e.g., 7.0.0+) addre...

CVE-2024-22156

CVE-2024-22156 concerns the WordPress SalesKing plugin (SalesKing) up to version 1.6.15. The root cause is Missing Authorization, allowing an unauthenticated user to change plugin settings due to missing capability checks. Affected versions are

CVE-2024-2906

CVE-2024-2906 describes a Missing Authorization vulnerability in SoftLab Radio Player (WordPress Radio Player plugin). Publicly available refs corroborate the issue affecting Radio Player versions up to 2.0.73. The Red Hat security entry mirrors the description and notes the affected product as R...

CVE-2024-30235

Technical details about CVE-2024-30235 are not provided in the supplied documents. Public disclosures or vendor advisories are not included here; monitor for updates from the vendor, CVE databases, or security advisories.

CVE-2024-30234

CVE-2024-30234 is a Missing Authorization vulnerability in WholesaleX (Wholesale X – WooCommerce Wholesale Plugin). Public information from Red Hat and CVE records indicates the issue affects WholesaleX versions n/a through 1.3.1. The NVD metrics show CVSS v3.1 base score 8.8 (High) with NETWORK ...

CVE-2024-30233

Technical details about CVE-2024-30233 are not present in the connected documents. Public information in the provided sources is limited to an exposure issue affecting WholesaleX (vulnerable from n/a to 1.3.1). Monitor for updates from vendors/partners.

CVE-2024-30232

Technical details about CVE-2024-30232 are not present in the provided connected documents. The data only references a stored XSS issue in Exclusive Addons for Elementor (up to v2.6.9) without specifics. Monitor official advisories for remediation.

CVE-2024-30231

CVE-2024-30231 refers to an Unrestricted Upload of File with Dangerous Type in WebToffee Product Import Export for WooCommerce (WordPress plugin). Affected: Product Import Export for WooCommerce

CVE-2024-23520

CVE-2024-23520 affects the WordPress PopupAlly (AccessAlly PopupAlly) plugin up to version 2.1.0, categorized as a Broken Access Control / Missing Authorization vulnerability via the optin_submit_callback. Exploitation could allow an attacker with subscriber privileges to influence subscriber opt...

CVE-2024-24711

CVE-2024-24711 refers to a Missing Authorization vulnerability in the WordPress plugin WooCommerce Conversion Tracking (weDevs) affecting versions n/a–2.11. The issue arises from a missing capability check on the wcct_install_happy_addons function, allowing authenticated users (e.g., subscribers)...

CVE-2024-24719

CVE-2024-24719 affects the Kikote – Location Picker at Checkout & Google Address AutoFill for WooCommerce plugin. The vulnerability is Missing Authorization in the checkout_map_rules_order_ajax_handler, enabling unauthorized modification of rule orders in affected installs. Affected versions are ...

CVE-2024-24799

CVE-2024-24799 is a Missing Authorization/Broken Access Control vulnerability in the WordPress plugin “WooCommerce Box Office” (versions

CVE-2024-2904

CVE-2024-2904 affects the WordPress Calliope theme (versions up to 1.0.33). The issue is a Cross-Site Request Forgery (CSRF) vulnerability in the Calliope theme, with PatchStack listing a fix in 1.0.35. Other sources corroborate the CSRF impact and affected range (

CVE-2023-23991

Summary of CVE-2023-23991 (WordPress Booking Calendar plugin) : The vulnerability affects the Booking Calendar plugin for WordPress, specifically versions up to and including 9.4.3. It is caused by improper neutralization of certain elements in SQL queries, resulting in a SQL Injection. The issue...

CVE-2023-7251

CVE-2023-7251 affects the WordPress plugin User Submitted Posts (versions

CVE-2023-41696

CVE-2023-41696 refers to the WordPress plugin User Submitted Posts . The vulnerability is a Stored Cross-Site Scripting (via shortcode) that could be exploited by authenticated users with Contributor+ access to inject scripts on pages. Affected versions are up to 20230901. The connected document ...

CVE-2023-49838

CVE-2023-49838 : CSRF in KlbTheme themes (Clotya up to 1.1.6; Cosmetsy up to 1.7.7; Furnob up to 1.2.2; Bacola up to 1.3.3; Partdo up to 1.1.1; Medibazar up to 1.8.6; Machic up to 1.2.8). Root cause per description: missing CSRF checks in some locations, enabling unauthorized actions via forged r...

CVE-2023-6175

CVE-2023-6175 is a NetScreen file parser crash in Wireshark, affecting Wireshark 4.0.0–4.0.10 and 3.6.0–3.6.18, leading to a denial of service when parsing crafted captures. Connected sources confirm the issue in Wireshark, with exploitation details not provided in the initial documents. Mitigati...