CVE-2024-2676

CVE-2024-2676 affects Campcodes Online Job Finder System 1.0, specifically an SQL injection in the /admin/company/controller.php file via the id parameter. A remote attacker could exploit this, and public disclosures exist (VDB-257376, multiple citations). The vulnerability stems from an unspecif...

CVE-2024-2538

CVE-2024-2538 impacts Permalink Manager Lite for WordPress. The issue stems from a missing capability check in the ajax_save_permalink path, allowing authenticated users with author access or higher to modify permalinks of arbitrary posts. Affected versions are all up to and including 2.4.3.1. Pu...

CVE-2024-2674

The CVE describes a SQL injection in Campcodes Online Job Finder System 1.0, affecting the /admin/employee/index.php file via the id parameter. This remote vulnerability can be triggered without user interaction and has publicly disclosed exploit information. The exact impact is SQL injection com...

CVE-2024-2673

CVE-2024-2673 affects Campcodes Online Job Finder System v1.0. The vulnerability resides in the /admin/login.php file, where manipulation of the user_email parameter enables a SQL injection. Exploitation is remotely possible and has been disclosed publicly (VDB-257373). Multiple sources corrobora...

CVE-2023-7246

CVE-2023-7246 is tied to the WordPress plugin System Dashboard prior to version 2.8.10. The issue arises because the plugin does not sanitize and escape certain parameters, enabling authenticated multisite administrators to perform Cross-Site Scripting through header manipulation, specifically vi...

CVE-2024-0337

CVE-2024-0337 corresponds to an Open Redirect vulnerability in the Travelpayouts: All Travel Brands in One Place WordPress plugin. Connected data shows the issue arises from insufficient validation of the travelpayouts_redirect variable, enabling unauthenticated attackers to steer users to potent...

CVE-2024-0856

Summary: CVE-2024-0856 affects the WordPress plugin “Appointment Booking Calendar” prior to version 1.3.83. The issue is the absence of CSRF checks in certain areas, enabling logged-in users to be induced into performing unwanted actions (e.g., adding a booking without paying). Impact per sources...

CVE-2024-1983

CVE-2024-1983 affects the WordPress plugin Simple Ajax Chat (formerly Simple Ajax Chat – Add a Fast, Secure Chat Box). The Red Hat/NVD description (and related sources) state the issue is that the plugin does not prevent visitors from using malicious Names in chat, which are reflected unsanitized...

CVE-2024-2474

CVE-2024-2474 affects the WordPress plugin Standout Color Boxes and Buttons . It is a Stored Cross‑Site Scripting (XSS) vulnerability in the plugin’s color-button shortcode, present in all versions up to and including 0.7.0. The root cause is insufficient input sanitization and output escaping on...

CVE-2024-2124

CVE-2024-2124 (Weglot for WordPress) : Stored XSS in Translate WordPress and go Multilingual – Weglot due to insufficient input sanitization and output escaping on widget/block attributes (e.g., className). Affected versions: up to and including 4.2.5. Exploitation requires authenticated access a...

CVE-2024-2670

CVE-2024-2670 affects Campcodes Online Job Finder System 1.0. The vulnerability is a SQL injection in the unknown function of the file /admin/vacancy/index.php , triggered by manipulating the id parameter. Exploitation is possible remotely and the vulnerability has been disclosed publicly. There ...

CVE-2024-2255

The CVE concerns the WordPress plugin Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates. It describes a Stored XSS flaw in the plugin’s widgets due to insufficient input sanitization and output escaping on user-supplied attributes (e.g., listStyle) in versions up to 4.5.2. Ex...

CVE-2024-1799

CVE-2024-1799 affects GamiPress (WordPress) up to version 6.8.6. Root cause: SQL Injection via the achievement_types parameter in the gamipress_earnings shortcode, caused by insufficient escaping and inadequate SQL query preparation. Impact per sources: authenticated users with contributor-level ...

CVE-2024-2384

CVE-2024-2384 affects the WooCommerce POS plugin for WordPress. Versions ≤ 1.4.11 expose potentially sensitive user data due to insufficient authentication/authorization checks, allowing authenticated users with customer-level access (or higher) to view other users’ information by abusing an orde...

CVE-2024-2460

Summary: The WordPress plugin GamiPress – Button is affected by a stored XSS via the shortcode gamipress_button in versions up to 1.0.7, due to insufficient input sanitization and output escaping. This can be exploited by authenticated users with contributor-level permissions or higher to inject ...

CVE-2024-1995

CVE-2024-1995 : The Smart Custom Fields WordPress plugin insecurely exposes post content due to a missing capability check in relational_posts_search() in all versions up to and including 4.2.2. This allows authenticated users with Subscriber+ privileges to retrieve password‑protected or private ...

CVE-2024-1787

CVE-2024-1787 affects the WordPress plugin “Contests by Rewards Fuel.” The vulnerability is a Stored XSS via the update_rewards_fuel_api_key parameter in all versions up to and including 2.0.64. Exploitation requires contributor-level access or higher (authenticated). The underlying issue is insu...

CVE-2024-2387

The CVE-2024-2387 entry concerns the WordPress plugin Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms. Affected versions are all up to and including 1.82.0, due to insufficient escaping of the integration_id parameter and inadequate query pr...

CVE-2024-29469

CVE-2024-29469 involves a stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4. The issue stems from the Lab module’s Category List parameter, where user-supplied data is not properly filtered/escaped, allowing attackers to inject and execute arbitrary web scripts or HTML in the cont...

CVE-2024-28571

CVE-2024-28571 affects FreeImage v3.19.0 (r1909). The vulnerability is a buffer overflow in fill_input_buffer() while reading JPEG images, enabling a local attacker to cause a DoS. Documents consistently describe a local attack vector with low privileges and no user interaction, yielding a High i...