CVE-2024-29116

CVE-2024-29116 is a Reflected XSS in IconicWP WooThumbs for WooCommerce. Affected: WooThumbs for WooCommerce by Iconic (vendor Iconic) up to version 5.5.3. Root cause: Improper neutralization of input during web page generation. Impact per sources is cross‑site scripting via crafted input. Mitiga...

CVE-2024-29117

CVE-2024-29117 is a WordPress vulnerability in the WordPress Contact Forms by Cimatti plugin. Connected sources confirm an unauthenticated Stored Cross‑Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation, affecting Cimatti Contact Forms by Cimatti versi...

CVE-2024-29118

CVE-2024-29118 affects the Scrollsequence WordPress plugin. It is a Stored XSS due to improper input neutralization during page generation. Affected: Scrollsequence

CVE-2024-29122

CVE-2024-29122 is a Stored XSS in FV Flowplayer Video Player for WordPress. Affected: FV Flowplayer Video Player versions from n/a up to 7.5.41.7212. Root cause: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting). This CVE description is corroborated by Red Hat’s a...

CVE-2024-1401

CVE-2024-1401 affects Profile Box Shortcode And Widget for WordPress, prior to version 1.2.1. Root cause: settings are not sanitized/escaped, enabling Stored XSS for admin-level users (and higher) even when unfiltered_html is disallowed (e.g., multisite). Impact: Stored XSS could compromise site ...

CVE-2024-29125

CVE-2024-29125 is a Reflected XSS in the WooCommerce Coupon Affiliates plugin (Coupon Affiliates) for WordPress. Affected: Coupon Affiliates up to version 5.12.7. Root cause: Improper neutralization of input during web page generation. Impact: Reflected cross-site scripting possible in pages usin...

CVE-2024-29129

CVE-2024-29129 is a reflected cross-site scripting (XSS) vulnerability in the WordPress plugin “OxyExtras” by WPLIT Pty Ltd. The issue arises from improper neutralization of input during web page generation, enabling an attacker-controlled input to be reflected in the page and execute script in a...

CVE-2024-29130

CVE-2024-29130 is a Reflected XSS in the Contact Form 7 – PayPal & Stripe Add-on affecting versions up to 2.0. The issue allows input handling to generate a reflected script in a user’s browser. Wordfence entries confirm the vulnerability and note that a patched version/update is available; updat...

CVE-2024-29136

CVE-2024-29136 affects the Tourfic WordPress plugin from Themefic, vulnerable to PHP Object Injection via deserialization of untrusted data in all versions up to 2.11.17. The vulnerability requires at least Subscriber+ authentication and could enable attacker-controlled object injection. Public s...

CVE-2024-29139

CVE-2024-29139 affects the WordPress plugin MyCurator Content Curation, with an Unauthenticated Reflected XSS vulnerability in versions n/a through 3.76. The CVSS v3.1 base score is 7.1 (High) with Network attack vector, no privileges, user interaction required, and changed scope; impact to confi...

CVE-2024-29143

Passwordless Login (WordPress plugin)

CVE-2024-2636

The CVE-2024-2636 issue affects Cegid Meta4 HR and is an Unrestricted Upload of File vulnerability. An attacker can upload malicious files via the path /config/espanol/update_password.jsp by modifying the M4_NEW_PASSWORD parameter, enabling a potentially executed JSP file when loaded by the appli...

CVE-2024-2635

CVE-2024-2635 affects Cegid Meta4 HR. The root issue is that configuration pages are exposed on an Internet-facing web server, revealing file paths to the client. This is described as a vulnerability in the product’s configuration pages, with a CVSS 3.1 base score of 7.3 ( NETWORK, LOW complexity...

CVE-2024-2634

CVE-2024-2634 concerns Meta4 HR (Cegid) where versions up to 819.001.022 are affected by a Cross-Site Scripting (XSS) vulnerability in the endpoint /sse_generico/generico_login.jsp, exploitable via the lang query parameter (e.g., /sse_generico/generico_login.jsp?lang=%27%3balert(%27BLEUSS%27)%2f%...

CVE-2024-2616

The CVE-2024-2616 entry describes a vulnerability in ICU handling for out-of-memory conditions that causes a crash instead of continued operation. Affected products include Firefox ESR and Thunderbird versions prior to 115.9. The change is intended to harden against exploitation, with the impact ...

CVE-2024-2614

CVE-2024-2614 is a documented memory-safety issue in Mozilla Firefox and Thunderbird. The core description states memory-safety bugs in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8, with evidence of memory corruption and a potential to be exploited to run arbitrary code. Affected product...

CVE-2024-2615

Summary (CVE-2024-2615) : The incident centers on memory safety bugs in Mozilla Firefox 123 that may allow memory corruption and, with enough effort, arbitrary code execution. The vulnerability affects Firefox versions earlier than 124. The connected sources consistently describe the issue as mem...

CVE-2024-2611

CVE-2024-2611 describes a clickjacking-type vulnerability in Firefox and Thunderbird where a missing delay in pointer lock handling could trick a user into granting permissions. Affected products include Firefox (versions before 124 and ESR before 115.9) and Thunderbird (before 115.9). Connected ...

CVE-2024-2608

CVE-2024-2608 affects Mozilla Firefox (including ESR) and Thunderbird. The issue arises from integer overflow in encoding routines (AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding(), and AppendEncodedCharacters()) that can underallocate an output buffer, leading to an out-of-bounds...

CVE-2024-2606

CVE-2024-2606 concerns Mozilla Firefox: a flaw where passing invalid data could produce invalid WebAssembly (WASM) values, including arbitrary integers that become pointer values. The vulnerability affects Firefox versions older than 124. Root cause described in the documents is improper handling...