CVE-2024-5439

CVE-2024-5439 : Blocksy Theme for WordPress is vulnerable to Reflected XSS via the custom_url parameter in all versions up to 2.0.50. Exploitation requires a user to click a crafted link (unauthenticated). A fix is available in Blocksy 2.0.51 (per changeset showing new version). If upgrading is n...

CVE-2024-4939

CVE-2024-4939 | Weaver Xtreme Theme Support (WordPress) is affected by a Stored XSS via the div shortcode in all versions up to 6.4. The issue allows authenticated attackers with contributor-level access and above to inject scripts that execute when users load the affected pages. The vulnerabilit...

CVE-2024-5453

CVE-2024-5453 affects the ProfileGrid – User Profiles, Groups and Communities WordPress plugin. It enables unauthorized data modification via a missing capability check in pm_dismissible_notice and pm_wizard_update_group_icon across all versions up to 5.8.6. Authentication required: attackers wit...

CVE-2024-5006

CVE-2024-5006 (Boostify Header Footer Builder for Elementor, WordPress) is a Stored XSS vulnerability in the size parameter affecting all versions up to 1.3.2. The issue stems from insufficient input sanitization and output escaping, allowing an authenticated attacker (Contributor level or higher...

CVE-2024-4088

CVE-2024-4088 affects Gutenberg Blocks and Page Layouts – Attire Blocks for WordPress. The vulnerability arises from a missing capability check in the disable_fe_assets function (affecting all versions up to 1.9.2) which can allow authenticated attackers with subscriber access or higher to modify...

CVE-2024-5222

CVE-2024-5222: Stored XSS in the Responsive Addons WordPress plugin via the file uploader; affects all versions up to 3.0.5 and requires authentication (Author level or higher). A patch/update is available per connected disclosures; apply the vendor/maintainer update to remediate.

CVE-2024-1164

CVE-2024-1164 (Brizy – Page Builder for WordPress) stores cross-site scripting via the plugin’s form functionality. Connected sources confirm Brizy versions up to 2.4.43 are affected, with the vulnerability caused by insufficient input sanitization and output escaping on user-supplied error messa...

CVE-2024-2368

CVE-2024-2368 concerns Mollie Forms for WordPress. The flaw is CSRF due to missing/incorrect nonce validation in duplicateForm(), enabling unauthenticated attackers to trigger form duplication via forged requests if a site admin is enticed to click a link. Affected: all versions up to 2.6.13. The...

CVE-2024-4886

CVE-2024-4886 describes an IDOR vulnerability in the WordPress BuddyBoss Platform plugin where an authenticated user (Subscriber+) can comment on a private post by manipulating the numeric ID in the request. The issue is labeled as an insecure Directory Object Reference and affects BuddyBoss Plat...

CVE-2024-3667

The Brizy – Page Builder WordPress plugin contains a Stored XSS in the Brizy widgets’ Link To field (CVE-2024-3667). Affected versions are all up to and including 2.4.43. Exploitation requires authentication at contributor level or higher, enabling an attacker to inject scripts that run on pages ...

CVE-2024-1940

The CVE-2024-1940 entry concerns Brizy – Page Builder for WordPress. Affected: Brizy Page Builder plugin for WordPress versions up to and including 2.4.41. Root cause: insufficient client-side input sanitization and output escaping in post content. Impact: Stored Cross-Site Scripting that can be ...

CVE-2024-2087

CVE-2024-2087 – Brizy (Brizy – Page Builder) for WordPress is a Stored Cross-Site Scripting (XSS) in which form name values are not properly sanitized/escaped, affecting all versions up to 2.4.43. This allows unauthenticated attackers to inject arbitrary JavaScript that executes when users load t...

CVE-2024-4295

CVE-2024-4295 affects the WordPress plugin Email Subscribers by Icegram Express . It is an unauthenticated SQL injection via the hash parameter in all versions up to 5.7.20 caused by insufficient escaping and poor SQL query preparation. Exploitation could enable attackers to append additional SQL...

CVE-2024-1161

CVE-2024-1161 applies to the Brizy – Page Builder for WordPress. It is a Stored XSS in the plugin’s Custom Attributes for blocks, caused by insufficient input sanitization and output escaping in all versions up to 2.4.43. Exploitation requires authentication at contributor level or higher, allowi...

CVE-2024-5149

The vulnerability CVE-2024-5149 affects the BuddyForms WordPress plugin (all versions up to and including 2.8.9). It enables an Email Verification Bypass due to an insufficiently random activation code, allowing unauthenticated attackers to bypass email verification. Wordfence reports this issue ...

CVE-2024-5262

CVE-2024-5262 concerns a vulnerability in the SMB server component of ProjectDiscovery Interactsh. Technical details in connected sources identify that remote attackers can read/write any files within the directory and subdirectories where the interactsh-server runs, via anonymous login. This con...

CVE-2024-5483

LearnPress – WordPress LMS Plugin (LearnPress) CVE-2024-5483: Sensitive Information Exposure in all versions up to 4.2.6.8 due to an incorrect implementation of get_items_permissions_check, allowing unauthenticated attackers to retrieve basic user data, including emails. Remediation provided by c...

CVE-2024-5317

CVE-2024-5317 affects the Newsletter – Send awesome emails from WordPress plugin. It remains vulnerable to Stored XSS via the np1 parameter in all versions up to 8.3.4 due to insufficient input sanitization and output escaping. The issue allows unauthenticated attackers to inject script code into...

CVE-2024-5636

CVE-2024-5636 affects itsourcecode Bakery Online Ordering System 1.0. The vulnerability is in the file report/index.php, where manipulation of the argument procduct leads to SQL injection. The issue is exploitable remotely and has been publicly disclosed. Documentation lists high-severity impact ...

CVE-2024-4084

CVE-2024-4084 affects mintplex-labs/anything-llm. The issue is a Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, enabling access to internal assets and services. Attackers can bypass intranet IP filters (192/172/10/127) and protocol restrictions by using a...