CVE-2024-20875

This CVE affects SemClipboard. The vulnerability is due to improper caller verification, enabling a local attacker to access arbitrary files through the SemClipboard component prior to SMR June-2024 Release 1. Impact is confined to local access with confidentiality impact; no exploit details are ...

CVE-2024-20874

CVE-2024-20874 affects Samsung SmartManagerCN prior to SMR Jun-2024 Release 1. The vulnerability is an improper access control that enables local attackers to perform privileged activities. The NVD metrics show a • LOCAL • LOW complexity • NONE/LOW privileges required with HIGH confidentiality, i...

CVE-2024-20873

The CVE-2024-20873 entry concerns an improper input validation vulnerability in the caminfo driver (Samsung Mobile) prior to the SMR Jun-2024 Release 1. The underlying issue allows local privileged attackers to result in a write out-of-bounds memory condition. Documents consistently describe the ...

CVE-2024-5485

CVE-2024-5485 affects the SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! WordPress plugin. The stored XSS exists in the Trigger Link shortcode in all versions up to 1.0.47 (per the CVE description) and can be exploited by an authenticated user with contributor-level a...

CVE-2024-4857

CVE-2024-4857 affects the WordPress plugin “FS Product Inquiry” for versions up to 1.1.1, where user input in form submissions is not sanitized/escaped, enabling unauthenticated Stored XSS. Affected product: FS Product Inquiry WordPress plugin

CVE-2024-4856

CVE-2024-4856 refers to the FS Product Inquiry WordPress plugin (versions ≤ 1.1.1) and describes a reflected XSS flaw. The vulnerability arises from not sanitising/escaping a parameter before echoing it on the page, potentially impacting admins or unauthenticated users. Public sources corroborate...

CVE-2024-2470

CVE-2024-2470 affects the WordPress plugin Simple Ajax Chat, with the issue occurring in versions prior to 20240412. The vulnerability stems from insufficient sanitisation/escaping of certain plugin settings, enabling Stored XSS by high-privilege users (e.g., administrators), even when unfiltered...

CVE-2024-4749

The CVE-2024-4749 entry concerns the WP eMember WordPress plugin (versions before 10.3.9). The vulnerability is a Reflected XSS due to the fieldId parameter not being sanitized/escaped before echo, potentially enabling script injection in output pages. Public details confirm affected software and...

CVE-2024-4750

The CVE-2024-4750 entry concerns the BuddyBoss Platform WordPress plugin prior to 2.6.0, where an Insecure Direct Object Reference (IDOR) allows a user to like a private post by manipulating the post ID in the request (id parameter). Multiple sources (Patchstack, PT-Security, WPVulndb, CVE record...

CVE-2024-4180

CVE-2024-4180 affects The Events Calendar WordPress plugin (versions before 6.4.0.1). The issue is an improper sanitization of user-submitted content when rendering certain AJAX views, which enables cross-site scripting (XSS) in the context of the affected site. Affected product and root cause ar...

CVE-2024-0757

CVE-2024-0757 : The WordPress plugin “Insert or Embed Articulate Content into WordPress” (

CVE-2024-4057

The CVE-2024-4057 issue affects Gutenberg Blocks with AI by Kadence WP for WordPress, where certain block attributes are not validated/escaped before they are output in a page/post containing the block. This can allow stored XSS by users with contributor role and above. Root cause: output of unva...

CVE-2024-4997

CVE-2024-4997 concerns WPUpper Share Buttons for WordPress, claiming unauthorized access to password‑protected post/page contents up to version 3.43. The provided connected documents do not supply technical details, affected versions beyond 3.43, root cause, exploit info, or fixes.

CVE-2024-4462

CVE-2024-4462 concerns the Nafeza Prayer Time WordPress plugin. The description indicates a Stored Cross‑Site Scripting vulnerability in admin settings for all versions up to 1.2.9, caused by insufficient input sanitization and output escaping. The issue affects multisite installations and sites ...

CVE-2024-4273

CVE-2024-4273 involves the Essential Real Estate WordPress plugin, enabling Stored XSS via the ere_property_map shortcode in all versions up to 4.4.2 due to insufficient input sanitization and output escaping. The vulnerability requires authenticated access (Contributor level or higher) and could...

CVE-2024-4697

CVE-2024-4697 is a WordPress plugin issue in Cowidgets – Elementor Addons. The vulnerability is a Stored Cross‑Site Scripting via the heading_tag parameter in all versions up to 1.1.1, caused by insufficient input sanitization and output escaping. It enables authenticated attackers with contribut...

CVE-2024-3230

The WordPress Download Attachments plugin is vulnerable to Stored XSS in all versions up to 1.3 via the download-attachments shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authenticated access (contributor level or higher) a...

CVE-2024-4274

Technical details about CVE-2024-4274 are not provided in the supplied documents. The entries reference the Essential Real Estate WordPress vulnerability but do not include affected versions, exploit info, or remediation specifics. Monitor for official advisories.

CVE-2024-3031

CVE-2024-3031 refers to a Stored XSS in the Fluid Notification Bar plugin for WordPress, affecting versions up to and including 3.2.3. The vulnerability exists due to insufficient input sanitization and output escaping in admin settings, enabling an authenticated attacker with administrator-level...

CVE-2024-2382

CVE-2024-2382 affects the Authorize.net Payment Gateway For WooCommerce plugin for WordPress. The root cause is that the plugin does not properly verify the authenticity of the request that updates an order’s payment status, enabling an unauthenticated attacker to set the status to paid and bypas...