CVE-2024-2019

CVE-2024-2019 affects WP-DB-Table-Editor for WordPress. The Red Hat entry states the vulnerability arises from missing default capability checks on the dbte_render function in all versions up to 1.8.4, enabling authenticated attackers with contributor access and above to modify database tables co...

CVE-2024-3555

CVE-2024-3555 affects the WordPress plugin “Social Link Pages: link-in-bio landing pages for your social media profiles”. The root cause is a missing capability check in import_link_pages() across versions up to and including 1.6.9, enabling unauthenticated attackers to create arbitrary pages and...

CVE-2024-1717

CVE-2024-1717 affects the Admin Notices Manager plugin for WordPress. A missing capability check in handle_ajax_call() (all versions through 1.4.0) allows authenticated users with subscriber-level access or higher to retrieve the emails of registered users. The provided documents do not specify a...

CVE-2024-3888

CVE-2024-3888 affects tagDiv Composer (td-composer) for WordPress; stored XSS via the button shortcode in all versions up to 4.8 due to insufficient input sanitization and output escaping of user attributes. Attack requires contributor-level auth or higher and can inject scripts on pages loaded b...

CVE-2024-4552

CVE-2024-4552 affects the Social Login Lite For WooCommerce plugin for WordPress. Versions up to and including 1.6.0 are vulnerable to an authentication bypass due to insufficient verification of the user during social login, allowing unauthenticated attackers to log in as any existing user (e.g....

CVE-2024-4870

CVE-2024-4870 affects the WordPress plugin Frontend Registration – Contact Form 7. The vulnerability arises from insufficient restriction on the cf7frr post meta, in versions up to and including 5.1, enabling authenticated attackers with editor-level access and higher to modify the default user r...

CVE-2024-29976

Zyxel NAS326/NAS542 are affected by CVE-2024-29976 due to improper privilege management in the show_allsessions command. An authenticated attacker could obtain a logged-in administrator’s session cookies. Remediation is to upgrade to firmware versions V5.21(AAZF.17)C0 (NAS326) or V5.21(ABAG.14)C0...

CVE-2024-29975

CVE-2024-29975 relates to Zyxel NAS326 and NAS542 devices where an improper privilege management in the SUID executable binary could allow an authenticated local admin to run commands as root. Affected: NAS326 before V5.21(AAZF.17)C0 and NAS542 before V5.21(ABAG.14)C0. Impact is elevated privileg...

CVE-2024-29974

CVE-2024-29974 affects Zyxel NAS326 and NAS542 devices via a remote code-execution flaw in the CGI program file_upload-cgi. An unauthenticated attacker can upload a crafted configuration file to execute arbitrary code. Affected firmware versions are NAS326 before V5.21(AAZF.17)C0 and NAS542 befor...

CVE-2024-29973

CVE-2024-29973 affects Zyxel NAS326 (firmware < V5.21(AAZF.17)C0) and NAS542 (firmware

CVE-2024-29972

CVE-2024-29972 affects Zyxel NAS326 (firmware < V5.21(AAZF.17)C0) and NAS542 (firmware

CVE-2024-29152

The CVE-2024-29152 issue affects Samsung Exynos baseband software in multiple processors (Samsung Mobile Processor, Wearable Processor, Exynos 980–2400; Exynos Modem 5123–5300). The root cause is improper handling of states in the RRC Reconfiguration message, which can lead to disclosure of sensi...

CVE-2023-28492

CVE-2023-28492 affects CodePeople CP Multi View Event Calendar (WordPress plugin)

CVE-2023-27460

CVE-2023-27460 affects WordPress CP Contact Form with Paypal plugin, <=1.3.34, due to Missing Authorization that could enable feedback submission abuse. A fix is available: upgrade to version 1.3.35. Public advisories show differing CVSS assessments (NVD: 8.8 HIGH; Patchstack: 4.3 MEDIUM), but...

CVE-2023-27437

CVE-2023-27437 applies to the WordPress Event Espresso 4 Decaf plugin. It describes a Missing Authorization vulnerability in Decaf, allowing functionality misuse for unauthenticated users on versions up to and including 4.10.44; mitigation is to upgrade to 4.10.45.decaf (patched). The issue is lo...

CVE-2023-26523

CVE-2023-26523 affects the WordPress plugin Calculated Fields Form (versions up to 1.1.120). The root cause is Missing Authorization, enabling functionality misuse through feedback submission. Public reports describe the vulnerability as a Missing Authorization issue in Calculated Fields Form tha...

CVE-2023-26521

CVE-2023-26521 affects the WordPress plugin Search in Place (

CVE-2023-24373

The CVE-2023-24373 entry concerns the WordPress Booking calendar, Appointment Booking System plugin. Affected versions are ≤ 3.2.3, and the root cause is an External Control of Assumed-Immutable Web Parameter that allows bypass by manipulating hidden fields. The vulnerability is categorized as a ...

CVE-2023-23738

CVE-2023-23738 affects the WordPress Spectra integration in the Ultimate Addons for Gutenberg plugin (Spectra blocks) up to version 2.3.0. The issue is an Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) that enables unauthenticated email spoofing/C...

CVE-2023-23735

CVE-2023-23735 affects the WordPress Spectra (WordPress Gutenberg Blocks) plugin. Vulnerable if using Spectra ≤ 2.3.0, where improper neutralization of script-related HTML tags enables unauthenticated email HTML injection (content injection). Root cause: inadequate input/output sanitization in th...