CVE-2024-34766

CVE-2024-34766 is an XSS flaw in the ChaosTheory WordPress theme (affected: ChaosTheory <= 1.3). The root cause is improper neutralization of input during web page generation, enabling stored XSS when an authenticated user interacts with or views pages generated by the theme. Public documentat...

CVE-2024-34767

CVE-2024-34767 is a Stored XSS vulnerability in the ShopLentor WordPress plugin (formerly WooLentor), affecting ShopLentor up to version 2.8.7. The root cause is improper input neutralization during web page generation, enabling stored XSS. The vulnerability has a patched status in the connected ...

CVE-2024-34769

CVE-2024-34769 affects the WordPress plugin Elegant Blocks (Elegant Blocks – Amazing Gutenberg Blocks). Root cause: Improper neutralization of input during web page generation, enabling Stored XSS. Affected version range: up to 1.7. Impact: Stored XSS in pages generated by the plugin. Patch statu...

CVE-2024-34770

CVE-2024-34770 is a Stored XSS vulnerability in the Popup Maker WP plugin. The issue arises from improper neutralization of user input during web page generation, allowing embedded malicious payloads to be stored and subsequently reflected to users. Affected products: Popup Maker WP versions up t...

CVE-2024-24919: Check Point’s Quantum Gateway comes under Attack as Hackers exploit Zero-Day Vulnerability

Active Exploits target Check Point Security Gateway Zero-Day Information Disclosure flaw Check Point Cybersecurity has issued hotfixes to address a zero-day vulnerability in its VPNs that has been exploited to gain remote access to firewalls and potentially infiltrate corporate networks. On...

CVE-2024-34789

CVE-2024-34789 affects the WordPress plugin “Post Grid Elementor Addon” (and is listed as vulnerable through v2.0.16). The issue is described as a Stored Cross-Site Scripting (XSS) vulnerability in the addon, specifically involving input during web page generation (XSS via title_tag). Affected ra...

CVE-2024-34790

CVE-2024-34790 is a Stored XSS vulnerability described in the initial and connected records as affecting the WordPress plugin ImageMagick Sharpen Resized Images, with the issue arising from improper input neutralization during web page generation. Public details in the documents indicate affected...

CVE-2024-34791

CVE-2024-34791 : Public documents do not include concrete technical details (affected product/versions/root cause/fix). Monitor for updates.

CVE-2024-34793

CVE-2024-34793 is documented as a Stored XSS vulnerability in the WordPress plugin WP Next Post Navi (affected versions: n/a through 1.8.3). The connected Red Hat and NVD entries confirm the issue and describe it as Improper Neutralization of Input During Web Page Generation leading to Stored XSS...

CVE-2024-34794

CVE-2024-34794 : The connected Wordfence details show a stored XSS vulnerability in the WordPress plugin “Tainacan” (Tainacan plugin) affecting versions n/a through 0.21.3. The vulnerability is described in Wordfence as unAuthenticated Stored Cross‑Site Scripting via a vulnerability in Tainacan, ...

CVE-2024-34795

CVE-2024-34795 is a stored XSS in WordPress plugin Tainacan (

CVE-2024-34796

CVE-2024-34796 is a stored XSS for AccessAlly PopupAlly (WordPress PopupAlly) affecting versions up to 2.1.1, per Red Hat and CVE records. The vulnerability arises from improper neutralization of input during web page generation. The connected Red Hat advisory reiterates the same description and ...

CVE-2024-34797

CVE-2024-34797 is a Stored XSS in the WordPress plugin “Simple Popup Manager” by Benoit Mercusot. The vulnerability affects Simple Popup Manager versions from n/a up to 1.3.5, caused by improper input neutralization during web page generation. The CVE entry provides a CVSS v3.1 base score of 5.9 ...

CVE-2024-34801

CVE-2024-34801 is a cross-site scripting vulnerability in the Praison SEO WordPress plugin. Multiple sources confirm it affects the Praison SEO WordPress plugin versions from n/a up to and including 4.0.15, with the issue described as a DOM-based XSS flaw in the plugin’s web page generation/input...

CVE-2024-35631

FV Flowplayer Video Player (WordPress plugin) is affected by CVE-2024-35631: a Reflected Cross-Site Scripting vulnerability in versions up to 7.5.45.7212. The issue arises from improper neutralization of input during web page generation, enabling an attacker to inject scripts that run in a user’s...

CVE-2024-35630

CVE-2024-35630 affects WP TripAdvisor Review Slider (LJ Apps) and is an authenticated SQL Injection in the plugin’s code path, enabling an Administrator+ user to exploit improper input handling. Wordfence details show the vulnerability exists in versions up to 12.6 (including), with CVSS v3.1 bas...

CVE-2024-34754

CVE-2024-34754 is a data-exposure vulnerability affecting the WordPress plugin Contact Form Widget, exposed through versions up to 1.3.9. Root cause is exposure of sensitive information to unauthorized actors, leading to information disclosure. The issue affects the Contact Form Widget component ...

CVE-2024-34798

CVE-2024-34798 corresponds to a vulnerability in the WordPress plugin Debug Log – Manger Tool (Lukman Nakib) that allows unauthenticated exposure of sensitive data via log files. Affected versions range up to 1.4.5; the issue stems from insertion of sensitive information into log files. The CVE i...

CVE-2024-34803

CVE-2024-34803 is a Missing Authorization vulnerability affecting the WordPress Fastly plugin. Public descriptions show impact on Fastly: from n/a through 1.2.25, indicating that all versions up to 1.2.25 are affected. The Red Hat and NVD entries mirror this issue with the same description. The C...

CVE-2024-3829

CVE-2024-3829 affects qdrant/qdrant 1.9.0-dev. The root cause is arbitrary file read/write during the snapshot recovery process via manipulated snapshot files containing symlinks, enabling an attacker to read arbitrary files and write payloads in the snapshot directory. The issue is fixed in vers...