CVE-2024-4344

CVE-2024-4344 concerns the Shield Security – Smart Bot Blocking & Intrusion Prevention Security WordPress plugin. It is vulnerable to Cross-Site Request Forgery in all versions up to and including 19.1.13. The root cause is missing or incorrect nonce validation on the exec function, enabling unau...

CVE-2024-35645

CVE-2024-35645 affects the WordPress plugin Random Banner (versions up to and including 4.2.8). The vulnerability is described as Stored XSS due to Improper Neutralization of Input During Web Page Generation, enabling an attacker with Administrator privileges to inject malicious scripts that coul...

CVE-2024-35646

CVE-2024-35646 refers to a stored XSS vulnerability in the WordPress plugin Smartarget Message Bar. The available sources identify the issue as improper input neutralization during web page generation, allowing stored Cross‑Site Scripting for authenticated users (admin+). Affected versions are li...

CVE-2024-35647

CVE-2024-35647 concerns a Stored XSS in the WordPress Global Notification Bar plugin (vulnerable up to 1.0.1). The vulnerability is triggered via authenticated admin settings, enabling an attacker with Administrator privileges to inject scripts that could execute in contexts accessed by users. Th...

CVE-2024-4148

CVE-2024-4148 affects lunary-ai/lunary version 1.2.10. A ReDoS vulnerability arises when processing crafted regular expressions, leading to high availability impact (response time degradation or crash) as described in NVD/NVD-linked sources. The PT-2024-29418 entry corroborates the affected versi...

CVE-2024-35636

CVE-2024-35636 is a CSRF vulnerability in the Uploadcare File Uploader and Adaptive Delivery (beta) WordPress plugin. Affected versions are up to and including 3.0.11, with mitigation and fix implemented in version 3.1.0. Patch status indicates the issue was addressed in the 3.1.0 release; fixed ...

CVE-2024-3820

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin (Premium) is affected by an unauthenticated SQL Injection via the id_key parameter of the wdt_delete_table_row AJAX action in versions up to 6.3.1. The root cause is insufficient escaping of the user-supplied parameter and ...

CVE-2024-3200

The CVE-2024-3200 entry concerns the wpForo Forum WordPress plugin. Affected software: wpForo Forum plugin for WordPress, versions up to and including 2.3.3. Root cause: insufficient escaping of the slug parameter in the wpforo shortcode and inadequate SQL query preparation, enabling SQL injectio...

CVE-2024-5348

The Elements For Elementor plugin (WordPress) is affected by CVE-2024-5348: Local File Inclusion in all versions up to 2.1 via multiple widget attributes (beforeafter_layout, eventsgrid_layout, marquee_layout, postgrid_layout, woocart_layout, woogrid_layout). Authenticated attackers with Contribu...

CVE-2024-3821

CVE-2024-3821 concerns the WordPress plugin wpDataTables (Premium) up to version 6.3.2. Root cause: missing capability check in wdt_ajax_actions.php, enabling unauthorized access and data table manipulation by unauthenticated users. A fix is noted in version 6.4 (patched). Provided Connected docu...

CVE-2024-4958

CVE-2024-4958 concerns the WordPress plugin “User Registration – Custom Registration Form, Login Form, and User Profile” up to version 3.2.0.1. The flaw is a missing capability check in the import_form_action function which allows authenticated users with contributor-level permissions and above t...

CVE-2024-2295

The CVE-2024-2295 entry concerns the WordPress plugin Contact Form Manager. Affected versions are all up to and including 1.6.1, where insufficient input sanitization and output escaping on the [xyz-cfm-form] shortcode attributes allows Stored Cross-Site Scripting (XSS). Exploitation requires aut...

CVE-2024-1324

CVE-2024-1324 affects QQWorld Auto Save Images (WordPress)

CVE-2024-2506

The Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the plugin’s Custom JS functionality in all versions up to 4.2.7, due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires at least Contributor-level ...

CVE-2024-4087

CVE-2024-4087 affects the WordPress plugin Royal Elementor Addons and Templates. It enables authenticated users with contributor access and above to trigger a Stored XSS via the Back to Top widget in versions up to and including 1.3.975. Impact is that injected scripts could execute on pages acce...

CVE-2024-4342

CVE-2024-4342 affects the Royal Elementor Addons and Templates plugin for WordPress. It enables Stored Cross-Site Scripting in multiple widgets (image hotspot, image accordion, off canvas, woogrid, product mini cart) in all versions up to and including 1.3.975 due to insufficient input sanitizati...

CVE-2024-5501

CVE-2024-5501 affects the Supreme Modules Lite plugin family for WordPress (Divi Theme, Extra Theme and Divi Builder). It is a Stored Cross-Site Scripting (XSS) vulnerability via the button_one_id parameter in all versions up to 2.5.51. Exploitation requires Contributor+ privileges on an authenti...

CVE-2023-6382

CVE-2023-6382 refers to the Master Slider – Responsive Touch Slider WordPress plugin. Affected versions are up to 3.9.9 and the flaw is a Stored Cross-Site Scripting in the ms_slide shortcode due to insufficient input sanitization and output escaping of the css_class attribute. Exploitation requi...

CVE-2024-3564

CVE-2024-3564 concerns the WordPress plugin Content Blocks (Custom Post Widget). Public sources confirm a Local File Inclusion vulnerability via the content_block shortcode in all versions up to 3.3.0, exploitable by authenticated attackers with contributor+ privileges to include and execute arbi...

CVE-2024-3565

CVE-2024-3565 affects Content Blocks (Custom Post Widget) for WordPress. It is a Stored XSS via the content_block shortcode in all versions up to 3.3.0 due to insufficient input sanitization and output escaping on user attributes. Exploitation requires authenticated access at contributor level or...