231576 matches found
CVE-2024-35666
CVE-2024-35666 affects the WordPress plugin Themesflat Addons For Elementor up to version 2.1.2. The issue is a Stored XSS via widget tags caused by insufficient input sanitization and output escaping. Exploitation context: authenticated attackers with contributor-level access can inject scripts ...
CVE-2024-35668
CVE-2024-35668 describes a Reflected XSS vulnerability in the Brevo (Newsletter, SMTP, Email marketing and Subscribe forms by Brevo) plugin for WordPress. The issue arises from improper input neutralization during web page generation, enabling reflected cross-site scripting. Affected versions are...
CVE-2024-35782
The CVE-2024-35782 issue affects WordPress plugin Cowidgets – Elementor Addons (versions
CVE-2024-35700
CVE-2024-35700 affects the WordPress plugin “UserPro” (DeluxeThemes) up to version 5.1.8. The issue is described as Improper Privilege Management enabling Unauthenticated Account Takeover with privilege escalation. Impact as stated: confidential and integrity/availability impact; CVSS v3.1 base s...
CVE-2024-35634
CVE-2024-35634 affects the Woocommerce – Recent Purchases plugin for WordPress (versions ≤ 1.0.1). It is a Local File Inclusion due to improper pathname limitation, enabling an authenticated Administrator to include arbitrary server files via path traversal. The Wordfence entry indicates this vul...
CVE-2024-34792
CVE-2024-34792 affects Dextaz Ping (WordPress plugin) up to version 0.65, with an improper neutralization of command elements that enables Command Injection and Remote Code Execution. Connected sources (Red Hat, NVD/WordPress listings) confirm the issue and identify the root cause as improper han...
CVE-2024-34554
CVE-2024-34554 is an authenticated Local File Inclusion (LFI) in Stockholm Core (WordPress plugin) that affects Stockholm Core up to version 2.4.1. Public references confirm the issue and that a patch is available (Stockholm Core patched). Affected product is WordPress Stockholm Core; root cause ...
CVE-2024-34552
CVE-2024-34552 is a Local File Inclusion (path traversal) issue in the WordPress Stockholm theme, affecting Stockholm up to version 9.6. The vulnerability arises from improper pathname limitation, enabling unauthenticated LFI and, in some cases, authenticated LFI against restricted files. The Red...
CVE-2024-34551
CVE-2024-34551 is an unauthenticated path traversal leading to PHP Local File Inclusion in the WordPress theme Stockholm (Stockholm Core) up to version 9.6. Multiple connected sources (NVD and CVE records) confirm: affected product is the Stockholm theme; vulnerability type is path traversal enab...
CVE-2024-34384
CVE-2024-34384 affects Sina Extension for Elementor (WordPress plugin) and is a path traversal that enables PHP Local File Inclusion. Affected versions: up to 3.5.1. Root cause: improper limitation of pathname to restricted directories, allowing local file access via authenticated use (Contributo...
CVE-2024-33628
CVE-2024-33628 is an authenticated local file inclusion vulnerability in the WordPress XforWooCommerce plugin. Affected plugin range: up to and including version 2.0.2; exploitation requires authentication. CVSS 3.1 base score 8.8 (high impact on confidentiality, integrity, and availability). Rem...
CVE-2024-33568
CVE-2024-33568 affects the WordPress plugin BdThemes Element Pack Pro. According to the CVE and corroborating sources, it enables Path Traversal and deserialization of untrusted data, allowing an attacker with at least Contributor+ privileges to perform an arbitrary file read and PHAR deserializa...
CVE-2024-33560
CVE-2024-33560 affects 8theme XStore (WordPress theme). The vulnerability is described as an improper limitation of a pathname to a restricted directory, enabling PHP Local File Inclusion (LFI). The issue impacts XStore versions from n/a up to 9.3.8 (per initial doc) and is echoed in multiple CVE...
CVE-2024-33557
CVE-2024-33557 describes a path traversal vulnerability in 8theme XStore Core (WordPress plugin) that enables PHP Local File Inclusion. Affected range: XStore Core from n/a through 5.3.8. The CVSS metrics indicate high impact (C/H, I/H, A/H) with network attack vector and low attack complexity; p...
CVE-2024-33541
CVE-2024-33541 (Better Elementor Addons) is a Path Traversal flaw in the Better Elementor Addons plugin for WordPress, allowing PHP Local File Inclusion. Affected versions are up to 1.4.1. Root cause: improper limitation of a pathname to restricted directories, enabling access to local files. Imp...
CVE-2024-36800
CVE-2024-36800: A SQL injection vulnerability in SEMCMS v4.8 allows a remote attacker to disclose sensitive information via the ID parameter in Download.php. Root cause: improper handling of the ID parameter enables unauthorized database access. Impact is information disclosure; no exploitation d...
CVE-2024-36801
CVE-2024-36801 affects SEMCMS v4.8. The issue is a SQL injection in the Download.php lgid parameter, stemming from unprotected SQL query structure, enabling a remote attacker to access sensitive information. Affected component is the Download.php handling lgid; root cause is lack of input sanitiz...
CVE-2023-52176
CVE-2023-52176 describes an Authentication Bypass by Spoofing in the Miniorange Malware Scanner (WordPress plugin). Affected products: Malware Scanner from n/a through version 4.7.1. Root cause per entry: bypasses access controls (ACLs) through spoofed authentication, enabling access to functiona...