Kimsuky APT Deploying Linux Backdoor Gomir in South Korean Cyber Attacks

The Kimsuky aka Springtail advanced persistent threat APT group, which is linked to North Korea's Reconnaissance General Bureau RGB, has been observed deploying a Linux version of its GoBear backdoor as part of a campaign targeting South Korean organizations. The backdoor, codenamed Gomir, is...

CVE-2023-51546

CVE-2023-51546 is an authority-listed vulnerability in the WordPress plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels (affected: up to version 4.2.1). The issue stems from Improper Privilege Management that enables Privilege Escalation . The vulnerability affects...

CVE-2023-51483

CVE-2023-51483 affects Glowlogix WP Frontend Profile for WordPress. The vulnerability is an Unauthenticated Privilege Escalation caused by Improper Privilege Management in the plugin, impacting WP Frontend Profile versions up to 1.3.1. Public disclosures in the connected documents confirm the iss...

CVE-2023-51481

CVE-2023-51481 concerns the WordPress plugin “Local Delivery Drivers for WooCommerce.” Multiple sources confirm an improper privilege management flaw that enables unauthenticated privilege escalation, affecting versions up to 1.9.0 (vendor/plugin name varies slightly across sources). The issue is...

CVE-2023-51479

CVE-2023-51479 is an authenticated privilege-escalation vulnerability in the WordPress plugin Build App Online . The issue affects versions

CVE-2023-51476

The connected data confirms CVE-2023-51476 affects the WP MLM Unilevel WordPress plugin (

CVE-2023-51424

CVE-2023-51424 affects WebinarIgnition (WordPress Webinar plugin) up to version 3.05.0. The issue is an unauthenticated privilege escalation due to improper privilege management. Public details in Wordfence/EU listings show an in-the-wild risk with a CVSS v3.1 base score of 9.8 (CRITICAL), networ...

CVE-2023-51401

Technical details (affected version, root cause, exploit vectors, and patch status) for CVE-2023-51401 are not provided in the connected documents. Monitor vendor advisories and CVE records for updates and remediation specifics.

CVE-2023-51398

CVE-2023-51398 is an authentication‑related vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder. The issue stems from improper privilege management that enables Privilege Escalation for authenticated users (Contributor+), potentially granting higher privileges than allowed. Affec...

CVE-2023-51356

CVE-2023-51356 corresponds to an Imp roper Privilege Management vulnerability in Repute Infosystems ARMember (WordPress plugin) affecting ARMember up to version 4.0.10. The issue allows Privilege Escalation for authenticated users (Subscriber+). The CVE details in connected sources indicate that ...

CVE-2023-49753

CVE-2023-49753 affects the Adifier System WordPress plugin and is a Local File Inclusion vulnerability caused by improper pathname restrictions in the Adifier System before 3.1.4. The issue enables unauthenticated local file inclusion, contributing to potential code execution or sensitive data ex...

CVE-2023-48319

CVE-2023-48319 affects the WordPress plugin Salon booking system (salon-booking-system) up to version 8.6. It is an Improper Privilege Management vulnerability that enables Privilege Escalation for users with Editor-level access, potentially granting Administrator privileges. The issue is fixed i...

CVE-2023-47782

CVE-2023-47782 pertains to Thrive Theme Builder prior to version 3.24.0 and is an authenticated privilege-escalation vulnerability. Public documentation confirms that an authenticated user with Subscriber privileges could elevate their access due to improper privilege management in Thrive Theme B...

CVE-2023-47683

The CVE-2023-47683 entry concerns the miniOrange WordPress Social Login and Register plugin (Discord, Google, Twitter, LinkedIn). The root cause is improper privilege management that allows authenticated users with Subscriber access to escalate to Administrator. Affected versions are up to 7.6.6;...

CVE-2023-46205

CVE-2023-46205 : Local File Inclusion in the WordPress plugin Ultimate Addons for WPBakery Page Builder. Affected versions: up to 3.19.14. Root cause: improper limitation of a pathname to restricted directories (path traversal) leading to PHP Local File Inclusion. Impact (per CVE metrics): potent...

CVE-2023-45652

CVE-2023-45652: WordPress Remote Content Shortcode

CVE-2024-24873

CVE-2024-24873 : Improper Control of Interaction Frequency in CodePeople CP Polls allows a polling limit bypass (flooding) in versions up to 1.0.71 . A fix is available in version 1.0.72 . The CVSS v3.1 base score is 5.3 (Medium) , with unauthenticated access required. Public exploitation status ...

CVE-2024-24874

CVE-2024-24874 affects WordPress plugin CP Polls up to version 1.0.71, where unauthenticated content injection is possible due to insufficient validation of poll answers. The vulnerability is categorized as Content Injection with a low CVSS (5.3) and is mitigated by upgrading to version 1.0.72, w...

CVE-2023-41957

CVE-2023-41957 affects WordPress Simple Membership Plugin (

CVE-2023-41956

The CVE-2023-41956 entry concerns WordPress Simple Membership (smp7) with an Improper Authentication flaw that allowed an authenticated user to takeover accounts via the password reset flow. Affected versions are Simple Membership up to 4.3.4; patched in 4.3.5. Reports from NVD/Red Hat/Wordfence ...