CVE-2024-13303

creationtimestamp| type| source ---|---|--- 2025-01-09 21:16:25+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfdlythl7b2e 2025-01-09 21:38:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lfdnazhipy2e 2025-01-09 22:48:01+00:00| seen|...

CVE-2025-21599

creationtimestamp| type| source ---|---|--- 2025-01-09 16:48:30+00:00| seen| https://infosec.exchange/users/cve/statuses/113799417683833601 2025-01-09 17:15:37+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfd6kb3fkl25 2025-01-09 17:21:06+00:00| seen|...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that stems from improper validation of post types, allowing an attacker to deny service to some users by creating posts with the customplnotification type...

CVE-2025-20166

creationtimestamp| type| source ---|---|--- 2025-01-08 16:15:48+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113793626771738794 2025-01-08 16:27:35+00:00| seen| https://infosec.exchange/users/cve/statuses/113793673111799579 2025-01-08 17:15:42+00:00| seen|...

CVE-2024-12855

The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sbremovead' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-12584

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6.2 via the 'duplicate' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2024-56444

creationtimestamp| type| source ---|---|--- 2025-01-08 02:59:03+00:00| seen| https://infosec.exchange/users/cve/statuses/113790493829149479 2025-01-08 03:15:53+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lf775rpqnh25 2025-01-08 03:40:41+00:00| seen|...

CVE-2024-50603

creationtimestamp| type| source ---|---|--- 2025-01-08 01:09:12+00:00| seen| https://infosec.exchange/users/cve/statuses/113790061901237352 2025-01-08 01:15:28+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lf6yghkmun2f 2025-01-08 01:37:28+00:00| seen|...

PT-2025-1900 · WordPress · The 140+ Widgets | Xpro Addons For Elementor

Name of the Vulnerable Software and Affected Versions: 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress versions up to, and including, 1.4.6.2 Description: The issue allows authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data...

CVE-2024-11635

creationtimestamp| type| source ---|---|--- 2025-01-07 21:01:36+00:00| seen| https://bsky.app/profile/abrahack.bsky.social/post/3lf6kaflqkk2d 2025-01-08 07:20:59+00:00| seen| https://infosec.exchange/users/cve/statuses/113791523823209673 2025-01-08 07:38:26+00:00| published-proof-of-concept|...

CVE-2024-9939

creationtimestamp| type| source ---|---|--- 2025-01-07 21:01:04+00:00| seen| https://bsky.app/profile/abrahack.bsky.social/post/3lf6k7fj6x22d 2025-01-08 08:34:48+00:00| seen| https://infosec.exchange/users/cve/statuses/113791814054818001 2025-01-08 09:12:49+00:00| published-proof-of-concept|...

WordPress SureForms plugin <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure vulnerability

Missing Authorization to Unauthenticated Protected Post Disclosure vulnerability discovered by Lucio Sá in WordPress Plugin SureForms versions = 1.2.2...

CVE-2024-53705

creationtimestamp| type| source ---|---|--- 2025-01-07 12:38:58+00:00| seen| https://vulnerability.circl.lu/bundle/602ffeaf-2425-48cc-967c-0efad9629dd0 2025-01-07 20:37:08+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113788992074892039 2025-01-08 08:57:24+00:00| seen|...

WordPress Category Posts Widget plugin < 4.9.18 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Category Posts Widget versions 4.9.18...

CVE-2024-11282

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that...

WordPress Same but Different – Related Posts by Taxonomy plugin <= 1.0.16 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Same but Different – Related Posts by Taxonomy versions = 1.0.16...

CVE-2024-9638

The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9638

The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9638 Category Posts Widget < 4.9.18 - Admin+ Stored XSS

The Category Posts Widget WordPress plugin before 4.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9638

CVE-2024-9638 affects Category Posts Widget for WordPress (Category Posts Widget) up to version 4.9.17. The issue is improper sanitization/escaping of widget settings, enabling stored XSS by high-privilege users (e.g., Admin) even when unfiltered_html is disallowed (e.g., multisite). The root cau...