CVE-2023-52144

CVE-2023-52144 is a Path Traversal in the RexTheme Product Feed Manager (WordPress plugin). Connected Red Hat/ENISA/NVD entries confirm this as an Improper Limitation of a Pathname to a Restricted Directory affecting RexTheme Product Feed Manager up to version 7.3.15. The Red Hat entry notes the ...

CVE-2024-2857

The Simple Buttons Creator WordPress plugin (versions 1.04 and earlier ) is vulnerable to multiple security flaws in its add button function. The root causes include a lack of authorization and CSRF protection, allowing unauthenticated users to call the function directly or via CSRF attacks . Add...

CVE-2024-2836

The Social Share, Social Login and Social Comments Plugin (also known as Super Socializer ) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 7.13.64 . The root cause is the failure to properly sanitize and escape certain plugin settings before they are display...

CVE-2024-1846

The Responsive Tabs WordPress plugin (versions

CVE-2024-1712

The Carousel Slider WordPress plugin (versions before 2.2.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to sanitize and escape certain settings. This flaw could allow high-privilege users, such as admins , to perform XSS attacks even when the unfiltered_html capability i...

CVE-2024-1755

The NPS computy WordPress plugin (versions 2.7.5 and earlier ) is vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of CSRF checks in certain areas. This flaw could allow an attacker to trick a logged-in user into performing unwanted actions, specifically including results deletion . ...

CVE-2024-1660

The Top Bar WordPress plugin (versions prior to 3.0.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . This issue arises because the plugin fails to properly sanitize and escape certain settings. It is notable that this vulnerability can be exploited by high-privilege users, such as adminis...

CVE-2024-1746

The Testimonial Slider WordPress plugin (versions prior to 2.3.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the insufficient sanitization and escaping of certain plugin settings before they are rendered on pages. This flaw allows authenticated attackers with administ...

CVE-2024-1310

The WooCommerce WordPress plugin in versions before 8.6 is vulnerable to a Broken Access Control flaw. This vulnerability allows users with at least the contributor role to leak products they should not have access to, specifically private, draft, and trashed products . The issue was resolved in ...

CVE-2023-7201

The Everest Backup WordPress plugin (versions prior to 2.2.5 ) contains an arbitrary file upload vulnerability. The root cause is the plugin's failure to properly validate backup files being uploaded to the server. This allows high-privilege users, such as administrators, to upload arbitrary file...

CVE-2023-6067

The WP User Profile Avatar WordPress plugin (versions 1.0.1 and earlier ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to validate and escape certain shortcode attributes before they are outputted back into a page or post where the shortcode is embedded. This...

Kruxton 1.0 Shell Upload

Title: kruxton-1.0-FileUpload-RCE Author: nu11secur1ty Date: 04/15/2024 Vendor: https://www.mayurik.com/ Software: https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html Reference: https://portswigger.net/web-security/file-upload Description: The system setting with paramete...

CVE-2024-2583

The Shortcodes Ultimate WordPress plugin (versions before 7.0.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly escape certain shortcode attributes before they are echoed back to users. This flaw allows users with the contributor role to conduct XS...

CVE-2023-51515

CVE-2023-51515 affects Uncode Core (WordPress plugin) up to version 2.8.8, with a Missing Authorization vulnerability enabling Privilege Escalation. Multiple sources confirm the issue and that a fix exists; remediation is to upgrade to a non-vulnerable version (patched). If upgrading is not immed...

CVE-2023-51499

CVE-2023-51499 affects the WordPress WooCommerce Shipping Per Product plugin. Connected sources describe a Missing Authorization/Broken Access Control flaw in versions up to 2.5.4, enabling unauthorized access to affected resources. Remediation per sources is to upgrade to a fixed version (2.5.5+...

CVE-2023-52211

The CVE-2023-52211 entry concerns the WordPress WP Job Manager plugin (

CVE-2022-40211

CVE-2022-40211 affects the WordPress GiveWP plugin

SUSE-RU-2024:1202-1 Recommended update for libzypp, zypper, PackageKit

This update for libzypp, zypper, PackageKit fixes the following issues: - Fixup New VendorSupportOption flag VendorSupportSuperseded jscOBS-301, jscPED-8014 - CVE-2024-0217: Check that Finished signal is emitted at most once bsc1218544 - Add resolver option 'removeOrphaned' for distupgrade...

CVE-2023-6257

The Inline Related Posts WordPress plugin, in versions prior to 3.6.0 , is vulnerable to Broken Access Control (OWASP Top 10 A1). The root cause is missing authorization in an AJAX action , which allows any authenticated user, such as a subscriber , to retrieve the content of password-protected p...

CVE-2023-29483

The dnspython library (versions before 2.6.0 ) is vulnerable to a denial of service (DoS) in the stub resolver, as used in eventlet versions before 0.35.2 . The root cause is that dnspython fails to wait for a valid packet within the full time window, allowing a remote attacker to interfere with ...