Wordfence Intelligence Weekly WordPress Vulnerability Report (November 4, 2024 to November 10, 2024)

Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through December 9th, 2024: All in-scope vulnerability types for WordPress plugins/themes with = 1,000 active installations are in-scop...

MozillaFirefox-132.0.1-1.1 on GA media (moderate)

MozillaFirefox-132.0.1-1.1 on GA media Announcement ID: openSUSE-SU-2024:14483-1 Rating: moderate Cross-References: CVE-2024-10458 CVE-2024-10459 CVE-2024-10460 CVE-2024-10461 CVE-2024-10462 CVE-2024-10463 CVE-2024-10464 CVE-2024-10465 CVE-2024-10466 CVE-2024-10467 CVE-2024-10468 CVSS scores:...

coredns-1.11.3+git129.387f34d-1.1 on GA media (moderate)

coredns-1.11.3+git129.387f34d-1.1 on GA media Announcement ID: openSUSE-SU-2024:14481-1 Rating: moderate Cross-References: CVE-2024-51744 CVSS scores: CVE-2024-51744 SUSE : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2024-51744 SUSE : 2.1...

govulncheck-vulndb-0.0.20241108T172500-1.1 on GA media (moderate)

govulncheck-vulndb-0.0.20241108T172500-1.1 on GA media Announcement ID: openSUSE-SU-2024:14482-1 Rating: moderate Cross-References: CVE-2024-10975 CVE-2024-45794 Affected Products: openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. Description: These are all securit...

CVE-2024-51579

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through = 1.4.01...

CVE-2024-51579

CVE-2024-51579 is a SQL Injection vulnerability in the WordPress plugin 5 Stars Rating Funnel (Builds up to 1.4.01). The issue arises from insufficient escaping of user-supplied input and lack of proper query preparation, enabling an authenticated attacker with Contributor+ privileges to potentia...

CVE-2024-51579 WordPress 5 Stars Rating Funnel plugin <=1.4.01 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through = 1.4.01...

rhel-system-roles bug fix update

An update is available for rhel-system-roles. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The rhel-system-roles package includes a collection of Ansible role...

linux-firmware bug fix update

An update is available for linux-firmware. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The linux-firmware packages contain all of the firmware files that are...

ruby3.3-rubygem-puma-6.4.3-1.1 on GA media (moderate)

ruby3.3-rubygem-puma-6.4.3-1.1 on GA media Announcement ID: openSUSE-SU-2024:14474-1 Rating: moderate Cross-References: CVE-2024-45614 CVSS scores: CVE-2024-45614 SUSE : 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N CVE-2024-45614 SUSE : 6.3...

xorg-x11-server-21.1.14-1.1 on GA media (moderate)

xorg-x11-server-21.1.14-1.1 on GA media Announcement ID: openSUSE-SU-2024:14466-1 Rating: moderate Cross-References: CVE-2024-9632 CVSS scores: CVE-2024-9632 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-9632 SUSE : 8.5...

xwayland-24.1.4-1.1 on GA media (moderate)

xwayland-24.1.4-1.1 on GA media Announcement ID: openSUSE-SU-2024:14467-1 Rating: moderate Cross-References: CVE-2024-9632 CVSS scores: CVE-2024-9632 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2024-9632 SUSE : 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N...

audacity-3.7.0-1.1 on GA media (moderate)

audacity-3.7.0-1.1 on GA media Announcement ID: openSUSE-SU-2024:14457-1 Rating: moderate Cross-References: CVE-2024-50602 CVSS scores: CVE-2024-50602 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2024-50602 SUSE : 5.6 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

CVE-2024-51678

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...

CVE-2024-51678

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through 1.0.3...

CVE-2024-51678 WordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...

CVE-2024-51678 WordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcel Pol Elo Rating Shortcode elo-rating-shortcode allows Stored XSS.This issue affects Elo Rating Shortcode: from n/a through = 1.0.3...

WordPress plugin Elo Rating Shortcode 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-34823 · Marcel Pol · Elo Rating Shortcode

Name of the Vulnerable Software and Affected Versions: Elo Rating Shortcode versions 1.0.3 and earlier Elo Rating Shortcode versions prior to 1.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows...

chromedriver-130.0.6723.91-1.1 on GA media (moderate)

chromedriver-130.0.6723.91-1.1 on GA media Announcement ID: openSUSE-SU-2024:14451-1 Rating: moderate Cross-References: CVE-2024-10487 CVE-2024-10488 Affected Products: openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. Description: These are all security issues fix...