CVE-2024-1850

The CVE CVE-2024-1850 concerns the WordPress plugin AI Post Generator | AutoWriter up to version 3.3. It lacks a capability check on AJAX-handled functions, enabling authenticated users with subscriber access or higher to view all generated posts (including non-published), create/publish new post...

CVE-2024-2336

CVE-2024-2336 affects the WordPress plugin Popup Maker – Popup for opt-ins, lead gen, & more. All versions up to 1.18.2 are vulnerable to Stored Cross‑Site Scripting via shortcode attributes due to insufficient input sanitization/output escaping. Exploitation requires contributor‑level privileges...

CVE-2024-1308

The CVE-2024-1308 entry covers the WooCommerce Cloak Affiliate Links plugin for WordPress up to version 1.0.33, where a missing authorization check in the permalink_settings_save function allows unauthenticated modification of the affiliate permalink base, enabling traffic redirection to maliciou...

CVE-2024-2804

CVE-2024-2804 — Network Summary WordPress plugin is affected. The vulnerability is an unauthenticated SQL Injection via the category parameter in Network Summary versions

CVE-2024-3093

CVE-2024-3093 is a duplicate of CVE-2024-1752 for the Font Farsi WordPress plugin. Connected sources indicate the issue affects Font Farsi

CVE-2024-2845

CVE-2024-2845 covers a Stored Cross-Site Scripting vulnerability in the WordPress plugin “BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg” up to and including version 3.4.2. The Red Hat and Wordfence entries describe the flaw...

CVE-2024-2200

The CVE CVE-2024-2200 concerns WordPress plugin Contact Form by BestWebSoft. Affected versions: all up to and including 4.2.8. Root cause: insufficient input sanitization and output escaping leads to Reflected Cross-Site Scripting via the cntctfrm_contact_subject parameter. Impact: unauthenticate...

CVE-2024-1904

CVE-2024-1904 affects the MasterStudy LMS WordPress plugin (up to and including 3.2.13). The issue is a missing capability check in the search_posts function, allowing authenticated users with subscriber-level access or higher to view draft post titles and excerpts. Impact is unauthorized data ex...

CVE-2024-1637

The CVE-2024-1637 entry concerns the 360 Javascript Viewer WordPress plugin. Affected versions are all versions up to and including 1.7.12, where an unauthorized modification of data is possible due to a missing capability check and nonce exposure on multiple AJAX actions. The vulnerability can b...

CVE-2024-1974

CVE-2024-1974 : The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in render() in versions up to 2.4.6. Authenticated attackers with contributor+ access can read arbitrary server files. The issue is documented by Wordfence and Red Hat; a fix is a...

CVE-2024-2185

CVE-2024-2185 concerns Beaver Builder Addons by WPZOOM for WordPress. Connected sources confirm a Stored XSS via the Image Box widget affecting versions up to 1.3.4 due to insufficient input sanitization/output escaping. Exploitation is reported to require at least Contributor+ authentication; th...

CVE-2024-0083

NVIDIA ChatRTX for Windows is affected by a UI-based cross-site scripting vulnerability (CVE-2024-0083) that can be triggered by network-delivered malicious scripts. The issue affects version 0.2 and earlier; exploitation could lead to code execution, denial of service, and information disclosure...

CVE-2024-1752

The CVE-2024-1752 entry concerns Font Farsi WordPress plugin versions ≤ 1.6.6. The issue is stored XSS caused by insufficient sanitization/escaping of certain settings, enabling high-privilege users (e.g., admins) to inject scripts even when unfiltered_html is disallowed (including multisite setu...

CVE-2024-1956

CVE-2024-1956 affects the WordPress plugin WPB Show Core prior to version 2.7. The vulnerability is a reflected XSS caused by insufficient sanitization/escaping of parameters in responses to unauthenticated requests. Multiple sources (Red Hat, CVE lists, Patchstack, WPVulndb) confirm the issue an...

CVE-2024-1958

CVE-2024-1958 affects the WPB Show Core WordPress plugin prior to version 2.7, where a parameter is not sanitised/escaped before being output on the page, causing a Reflected XSS vulnerability. Patch/upgrade to WPB Show Core 2.7 or later to remediat​e; the vulnerability is triggered via output re...

CVE-2024-1588

The CVE CVE-2024-1588 affects the WordPress plugin “SendPress Newsletters” up to version 1.23.11.6. The issue is an Admin+ Stored XSS via Settings vulnerability caused by insufficient sanitisation/escaping of certain settings, enabling stored cross-site scripting by high-privilege users (e.g., ad...

CVE-2024-1292

CVE-2024-1292 affects the WPB Show Core WordPress plugin prior to 2.7. The issue is a Reflected Cross-Site Scripting caused by insufficient sanitisation/escaping of parameters before they are output in the page, potentially exploitable against high-privilege users (e.g., admins). Public sources i...

CVE-2024-1589

The CVE-2024-1589 issue affects the WordPress SendPress Newsletters plugin up to version 1.23.11.6. The root cause is that certain settings are not properly sanitised/escaped, enabling Stored Cross-Site Scripting (stored XSS) by high-privilege users (e.g., admins), even when unfiltered_html is di...

CVE-2024-2444

CVE-2024-2444 affects the Inline Related Posts WordPress plugin (before 3.5.0). The issue is stored XSS due to insufficient sanitisation/escaping of certain settings, enabling high-privilege users (e.g., Administrators) to perform Cross-Site Scripting attacks. The vulnerability is exploitable via...

CVE-2023-5973

Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display...