WordPress Ultimate Auction Pro plugin <= 1.5.2 - Unauthenticated SQL Injection via 'auction_id' vulnerability

Unauthenticated SQL Injection via 'auctionid' vulnerability discovered by Tom Broucke in WordPress Plugin Ultimate Auction Pro versions = 1.5.2...

WordPress BuddyBoss Platform plugin <= 2.8.50 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'invitee_name' vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'inviteename' vulnerability discovered by Kaique Peres in WordPress Plugin Buddyboss Platform versions = 2.8.50...

WordPress WPML Multilingual CMS plugin 3.6.0-4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode

Authenticated Contributor+ Stored Cross-Site Scripting via wpmllanguageswitcher Shortcode vulnerability discovered by stealthcopter in WordPress Plugin Multilingual CMS versions 3.6.0-4.7.3...

WordPress MStore API plugin <= 4.17.4 - Unauthenticated Limited Privilege Escalation vulnerability

Unauthenticated Limited Privilege Escalation vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin MStore API versions = 4.17.4...

WordPress FULL – Cliente plugin <= 3.1.25 - Authenticated (Subscriber+) SQL Injection

Authenticated Subscriber+ SQL Injection vulnerability discovered by kr0d in WordPress Plugin FULL Customer versions = 3.1.25...

WordPress Taxonomy Chain Menu plugin <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via pn_chain_menu Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via pnchainmenu Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Taxonomy Chain Menu versions = 1.0.8...

WordPress Ads Pro plugin <= 4.88 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Ads Pro versions = 4.88...

WordPress tagDiv Composer plugin <= 5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Shortcodes vulnerability discovered by stealthcopter in WordPress Plugin tagDiv Composer versions = 5.4...

WordPress Formality plugin <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via align Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Formality versions = 1.5.8...

WordPress Advance Seat Reservation Management for WooCommerce plugin <= 3.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Aiden Thái An in WordPress Plugin Advance Seat Reservation Management for WooCommerce versions = 3.3...

WordPress KiwiChat NextClient plugin <= 6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via url Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin KiwiChat NextClient versions = 6.2...

WordPress OTP-less one tap Sign in plugin 2.0.14-2.0.59 - Unauthenticated Arbitrary Email Update to Account Takeover/Privilege Escalation vulnerability

Unauthenticated Arbitrary Email Update to Account Takeover/Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin OTP-less one tap Sign in versions 2.0.14-2.0.59...

WordPress GmapsMania plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin GmapsMania versions = 1.1...

WordPress Yame plugin <= 0.9.0 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by Avraham Shemesh in WordPress Plugin Yame versions = 0.9.0...

WordPress Flynax Bridge plugin <= 2.2.0 - Unauthenticated Arbitrary User Deletion vulnerability

Unauthenticated Arbitrary User Deletion vulnerability discovered by kr0d in WordPress Plugin Flynax Bridge versions = 2.2.0...

WordPress AM LottiePlayer plugin <= 3.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Lottie File vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Uploaded Lottie File vulnerability discovered by Avraham Shemesh in WordPress Plugin AM LottiePlayer versions = 3.5.3...

WordPress WP Maps plugin < 4.7.2 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin WP Maps versions 4.7.2...

GHSA-8X27-JWJR-8545 SQL injection in ADOdb PostgreSQL driver pg_insert_id() method

Improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a PostgreSQL database and calls pginsertid with user-supplied data. Note that the indicated Severity corresponds to a worst-case usage scenario. Impact PostgreSQL...

Kibana 7.17.24 and 8.12.0 Security Update (ESA-2024-20)

Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS ESA-2024-20 Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser XSS via crafted HTML and JavaScript files. The attacker must have access to the Synthetic...

WordPress WordPress Simple PayPal Shopping Cart plugin <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Jack Taylor in WordPress Plugin Simple Shopping Cart versions = 5.1.3...