keycloak: secondary factor bypass in step-up authentication

A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to register a false second authentication factor along with an existing one and bypass authentication...

WordPress Ovic Responsive WPBakery plugin <= 1.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Skalucy Patchstack Alliance in WordPress Plugin Ovic Responsive WPBakery versions = 1.3.0...

WordPress Attesa Extra plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra Patchstack Alliance in WordPress Plugin Attesa Extra versions = 1.3.9...

CVE-2024-3873 SMI SMI-EX-5414W Web Interface cross-site request forgery

A vulnerability was found in SMI SMI-EX-5414W up to 1.0.03. It has been classified as problematic. This affects an unknown part of the component Web Interface. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to t...

WordPress Backend Designer plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin Backend Designer versions = 1.3...

WordPress HurryTimer plugin <=2.9.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin HurryTimer versions = 2.9.2...

WordPress Paid Memberships Pro plugin <= 3.0.1 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Whit Taylor in WordPress Plugin Paid Memberships Pro versions = 3.0.1...

WordPress Enhanced Media Library plugin <= 2.8.9 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Tim Coen in WordPress Plugin Enhanced Media Library versions = 2.8.9...

VulnCheck KEV: CVE-2024-32553

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in looksawesome Superfly Menu superfly-menu.This issue affects Superfly Menu: from n/a through = 5.0.25...

WordPress BMI Adult & Kid Calculator plugin <= 1.2.1 - CSRF to XSS vulnerability

CSRF to XSS vulnerability discovered by Faizal Abroni Patchstack Alliance in WordPress Plugin BMI Adult & Kid Calculator versions = 1.2.1...

WordPress Fixed HTML Toolbar plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Fixed HTML Toolbar versions = 1.0.7...

WordPress WP TradingView plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin WP TradingView versions = 1.7...

WordPress Yoga Schedule Momoyoga plugin <= 2.7.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Yoga Schedule Momoyoga versions = 2.7.0...

WordPress GG Woo Feed for WooCommerce plugin <= 1.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin GG Woo Feed for WooCommerce versions = 1.2.6...

WordPress Simple Registration for WooCommerce plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin Simple Registration for WooCommerce versions = 1.5.6...

CVE-2024-31373

Cross-Site Request Forgery CSRF vulnerability in E2Pdf.This issue affects e2pdf: from n/a through 1.20.27...

WordPress Responsive Contact Form Builder & Lead Generation Plugin plugin <= 1.8.9 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Duc Manh in WordPress Plugin Contact Form & Lead Form Elementor Builder versions = 1.8.9...

CVE-2024-32443

Cross-Site Request Forgery CSRF vulnerability in IP2Location Download IP2Location Country Blocker.This issue affects Download IP2Location Country Blocker: from n/a through 2.34.2...

CVE-2024-32438

Cross-Site Request Forgery CSRF vulnerability in cleverplugins.Com SEO Booster.This issue affects SEO Booster: from n/a through 3.8.9...

CVE-2024-32147

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Form Plugin Team - GhozyLab Easy Contact Form Lite allows Stored XSS.This issue affects Easy Contact Form Lite : from n/a through 1.1.23...