CVE-2024-38671

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Martin Gibson WP GoToWebinar allows Stored XSS.This issue affects WP GoToWebinar: from n/a through 15.7...

CVE-2024-38671

CVE-2024-38671 is a stored XSS vulnerability in the WordPress WP GoToWebinar plugin (Improp er Neutralization of Input During Web Page Generation). It affects WP GoToWebinar versions up to 15.7 (vendor/exploit context lists n/a through 15.7) and is confirmed across multiple sources (NVD/Red Hat/W...

CVE-2024-38685

CVE-2024-38685 refers to a Stored XSS in SubscriptionPro WP Announcement (WordPress plugin) due to improper input neutralization during web page generation. Affected: WP Announcement versions up to 2.0.8 (no details provided beyond this range). Root cause: improper neutralization of input during ...

CVE-2024-38703

CVE-2024-38703 affects WordPress WP Event Aggregator (Plugin) versions n/a through 1.7.9. The issue is Stored XSS due to Improper Neutralization of Input During Web Page Generation. Root cause and impact are stated in the connected records; remediation guidance from the sources is to update to a ...

CVE-2024-6694

CVE-2024-6694 affects the WP Mail SMTP plugin for WordPress up to version 4.0.1. An authenticated admin can view the SMTP password in the SMTP Password field when viewing settings, leading to information exposure of the configured mail server credentials. The documented impact is limited to infor...

WordPress WP GoToWebinar Plugin <= 15.7 is vulnerable to Cross Site Scripting (XSS)

Software WP GoToWebinar Type Plugin Vulnerable versions = 15.7 Fixed in 15.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-38776 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 1de7124c716d Credits Majed Refaea Required...

WordPress WP Fast Total Search Plugin <= 1.69.234 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Fast Total Search Type Plugin Vulnerable versions = 1.69.234 Fixed in 1.70.236 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-38778 Patch priority Low CVSS severity Low 4.3 Developer Epsiloncool PSID 7430c079e28f Credits Majed Refaea...

CVE-2024-6621 WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update

The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wprssactivatefeedsource' and 'wprsspausefeedsource' functions in all versions up to, and including, 4.23.11...

CVE-2024-2691

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and output escaping on use...

CVE-2024-2691 WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and output escaping on use...

CVE-2024-2691

CVE-2024-2691 affects the WordPress plugin WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce . All versions up to and including 3.1.43 are vulnerable to Stored Cross-Site Scripting (XSS) via the plugin’s 'events' shortcode due to insufficient input sanitization and ...

WordPress WP RSS Aggregator plugin <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update vulnerability

Missing Authorization to Authenticated Subscriber+ Feed State Update vulnerability discovered by Peter Thaleikis in WordPress Plugin WP RSS Aggregator versions = 4.23.11...

WordPress WP Event Manager Plugin <= 3.1.43 is vulnerable to Cross Site Scripting (XSS)

Software WP Event Manager Type Plugin Vulnerable versions = 3.1.43 Fixed in 3.1.44 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2691 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 244e2b26df97 Credits Krzysztof Zając...

WordPress WP RSS Aggregator Plugin <= 4.23.11 is vulnerable to Broken Access Control

Software WP RSS Aggregator Type Plugin Vulnerable versions = 4.23.11 Fixed in 4.23.12 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6621 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2954812636fe Credits Peter Thaleikis Required...

CVE-2024-6073

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6074

CVE-2024-6074 relates to the WordPress plugin wp-cart-for-digital-products (pre-8.5.5). The vulnerability is a Reflected XSS caused by failing to sanitize/escape a parameter before outputting it on the page, potentially exploitable against admin/high-privilege users. Affected versions:

CVE-2024-6075 WP eStore < 8.5.5 - Coupon Deletion via CSRF

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-6076 WP eStore < 8.5.5 - Reflected XSS in Category Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6074 WP eStore < 8.5.5 - Reflected XSS in Customer Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6073 WP eStore < 8.5.5 - Reflected XSS in Discount Editing

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...