CyberAlerts

CVE-2024-11436

Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! <= 1.4.19 - Reflected C...

Description: The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS: MEDIUM (6.1)

EPSS Score: 0.05%

Source: CVE

December 10th, 2024 (4 months ago)

CVE-2024-11353

SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion

Description: The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_message() function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary messages.

CVSS: MEDIUM (4.3)

EPSS Score: 0.05%

Source: CVE

December 10th, 2024 (4 months ago)

CVE-2024-11329

Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting

Description: The Comfino Payment Gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.1.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS: MEDIUM (6.1)

EPSS Score: 0.05%

Source: CVE

December 10th, 2024 (4 months ago)

CVE-2024-10046

افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting

Description: The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.0.5. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS: MEDIUM (6.1)

EPSS Score: 0.05%

Source: CVE

December 10th, 2024 (4 months ago)

CVE-2023-51362

WordPress myStickyElements plugin <= 2.1.3 - Broken Access Control vulnerability

Description: Missing Authorization vulnerability in Premio All-in-one Floating Contact Form – My Sticky Elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All-in-one Floating Contact Form – My Sticky Elements: from n/a through 2.1.3.

CVSS: MEDIUM (5.3)

EPSS Score: 0.04%

Source: CVE

December 10th, 2024 (4 months ago)

CVE-2023-51360

WordPress Essential Blocks plugin <= 4.2.0 - Multiple Subscriber+ Broken Access Control vulnerability

Description: Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 4.2.0.

CVSS: MEDIUM (6.5)

EPSS Score: 0.05%

Source: CVE

December 10th, 2024 (4 months ago)

CVE-2023-51359

WordPress Essential Blocks plugin <= 4.2.0 - Multiple Contributor+ Broken Access Control vulnerability

Description: Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 4.2.0.

CVSS: MEDIUM (5.4)

EPSS Score: 0.05%

Source: CVE

December 10th, 2024 (4 months ago)

CVE-2023-51357

WordPress Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.0 - Broken Access ...

Description: Missing Authorization vulnerability in Conversios Conversios.io allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through 6.5.0.

CVSS: MEDIUM (5.3)

EPSS Score: 0.04%

Source: CVE

December 10th, 2024 (4 months ago)

CVE-2023-51355

WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerability

Description: Missing Authorization vulnerability in MultiVendorX WC Marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Marketplace: from n/a through 4.0.23.

CVSS: HIGH (8.2)

EPSS Score: 0.04%

Source: CVE

December 10th, 2024 (4 months ago)

CVE-2023-51353

WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control vulnerability

Description: Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through 1.10.19.

CVSS: MEDIUM (5.3)

EPSS Score: 0.04%

Source: CVE

December 10th, 2024 (4 months ago)

Threat and Vulnerability Intelligence Database

Example Searches: