Explore CVE records

HighPublished 18 Dec 2024, 13:00 WIB

CVE-2024-4464

Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 23:21 WIB

Official record

UnscoredPublished 18 Dec 2024, 13:00 WIB

CVE-2024-10892

Cost Calculator Builder < 3.2.43 - Settings update via CSRF

The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.

Excerpt language: en.

CVSS

MedPublished 18 Dec 2024, 12:07 WIB

CVE-2024-12698

Ose-olm-catalogd-container: incomplete fix for rapid reset (cve-2023-39325/cve-2023-44487)

An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streams were protected, not streams created by authenticated sources.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Nov 2025, 01:22 WIB

Official record

MedPublished 18 Dec 2024, 10:22 WIB

CVE-2024-12061

Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure

The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naevents_elementor_template shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:33 WIB

Official record

MedPublished 18 Dec 2024, 10:22 WIB

CVE-2024-12250

Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure

The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via the cf7adn-info.php file. This makes it possible for unauthenticated attackers to extract configuration data which can be used to aid in other attacks.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:26 WIB

Official record

MedPublished 18 Dec 2024, 10:22 WIB

CVE-2024-12449

Video Share VOD – Turnkey Video Site Builder Script <= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_player_html' shortcode in all versions up to, and including, 2.6.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:17 WIB

Official record

MedPublished 18 Dec 2024, 10:22 WIB

CVE-2024-12596

LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with Subscriber-level access a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:06 WIB

Official record

HighPublished 18 Dec 2024, 10:22 WIB

CVE-2024-12259

CRM WordPress Plugin – RepairBuddy <= 3.8120 - Missing Authorization to Account Takeover/Privilege Escalation

The CRM WordPress Plugin – RepairBuddy plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.8120. This is due to the plugin not properly validating a user's identity prior to updating their email through the wc_update_user_data AJAX action. This makes i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:03 WIB

Official record

MedPublished 18 Dec 2024, 10:22 WIB

CVE-2024-11254

AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus_name parameter in all versions up to, and including, 1.1.1 due to insufficient input validation. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:55 WIB

Official record

HighPublished 18 Dec 2024, 10:22 WIB

CVE-2024-12025

Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection

The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:33 WIB

Official record

HighPublished 18 Dec 2024, 10:22 WIB

CVE-2024-12432

WPC Shop as a Customer for WooCommerce <= 1.2.8 - Authentication Bypass Due to Insufficiently Unique Key

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generate_key' function not producing a sufficiently random value. This makes it possible for authenticated attackers, with Subscribe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:33 WIB

Official record

MedPublished 18 Dec 2024, 09:24 WIB

CVE-2024-12513

Contests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RF_CONTEST' shortcode in all versions up to, and including, 2.0.65 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:21 WIB

Official record

MedPublished 18 Dec 2024, 09:24 WIB

CVE-2024-11881

Easy Waveform Player <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easywaveformplayer' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:37 WIB

Official record

MedPublished 18 Dec 2024, 09:24 WIB

CVE-2024-12500

Philantro – Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:35 WIB

Official record

MedPublished 18 Dec 2024, 09:08 WIB

CVE-2024-11748

Taeggie Feed <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'taeggie-feed' shortcode in all versions up to, and including, 0.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:57 WIB

Official record

MedPublished 18 Dec 2024, 09:08 WIB

CVE-2024-11439

ScanCircle <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The ScanCircle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'scancircle' shortcode in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:42 WIB

Official record

HighPublished 18 Dec 2024, 08:05 WIB

CVE-2024-47480

Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privilege attacker with local access may exploit this vulnerability, potentially resulting in Elevation of Privileges and unauthorized file system access.

Excerpt language: en.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 22:13 WIB

Official record

UnscoredPublished 18 Dec 2024, 07:00 WIB

CVE-2024-36694

OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated24 Jan 2025, 03:35 WIB

Official record

UnscoredPublished 18 Dec 2024, 07:00 WIB

CVE-2024-37649

Insecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically proximate attacker to obtain sensitive information via the modification of user credentials.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated01 Jan 2025, 02:45 WIB

Official record

HighPublished 18 Dec 2024, 07:00 WIB

CVE-2024-39703

In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API endpoint.

Excerpt language: en.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Dec 2024, 22:14 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage