Explore CVE records

HighPublished 24 Jan 2025, 21:26 WIB

CVE-2024-9491

Uncontrolled search path can lead to DLL hijacking in Configuration Wizard 2 installer

DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.

Excerpt language: en.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated13 Feb 2025, 03:01 WIB

Official record

HighPublished 24 Jan 2025, 21:26 WIB

CVE-2024-9490

Uncontrolled search path can lead to DLL hijacking in Silicon Labs IDE installer

DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.

Excerpt language: en.

MedPublished 24 Jan 2025, 20:40 WIB

CVE-2024-10324

RomethemeKit For Elementor <= 1.5.2 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:24 WIB

Official record

MedPublished 24 Jan 2025, 20:40 WIB

CVE-2024-11913

Activity Plus Reloaded for BuddyPress <= 1.1.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery

The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajax_preview_link' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:58 WIB

Official record

HighPublished 24 Jan 2025, 20:37 WIB

CVE-2024-41739

IBM Cognos Dashboards on Cloud Pak for Data privilege escalation

IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Jan 2025, 21:55 WIB

Official record

HighPublished 24 Jan 2025, 18:07 WIB

CVE-2024-13408

Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion

The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' attribute of the `pgcu` shortcode. This makes it possible for authenticated attackers, with Contributor-l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:35 WIB

Official record

MedPublished 24 Jan 2025, 18:07 WIB

CVE-2024-13354

Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in several widgets in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:20 WIB

Official record

MedPublished 24 Jan 2025, 18:07 WIB

CVE-2024-13335

Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme Install

The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoder_theme_install_func() function in all versions up to, and including, 1.0.14. This makes it possible for authenticated attackers, with S…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:51 WIB

Official record

MedPublished 24 Jan 2025, 18:07 WIB

CVE-2024-13542

WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP Google Street View (with 360° virtual tour) & Google maps + Local SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgsv' shortcode in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:50 WIB

Official record

MedPublished 24 Jan 2025, 18:07 WIB

CVE-2024-13594

Simple Downloads List <= 1.4.2 - Authenticated (Contributor+) SQL Injection

The Simple Downloads List plugin for WordPress is vulnerable to SQL Injection via the 'category' attribute of the 'neofix_sdl' shortcode in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it po…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:50 WIB

Official record

MedPublished 24 Jan 2025, 18:07 WIB

CVE-2024-13572

Precious Metals Charts and Widgets for WordPress <= 1.2.8 - Authenticated (Contributor+) Stored Cross-site Scripting

The Precious Metals Charts and Widgets for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nfusion-widget' shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:48 WIB

Official record

HighPublished 24 Jan 2025, 18:07 WIB

CVE-2024-13409

Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()

The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the post_type_ajax_handler() function. This makes it possible for authenticated attackers, w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:46 WIB

Official record

HighPublished 24 Jan 2025, 17:52 WIB

CVE-2025-22714

WordPress MDJM Event Management Plugin <= 1.7.5.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Reflected XSS.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.6.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 24 Jan 2025, 17:52 WIB

CVE-2025-23889

WordPress FooGallery Captions Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten FooGallery Captions foogallery-captions allows Reflected XSS.This issue affects FooGallery Captions: from n/a through <= 1.0.2.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:18 WIB

Official record

HighPublished 24 Jan 2025, 17:52 WIB

CVE-2025-23888

WordPress Custom Page Extensions Plugin <= 0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GrandSlambert Custom Page Extensions custom-page-extensions allows Reflected XSS.This issue affects Custom Page Extensions: from n/a through <= 0.6.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:18 WIB

Official record

HighPublished 24 Jan 2025, 17:52 WIB

CVE-2025-23885

WordPress MJ Contact us Plugin <= 5.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anildhiman MJ Contact us mj-contact-us allows Reflected XSS.This issue affects MJ Contact us: from n/a through <= 5.2.3.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 24 Jan 2025, 17:52 WIB

CVE-2025-23839

WordPress Sticky Button plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asif Shakeel Sticky Button sticky-chat-button allows Stored XSS.This issue affects Sticky Button: from n/a through <= 1.0.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 24 Jan 2025, 17:52 WIB

CVE-2025-23838

WordPress Bauernregeln Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rally Vincent Bauernregeln bauernregeln allows Reflected XSS.This issue affects Bauernregeln: from n/a through <= 1.0.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:18 WIB

Official record

HighPublished 24 Jan 2025, 17:52 WIB

CVE-2025-23837

WordPress One Backend Language Plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martinjuhasz One Backend Language one-backend-language allows Reflected XSS.This issue affects One Backend Language: from n/a through <= 1.0.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:18 WIB

Official record

HighPublished 24 Jan 2025, 17:52 WIB

CVE-2025-23737

WordPress Network-Favorites plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thobian Network-Favorites network-favorites allows Reflected XSS.This issue affects Network-Favorites: from n/a through <= 1.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:18 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage