Business and Enterprise Solutions

In Directus versions before 10.12.0 a medium severity vulnerability CVE-2024-39895 was detected. This vulnerability allows attackers to perform a denial of service (DoS) attack by sending GraphQL queries with duplicated fields, causing excessive resource consumption and impacting legitimate users. To address this issue, users should upgrade to version 10.12.0 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-39895.

In the Page Keys plugin for WordPress versions up to and including 1.3.3 a medium severity vulnerability CVE-2025-15000 was detected. This vulnerability allows authenticated attackers with administrator-level access to inject arbitrary web scripts via the page_key parameter due to insufficient input sanitization and output escaping, resulting in stored cross-site scripting (XSS). Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-15000.

In Directus versions before 10.13.2 a medium severity vulnerability CVE-2024-47822 was detected. This vulnerability allows attackers to gain unauthorized data access and manipulation by exploiting exposed access tokens in system logs. To address this issue, users should upgrade to version 10.13.2 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-47822.

In WP Job Portal WordPress plugin versions up to and including 2.2.4 a medium severity vulnerability CVE-2024-12132 was detected. This vulnerability allows authenticated attackers with Subscriber-level access or higher to create jobs for companies they are not affiliated with due to missing validation on a user-controlled key. To address this issue, users should upgrade to a version 2.2.5 or above. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12132.

In wp-enable-svg WordPress plugin through version 0.7 a medium severity vulnerability CVE-2024-11184 was detected. This vulnerability allows authors and higher-privileged users to upload SVG files containing malicious scripts due to insufficient sanitization during file uploads. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11184.

In goodlayers-core WordPress plugin before version 2.0.10 a medium severity vulnerability CVE-2024-11357 was detected. This vulnerability allows users with the contributor role or higher to perform Stored Cross-Site Scripting (XSS) attacks by exploiting unsanitized and unescaped settings. To address this issue, users should upgrade to version 2.0.10 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11357.

In AHAthat WordPress plugin version 1.6 and prior a medium severity vulnerability CVE-2024-12595 was detected. This vulnerability allows attackers to perform Reflected Cross-Site Scripting (XSS) attacks by exploiting the unsanitized `$_SERVER[‘REQUEST_URI’]` parameter, which is outputted in an attribute. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12595.

In WebToffee WordPress Backup & Migration plugin versions up to 1.4.1 a medium severity vulnerability CVE-2023-45636 was detected. This vulnerability allows attackers to exploit improperly configured access control security levels due to missing authorization. To address this issue, users should upgrade to version 1.4.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2023-45636.

In Hunk Companion WordPress plugin before version 1.9.0 a critical severity vulnerability CVE-2024-11972 was detected. This vulnerability allows unauthenticated attackers to install and activate arbitrary plugins, including vulnerable versions of the Hunk Companion plugin, from the WordPress.org repository via improperly authorized REST API endpoints. To address this issue, users should upgrade to version 1.9.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11972.