Our news and updates

In WordPress Simple Shopping Cart plugin versions 5.0.7 and prior a medium severity vulnerability CVE-2024-12622 was detected. This vulnerability lets users with contributor-level access or higher add harmful scripts through the ‘wp_cart_button’ and ‘wp_cart_display_product’ shortcodes. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12622.

In Tracking Code Manager plugin versions 2.3.0 and prior a medium severity vulnerability CVE-2024-8721 was detected. This vulnerability allows users with Contributor-level access or higher add harmful scripts through the tracking code field, which will execute whenever a user accesses an injected page. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8721.

In WP Datepicker plugin versions 2.1.4 and prior a medium severity vulnerability CVE-2024-12468 was detected. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts via the ‘wpdp_get_selected_datepicker’ parameter, which execute if they successfully trick a user into performing an action such as clicking on a link. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12468.

In Download Manager WordPress plugin versions before 3.3.03 a medium severity vulnerability CVE-2024-10706 was detected. This vulnerability allows attackers to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed (for example in multisite setups). To address this issue, users should upgrade Download Manager plugin to version 3.3.03 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-10706.

In Ebook Store plugin versions 5.8001 and prior a medium severity vulnerability CVE-2024-12262 was detected. This vulnerability allows attackers to inject arbitrary web scripts via the ‘step’ parameter due to insufficient input sanitization and output escaping. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-12262.

In Elementor Header & Footer Builder plugin versions 1.6.46 and prior a medium severity vulnerability CVE-2024-11230 was detected. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the ‘size’ parameter, which will execute whenever a user accesses an injected page. No patched version has been officially released at this time. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-11230.

In the LaTeX2HTML plugin for WordPress all versions up to 2.5.5 a medium severity vulnerability CVE-2024-11688 was detected. This vulnerability allows attackers to execute arbitrary scripts in the context of the user’s browser, potentially leading to session hijacking, defacement, or other malicious activities. This vulnerability remains unresolved at this time. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-11688.

In the real.Kit plugin for WordPress all versions up to 5.1.1 a medium severity vulnerability CVE-2024-12697 was detected. This vulnerability allows attackers with certain access to add harmful scripts to a website. This vulnerability remains unresolved at this time. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-12697.

In Discourse instances configured to use `FileStore::LocalStore` versions stable 3.3.2 and prior; beta 3.4.0.beta3 and prior; tests-passed 3.4.0.beta3 and prior a high severity vulnerability CVE-2024-53991 was detected. This vulnerability allows attackers to access Discourse backup files if they know the file name by crafting specific requests to nginx. To address this issue, users should upgrade to the stable 3.3.3 or above; beta 3.4.0.beta4 or above, or tests-passed 3.4.0.beta4 or above versions. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-53991.