{"vulnerability": "CVE-2024-1352", "sightings": [{"uuid": "c555392b-4206-4839-a118-eb4561a8db95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13527", "type": "seen", "source": "https://t.me/cvedetector/16595", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13527 - Philantro Donations and Donor Management - WordPress Stored Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-13527 \nPublished : Jan. 28, 2025, 9:15 a.m. | 2\u00a0hours, 4\u00a0minutes ago \nDescription : The Philantro \u2013 Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"28 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-28T12:56:20.000000Z"}, {"uuid": "4e2482ae-d2bc-41c6-895c-7d4d93ef3379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13521", "type": "seen", "source": "https://t.me/cvedetector/16586", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13521 - MailUp Auto Subscription CSRF\", \n  \"Content\": \"CVE ID : CVE-2024-13521 \nPublished : Jan. 28, 2025, 8:15 a.m. | 58\u00a0minutes ago \nDescription : The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the mas_options function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. \nSeverity: 6.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"28 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-28T10:25:46.000000Z"}, {"uuid": "f5af775b-4b3e-4be4-9bc8-df36924eea22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13529", "type": "seen", "source": "https://t.me/cvedetector/17179", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13529 - SocialV BuddyPress Theme Unauthenticated File Download Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-13529 \nPublished : Feb. 4, 2025, 10:15 a.m. | 47\u00a0minutes ago \nDescription : The SocialV - Social Network and Community BuddyPress Theme theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'socialv_send_download_file' function in all versions up to, and including, 2.0.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download arbitrary files from the target system. \nSeverity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"04 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-04T12:12:59.000000Z"}, {"uuid": "2e8882ab-7406-4b68-89de-41923fc3141b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13524", "type": "seen", "source": "https://t.me/cvedetector/15878", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13524 - OBS Studio Windows Local Privilege Escalation Search Path Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-13524 \nPublished : Jan. 20, 2025, 3:15 a.m. | 39\u00a0minutes ago \nDescription : A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. It is recommended to apply a patch to fix this issue. The vendor disagrees that this issue is \"something worth reporting, as every attack surface requires privileged access/user compromise\". \nSeverity: 4.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"20 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-20T05:01:05.000000Z"}, {"uuid": "a9a47e09-1323-499a-8d9c-4f31fd9994e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13523", "type": "seen", "source": "Telegram/Bw0xQ_SFLAhX33_Xq6jT0wcR9PeAYZ_NUgFXvhb0myFYPTsJ", "content": "", "creation_timestamp": "2025-02-18T11:39:00.000000Z"}, {"uuid": "7c2e2464-fd86-4699-861a-6c0204521c77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13522", "type": "seen", "source": "Telegram/09-SGBFbI98PdFagZtCMShiRu40wzwW7j9mCPvyybcDpB0cG", "content": "", "creation_timestamp": "2025-02-18T11:39:00.000000Z"}, {"uuid": "6c35b19d-87c4-444e-bec7-ad8c8ce091fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13529", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113944905544642459", "content": "", "creation_timestamp": "2025-02-04T09:27:59.233014Z"}, {"uuid": "ca54d719-6da1-4f6f-bb72-0d485ecef7c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13521", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lgrzatxbew2c", "content": "", "creation_timestamp": "2025-01-28T08:16:01.588538Z"}, {"uuid": "edf1f982-c12b-4457-890b-425fc20f21f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13527", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113905037299606707", "content": "", "creation_timestamp": "2025-01-28T08:28:57.854235Z"}, {"uuid": "1b4da668-ea3d-4fd1-baa4-d8b6c24f11b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13527", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lgs4kyz7v32n", "content": "", "creation_timestamp": "2025-01-28T09:15:23.289417Z"}, {"uuid": "0c6427ae-2f2d-4533-b180-24ffb476e502", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13521", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lgsjg5eisa2i", "content": "", "creation_timestamp": "2025-01-28T13:05:21.198227Z"}, {"uuid": "6513380e-38de-4376-a153-1aa9fed64779", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13528", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113990323173619602", "content": "", "creation_timestamp": "2025-02-12T09:58:17.036200Z"}, {"uuid": "a63e6aaf-5481-4d08-8e2e-4fc6dc64802c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13528", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lhxwxjn45p2x", "content": "", "creation_timestamp": "2025-02-12T10:16:10.871111Z"}, {"uuid": "cd7dde6d-8196-4096-b47a-83f5d1762b4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13528", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lhyemcnecv2w", "content": "", "creation_timestamp": "2025-02-12T14:20:30.355568Z"}, {"uuid": "0407b0a2-62e4-4c66-92d8-8a8fc06cb73c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13522", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ligiyga24q2o", "content": "", "creation_timestamp": "2025-02-18T05:16:04.500803Z"}, {"uuid": "80487518-3cef-42c8-992d-e760d5e7307f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13523", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3ligpo5xqp42i", "content": "", "creation_timestamp": "2025-02-18T07:15:36.899559Z"}, {"uuid": "75ae7a01-38ce-4457-ba15-66c582accb3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13520", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3limctfhwyb2l", "content": "", "creation_timestamp": "2025-02-20T12:41:51.918456Z"}, {"uuid": "db26f1f2-49b2-4d44-952f-a4403f78bbbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13526", "type": "seen", "source": "https://t.me/cvedetector/19772", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13526 - EventPrime \u2013 WordPress Events Calendar Unauthorized Data Access Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-13526 \nPublished : March 7, 2025, 2:15 a.m. | 33\u00a0minutes ago \nDescription : The EventPrime \u2013 Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the export_submittion_attendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download list of attendees for any event. \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"07 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-07T04:03:54.000000Z"}, {"uuid": "50316b4a-070a-4615-b4b3-17e920e34ddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13520", "type": "seen", "source": "https://t.me/cvedetector/18527", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13520 - WooCommerce Gift Cards Unauthenticated Data Modification Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-13520 \nPublished : Feb. 20, 2025, 10:15 a.m. | 1\u00a0hour, 3\u00a0minutes ago \nDescription : The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'update_voucher_price', 'update_voucher_date', 'update_voucher_note' functions in all versions up to, and including, 4.4.6. This makes it possible for unauthenticated attackers to update the value, expiration date, and user note for any gift voucher. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"20 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-20T13:09:00.000000Z"}, {"uuid": "a97c29d0-7a40-4196-afbf-eeece0abadc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13523", "type": "seen", "source": "https://t.me/cvedetector/18310", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13523 - MemorialDay WordPress CSRF\", \n  \"Content\": \"CVE ID : CVE-2024-13523 \nPublished : Feb. 18, 2025, 7:15 a.m. | 2\u00a0hours, 17\u00a0minutes ago \nDescription : The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. \nSeverity: 6.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"18 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-18T10:57:50.000000Z"}, {"uuid": "c137741b-ce83-4aca-b409-4e7d63e45f4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13525", "type": "seen", "source": "https://t.me/cvedetector/18170", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13525 - WooCommerce Customer Email Verification Sensitive Information Exposure\", \n  \"Content\": \"CVE ID : CVE-2024-13525 \nPublished : Feb. 15, 2025, 9:15 a.m. | 2\u00a0hours, 4\u00a0minutes ago \nDescription : The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via Shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including emails as well as hashed passwords of any user. \nSeverity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"15 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-15T12:41:31.000000Z"}, {"uuid": "261f55d0-e9d9-4bce-b03f-d17c3d74f731", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13526", "type": "seen", "source": "Telegram/pA1hhKvf3_JJ_EuRrigiNmdRIHzO3qdWKJ_cAFG0ON9iL-mh", "content": "", "creation_timestamp": "2025-03-08T04:34:55.000000Z"}, {"uuid": "0e33af02-3297-4bd0-ba9d-d87d108d09dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13521", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/3247", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13521\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: No description available\n\ud83d\udccf Published: 2025-01-28T08:15:29.583\n\ud83d\udccf Modified: N/A\n\ud83d\udd17 References:\n1. https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3060078%40mailup-auto-subscribtion%2Ftags%2F1.1.0&new=3229728%40mailup-auto-subscribtion%2Ftags%2F1.2.0\n2. https://www.wordfence.com/threat-intel/vulnerabilities/id/9ee9b2e9-e3fe-43b2-9caf-7246a4201fe9?source=cve", "creation_timestamp": "2025-01-28T09:16:58.000000Z"}, {"uuid": "6a8f59a7-6fc8-46f0-80d5-d79a00d11d8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13528", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/4068", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13528\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: No description available\n\ud83d\udccf Published: 2025-02-12T10:15:12.130\n\ud83d\udccf Modified: N/A\n\ud83d\udd17 References:\n1. https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.9.2/includes/class-alg-wc-ev-emails.php#L151\n2. https://plugins.trac.wordpress.org/changeset/3238136/\n3. https://www.wordfence.com/threat-intel/vulnerabilities/id/0b3798e3-45fe-4829-9012-dc728d4af87f?source=cve", "creation_timestamp": "2025-02-12T11:10:45.000000Z"}, {"uuid": "e5b09b66-54e9-4988-ba8e-d7e10dfc27f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13528", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/4094", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13528\n\ud83d\udd25 CVSS Score: 7.5 (CVSS_V3)\n\ud83d\udd39 Description: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.9.5. This is due to the presence of a shortcode that will generate a confirmation link with a placeholder email. This makes it possible for authenticated attackers, with Contributor-level access and above, to generate a verification link for any unverified user and log into the account. The 'Fine tune placement' option must be enabled in the plugin settings in order to exploit the vulnerability.\n\ud83d\udccf Published: 2025-02-12T12:30:47Z\n\ud83d\udccf Modified: 2025-02-12T12:30:47Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-13528\n2. https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.9.2/includes/class-alg-wc-ev-emails.php#L151\n3. https://plugins.trac.wordpress.org/changeset/3238136\n4. https://www.wordfence.com/threat-intel/vulnerabilities/id/0b3798e3-45fe-4829-9012-dc728d4af87f?source=cve", "creation_timestamp": "2025-02-12T13:11:27.000000Z"}, {"uuid": "c7bda7a4-3569-4c41-a5e0-04cac9c7d2b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13525", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/4553", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13525\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: No description available\n\ud83d\udccf Published: 2025-02-15T09:15:08.833\n\ud83d\udccf Modified: N/A\n\ud83d\udd17 References:\n1. https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.9.2/includes/class-alg-wc-ev-core.php#L990\n2. https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3232261%40emails-verification-for-woocommerce%2Ftrunk&old=3230854%40emails-verification-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=\n3. https://www.wordfence.com/threat-intel/vulnerabilities/id/a63a41d1-b9b0-43a9-a6e0-761f3b8d9d4a?source=cve", "creation_timestamp": "2025-02-15T11:10:57.000000Z"}, {"uuid": "6e853e92-e78b-4e0a-a773-a621d1eca4d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13525", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/4544", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13525\n\ud83d\udd25 CVSS Score: 6.4 (CVSS_V3)\n\ud83d\udd39 Description: The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via Shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including emails as well as hashed passwords of any user.\n\ud83d\udccf Published: 2025-02-15T09:30:28Z\n\ud83d\udccf Modified: 2025-02-15T09:30:28Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-13525\n2. https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.9.2/includes/class-alg-wc-ev-core.php#L990\n3. https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3232261%40emails-verification-for-woocommerce%2Ftrunk&old=3230854%40emails-verification-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=\n4. https://www.wordfence.com/threat-intel/vulnerabilities/id/a63a41d1-b9b0-43a9-a6e0-761f3b8d9d4a?source=cve", "creation_timestamp": "2025-02-15T10:11:06.000000Z"}, {"uuid": "8b33d2b5-1759-4316-be03-3019e128bf46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13525", "type": "seen", "source": "Telegram/wMGMkkwbQbk8rTIqNssmAWMB_LWiumTo5uWKyMmts8rpqUMm", "content": "", "creation_timestamp": "2025-02-15T23:50:18.000000Z"}, {"uuid": "2e9b2d47-8b94-4748-9e6d-87e85d5543f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13521", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113904796362962773", "content": "", "creation_timestamp": "2025-01-28T07:27:41.526411Z"}, {"uuid": "f2038445-6f8f-4650-aed5-fb955823fc21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13529", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lhdt72vfko2t", "content": "", "creation_timestamp": "2025-02-04T10:15:34.016006Z"}, {"uuid": "de92523d-7a95-448f-a6a2-99904d0437c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13527", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lgsjg6gnhu2r", "content": "", "creation_timestamp": "2025-01-28T13:05:27.014375Z"}, {"uuid": "563c016d-549d-4815-a5cc-a99a18c66443", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13529", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lheaqw4puu2r", "content": "", "creation_timestamp": "2025-02-04T14:18:13.011053Z"}, {"uuid": "ec116647-7461-48af-8e2c-0a3129c18d32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13523", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lih6sobjk226", "content": "", "creation_timestamp": "2025-02-18T11:46:33.964135Z"}, {"uuid": "7caa8e29-5612-4085-befb-4328ce003aa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13521", "type": "seen", "source": "MISP/d0bda5d9-8cbc-4c6c-8803-a5e3150f9ec2", "content": "", "creation_timestamp": "2025-09-01T19:03:03.000000Z"}, {"uuid": "cbd1c30d-c981-42bc-8431-8bc2fd85c235", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13523", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/4755", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13523\n\ud83d\udd25 CVSS Score: 6.1 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.\n\ud83d\udccf Published: 2025-02-18T07:02:26.288Z\n\ud83d\udccf Modified: 2025-02-18T07:02:26.288Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/96cec16e-7bb3-4279-8c17-eca88d413ad8?source=cve\n2. https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3232363%40memorialday%2Ftrunk&old=3207291%40memorialday%2Ftrunk&sfp_email=&sfph_mail=", "creation_timestamp": "2025-02-18T08:09:52.000000Z"}, {"uuid": "ca709cdc-23af-4bbd-bf12-81a9b27e2d71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13526", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/6786", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13526\n\ud83d\udd25 CVSS Score: 4.3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)\n\ud83d\udd39 Description: The EventPrime \u2013 Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the export_submittion_attendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to download list of attendees for any event.\n\ud83d\udccf Published: 2025-03-07T01:44:54.034Z\n\ud83d\udccf Modified: 2025-03-07T01:44:54.034Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/2be578d9-27c3-4a16-a634-1514ed97a1a2?source=cve\n2. https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/tags/4.0.7.3/includes/class-ep-ajax.php#L1903", "creation_timestamp": "2025-03-07T02:35:11.000000Z"}, {"uuid": "2bd8ace2-a0e0-4d41-a742-901f2104d788", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13524", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113858298618080202", "content": "", "creation_timestamp": "2025-01-20T02:22:42.226804Z"}, {"uuid": "c629bb19-1e7c-44b7-a31d-841c791c795a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13524", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lg5eq5iqjb2b", "content": "", "creation_timestamp": "2025-01-20T03:15:31.226651Z"}, {"uuid": "497b20d6-e1e9-411a-9298-5335a42951b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13524", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lg5gwbdzvl2k", "content": "", "creation_timestamp": "2025-01-20T03:54:44.114544Z"}, {"uuid": "2fee0954-c4ce-486f-b95e-0219d3fd0911", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13524", "type": "seen", "source": "https://bsky.app/profile/basefortify.bsky.social/post/3lg6fool64c2v", "content": "", "creation_timestamp": "2025-01-20T13:05:17.983179Z"}, {"uuid": "ae7f5109-8b5e-4063-8de8-03ab1c728793", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13525", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/114006958211681134", "content": "", "creation_timestamp": "2025-02-15T08:28:47.613339Z"}, {"uuid": "a0070153-debe-4ef1-8f7e-e8a2c8c0fa54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13525", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3li7extqvy42k", "content": "", "creation_timestamp": "2025-02-15T09:15:32.237830Z"}, {"uuid": "1894bac9-530f-4d8d-8377-944d746bc43a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13525", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3li7le4xf7z2a", "content": "", "creation_timestamp": "2025-02-15T11:09:47.309435Z"}, {"uuid": "26193869-1325-4f0a-b459-a08aa2095f10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13526", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ljrddpyzeb2h", "content": "", "creation_timestamp": "2025-03-07T05:59:30.527459Z"}, {"uuid": "651ac8a4-5dc3-4503-9157-7feec1a35f8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13527", "type": "seen", "source": "MISP/d0bda5d9-8cbc-4c6c-8803-a5e3150f9ec2", "content": "", "creation_timestamp": "2025-09-01T19:03:03.000000Z"}, {"uuid": "ead8ef04-e4d9-49f1-b7c4-178993f19db5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13528", "type": "seen", "source": "https://t.me/cvedetector/17838", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13528 - WooCommerce WordPress Customer Email Verification Authentication Bypass\", \n  \"Content\": \"CVE ID : CVE-2024-13528 \nPublished : Feb. 12, 2025, 10:15 a.m. | 37\u00a0minutes ago \nDescription : The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.9.5. This is due to the presence of a shortcode that will generate a confirmation link with a placeholder email. This makes it possible for authenticated attackers, with Contributor-level access and above, to generate a verification link for any unverified user and log into the account. The 'Fine tune placement' option must be enabled in the plugin settings in order to exploit the vulnerability. \nSeverity: 7.5 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"12 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-12T12:41:39.000000Z"}]}