{"vulnerability": "cve-2024-1342", "sightings": [{"uuid": "9b851564-6827-4ae6-a741-a783ad966a0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13420", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/14432", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13420\n\ud83d\udd25 CVSS Score: 4.3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)\n\ud83d\udd39 Description: Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.\n\ud83d\udccf Published: 2025-05-02T03:21:19.589Z\n\ud83d\udccf Modified: 2025-05-02T03:21:19.589Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/6d484422-4adf-4370-b228-61496d5ad78a?source=cve\n2. https://themeforest.net/item/beyot-wordpress-real-estate-theme/19514964", "creation_timestamp": "2025-05-02T04:15:44.000000Z"}, {"uuid": "6a512777-e0a1-4199-8ab3-e0bd315162b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13427", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/17487", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13427\n\ud83d\udd25 CVSS Score: 6.4 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)\n\ud83d\udd39 Description: The Page Builder: Pagelayer \u2013 Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widget in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 1.9.9 and completely fixed in version 2.0.1.\n\ud83d\udccf Published: 2025-05-24T01:41:10.473Z\n\ud83d\udccf Modified: 2025-05-24T10:11:51.407Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/5df2f3cc-affc-4549-b59e-d145cce10c79?source=cve\n2. https://plugins.trac.wordpress.org/changeset/3298138/pagelayer", "creation_timestamp": "2025-05-24T10:45:06.000000Z"}, {"uuid": "30637e7c-7b87-4cf5-ac80-ef8717778981", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13421", "type": "seen", "source": "Telegram/xTjoccFUQwvLIHGJt86D87C7K87Lp1WStIQjAjMBI-0kKwsP", "content": "", "creation_timestamp": "2025-02-14T10:04:02.000000Z"}, {"uuid": "c76b6e7b-beb9-40d8-af26-b6e354d2d1d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13420", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lo6e7ptwoy2e", "content": "", "creation_timestamp": "2025-05-02T08:00:37.900469Z"}, {"uuid": "d00ab401-c455-4679-8d90-67a19d1667ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13424", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/3587", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13424\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: No description available\n\ud83d\udccf Published: 2025-01-31T06:15:29.443\n\ud83d\udccf Modified: N/A\n\ud83d\udd17 References:\n1. https://wordpress.org/plugins/ni-woo-sales-commission/\n2. https://www.wordfence.com/threat-intel/vulnerabilities/id/ac4a026b-ed1c-4864-8900-1d70d95af6f4?source=cve", "creation_timestamp": "2025-01-31T07:24:02.000000Z"}, {"uuid": "1c5923b5-13dc-42bc-9570-2db6bd252b47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13428", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/3744", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13428\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: No description available\n\ud83d\udccf Published: 2025-02-01T08:15:09.910\n\ud83d\udccf Modified: N/A\n\ud83d\udd17 References:\n1. https://plugins.trac.wordpress.org/changeset/3229608/wp-job-portal/tags/2.2.7/modules/company/model.php?old=3216415&old_path=wp-job-portal%2Ftags%2F2.2.6%2Fmodules%2Fcompany%2Fmodel.php\n2. https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c786fe-898e-4478-97b9-c1fb41c9081c?source=cve", "creation_timestamp": "2025-02-01T09:26:02.000000Z"}, {"uuid": "45b12b74-f52c-4753-a84b-a78ccc08e6ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13429", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/3743", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13429\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: No description available\n\ud83d\udccf Published: 2025-02-01T08:15:10.340\n\ud83d\udccf Modified: N/A\n\ud83d\udd17 References:\n1. https://plugins.trac.wordpress.org/changeset/3229608/wp-job-portal/tags/2.2.7/modules/job/controller.php?old=3216415&old_path=wp-job-portal%2Ftags%2F2.2.6%2Fmodules%2Fjob%2Fcontroller.php\n2. https://www.wordfence.com/threat-intel/vulnerabilities/id/9cbce69a-53d0-4b83-9b7a-893a6b9c39c4?source=cve", "creation_timestamp": "2025-02-01T09:26:01.000000Z"}, {"uuid": "09b93dcf-8019-42c1-a663-35f943dbfac9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13425", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/3745", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13425\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: No description available\n\ud83d\udccf Published: 2025-02-01T08:15:09.483\n\ud83d\udccf Modified: N/A\n\ud83d\udd17 References:\n1. https://plugins.trac.wordpress.org/changeset/3229608/wp-job-portal/tags/2.2.7/modules/company/controller.php?old=3216415&old_path=wp-job-portal%2Ftags%2F2.2.6%2Fmodules%2Fcompany%2Fcontroller.php\n2. https://www.wordfence.com/threat-intel/vulnerabilities/id/a14e110f-0850-44f4-8de3-95a654096ae8?source=cve", "creation_timestamp": "2025-02-01T09:26:02.000000Z"}, {"uuid": "2c783457-a28e-4667-a87f-790365626be0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13429", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/3755", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13429\n\ud83d\udd25 CVSS Score: 4.2 (CVSS_V3)\n\ud83d\udd39 Description: The WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the 'jobenforcedelete' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with employer-level access and above, to delete arbitrary\n\ud83d\udccf Published: 2025-02-01T09:30:28Z\n\ud83d\udccf Modified: 2025-02-01T09:30:28Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-13429\n2. https://plugins.trac.wordpress.org/changeset/3229608/wp-job-portal/tags/2.2.7/modules/job/controller.php?old=3216415&old_path=wp-job-portal%2Ftags%2F2.2.6%2Fmodules%2Fjob%2Fcontroller.php\n3. https://www.wordfence.com/threat-intel/vulnerabilities/id/9cbce69a-53d0-4b83-9b7a-893a6b9c39c4?source=cve", "creation_timestamp": "2025-02-01T10:15:46.000000Z"}, {"uuid": "4052496a-0e72-4d5f-ac01-bae0b197e082", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13428", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/3754", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13428\n\ud83d\udd25 CVSS Score: 5.3 (CVSS_V3)\n\ud83d\udd39 Description: The WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the deleteCompanyLogo() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary company logos.\n\ud83d\udccf Published: 2025-02-01T09:30:28Z\n\ud83d\udccf Modified: 2025-02-01T09:30:28Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-13428\n2. https://plugins.trac.wordpress.org/changeset/3229608/wp-job-portal/tags/2.2.7/modules/company/model.php?old=3216415&old_path=wp-job-portal%2Ftags%2F2.2.6%2Fmodules%2Fcompany%2Fmodel.php\n3. https://www.wordfence.com/threat-intel/vulnerabilities/id/a7c786fe-898e-4478-97b9-c1fb41c9081c?source=cve", "creation_timestamp": "2025-02-01T10:15:44.000000Z"}, {"uuid": "d92f8f41-f024-49e8-97aa-c99577549c37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13425", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/3758", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13425\n\ud83d\udd25 CVSS Score: 4.2 (CVSS_V3)\n\ud83d\udd39 Description: The WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the enforcedelete() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Employer-level access and above, to delete other users companies.\n\ud83d\udccf Published: 2025-02-01T09:30:28Z\n\ud83d\udccf Modified: 2025-02-01T09:30:28Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-13425\n2. https://plugins.trac.wordpress.org/changeset/3229608/wp-job-portal/tags/2.2.7/modules/company/controller.php?old=3216415&old_path=wp-job-portal%2Ftags%2F2.2.6%2Fmodules%2Fcompany%2Fcontroller.php\n3. https://www.wordfence.com/threat-intel/vulnerabilities/id/a14e110f-0850-44f4-8de3-95a654096ae8?source=cve", "creation_timestamp": "2025-02-01T10:15:51.000000Z"}, {"uuid": "cf5fb2cc-b229-4914-b38e-deabe7093412", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13421", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/4028", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13421\n\ud83d\udd25 CVSS Score: 9.8 (CVSS_V3)\n\ud83d\udd39 Description: The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account.\n\ud83d\udccf Published: 2025-02-12T06:30:32Z\n\ud83d\udccf Modified: 2025-02-12T06:30:32Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-13421\n2. https://contempothemes.com/changelog\n3. https://themeforest.net/item/wp-pro-real-estate-7-responsive-real-estate-wordpress-theme/12473778\n4. https://www.wordfence.com/threat-intel/vulnerabilities/id/a50b3304-d55b-487a-8137-d5083c704cf4?source=cve", "creation_timestamp": "2025-02-12T07:11:38.000000Z"}, {"uuid": "ec9a1e36-c040-48df-a791-00f1eb233124", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13423", "type": "seen", "source": "https://t.me/cvedetector/19632", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13423 - \"Sparkling WordPress Plugin Activation/Deactivation Unauthorized Access\"\", \n  \"Content\": \"CVE ID : CVE-2024-13423 \nPublished : March 5, 2025, 12:15 p.m. | 51\u00a0minutes ago \nDescription : The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions in versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to activate/deactivate arbitrary plugins. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-05T14:26:19.000000Z"}, {"uuid": "27524167-b9cb-42c9-b639-cd213eba72b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13425", "type": "seen", "source": "https://t.me/cvedetector/17010", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13425 - WordPress WP Job Portal Insecure Direct Object Reference\", \n  \"Content\": \"CVE ID : CVE-2024-13425 \nPublished : Feb. 1, 2025, 8:15 a.m. | 23\u00a0minutes ago \nDescription : The WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the enforcedelete() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Employer-level access and above, to delete other users companies. \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"01 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-01T09:47:53.000000Z"}, {"uuid": "8129e106-665e-4037-8373-da31dafdebf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13428", "type": "seen", "source": "https://t.me/cvedetector/17008", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13428 - Ac wnJobs \u2013 Insecure Direct Object Reference Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-13428 \nPublished : Feb. 1, 2025, 8:15 a.m. | 23\u00a0minutes ago \nDescription : The WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the deleteCompanyLogo() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary company logos. \nSeverity: 5.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"01 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-01T09:47:51.000000Z"}, {"uuid": "9cc6af65-4c56-4689-b09c-b55292353354", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13429", "type": "seen", "source": "https://t.me/cvedetector/17007", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13429 - \"WP Job Portal Missing Validation Insecure Direct Object Reference Vulnerability\"\", \n  \"Content\": \"CVE ID : CVE-2024-13429 \nPublished : Feb. 1, 2025, 8:15 a.m. | 23\u00a0minutes ago \nDescription : The WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the 'jobenforcedelete' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with employer-level access and above, to delete arbitrary \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"01 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-01T09:47:51.000000Z"}, {"uuid": "73c53cf0-65a7-43e5-ab79-a22840cb4df1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13422", "type": "seen", "source": "https://t.me/cvedetector/16178", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13422 - \"SEO Blogger to WordPress Migration Plugin (Reflected Cross-Site Scripting)\"\", \n  \"Content\": \"CVE ID : CVE-2024-13422 \nPublished : Jan. 23, 2025, 12:15 p.m. | 45\u00a0minutes ago \nDescription : The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. \nSeverity: 6.1 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"23 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-23T14:08:04.000000Z"}, {"uuid": "c7563152-9659-449e-a759-f41a166beb89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13426", "type": "seen", "source": "https://t.me/cvedetector/16070", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13426 - WordPress WP-Polls Stored Cross-Site Scripting (SQL Injection)\", \n  \"Content\": \"CVE ID : CVE-2024-13426 \nPublished : Jan. 22, 2025, 3:15 a.m. | 24\u00a0minutes ago \nDescription : The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries. Those queries are stored and results are not displayed to the attacker, which means they cannot be exploited to obtain any additional information about the database. However, a properly configured payload allows for the injection of malicious JavaScript resulting in Stored Cross-Site Scripting. \nSeverity: 5.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"22 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-22T04:41:43.000000Z"}, {"uuid": "ba0590fc-73a9-4b70-a7e5-d13358f76c06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13420", "type": "seen", "source": "https://t.me/cvedetector/24317", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13420 - WordPress Envato Theme/Plugin Unauthorized Access Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-13420 \nPublished : May 2, 2025, 4:15 a.m. | 33\u00a0minutes ago \nDescription : Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable. \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"02 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-05-02T07:34:42.000000Z"}, {"uuid": "ff0e869e-e009-43fd-a4ef-c4af66716ce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13426", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lgcfpce4tn2n", "content": "", "creation_timestamp": "2025-01-22T03:16:15.138496Z"}, {"uuid": "82dad74e-37c6-4496-b309-aa0b34c9cb53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13426", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lgchuyawnd2q", "content": "", "creation_timestamp": "2025-01-22T03:55:13.256908Z"}, {"uuid": "92648578-8ffa-4f3d-87f8-1978b81ef4c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13424", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lgzdxuwxzm2t", "content": "", "creation_timestamp": "2025-01-31T06:16:29.337433Z"}, {"uuid": "c57b0adf-5a28-4ab8-a163-a3d1b7def3e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13425", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lh433vgbub2c", "content": "", "creation_timestamp": "2025-02-01T08:15:39.660851Z"}, {"uuid": "36b644ef-5341-4070-86c4-877a1ab58d44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13428", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lh433xo7g52n", "content": "", "creation_timestamp": "2025-02-01T08:15:42.450591Z"}, {"uuid": "01d3cf99-59dc-4a7a-8a5f-ce2b65144990", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13429", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lh433zvyow2e", "content": "", "creation_timestamp": "2025-02-01T08:15:44.527650Z"}, {"uuid": "3758ab30-cdae-47f6-9741-ab54975dfa33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13422", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lgfudxh5t62f", "content": "", "creation_timestamp": "2025-01-23T12:16:19.877020Z"}, {"uuid": "70421549-5204-44c4-b5ab-44ae4e73f2c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13424", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lgzi4pyciu2r", "content": "", "creation_timestamp": "2025-01-31T07:30:51.904024Z"}, {"uuid": "4fb5a29b-3e6a-40c6-b32e-c53402d64ea6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13422", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lgfvnyhldv2q", "content": "", "creation_timestamp": "2025-01-23T12:39:51.633614Z"}, {"uuid": "5c2bf768-8d01-4bc9-80e6-7c7e955bf8d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13429", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lh4gsnkdrg2k", "content": "", "creation_timestamp": "2025-02-01T11:45:15.612882Z"}, {"uuid": "39473cfb-27f9-406d-bb40-9fbce07147df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13428", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lh4gsnnvnb2y", "content": "", "creation_timestamp": "2025-02-01T11:45:16.177069Z"}, {"uuid": "81622abd-d93c-47df-a55d-febf7de10224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13425", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lh4gsnrpv22k", "content": "", "creation_timestamp": "2025-02-01T11:45:16.737956Z"}, {"uuid": "6d68f36e-931a-4c91-85eb-07dd929cc3d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13421", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/113989577512863138", "content": "", "creation_timestamp": "2025-02-12T06:48:39.190078Z"}, {"uuid": "afd7ddda-afbe-4018-8fb6-df92931c29d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13421", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lhxmbmtcz326", "content": "", "creation_timestamp": "2025-02-12T07:05:00.277843Z"}, {"uuid": "a8c0e5af-c305-409b-9ded-9e79ca5205e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13421", "type": "seen", "source": "https://bsky.app/profile/vulnalerts.bsky.social/post/3lhzlsuipj22t", "content": "", "creation_timestamp": "2025-02-13T02:02:03.642367Z"}, {"uuid": "abd83a18-78e1-49b5-a2bf-0c3494f4bf1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13423", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ljndxxx6vw2f", "content": "", "creation_timestamp": "2025-03-05T16:00:10.858622Z"}, {"uuid": "0ccc3893-919a-4d25-be90-86f9c8fb9e06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13421", "type": "seen", "source": "https://t.me/cvedetector/17821", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13421 - Real Estate 7 WordPress Privilege Escalation\", \n  \"Content\": \"CVE ID : CVE-2024-13421 \nPublished : Feb. 12, 2025, 5:15 a.m. | 1\u00a0hour, 26\u00a0minutes ago \nDescription : The Real Estate 7 WordPress theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.1. This is due to the plugin not properly restricting the roles allowed to be selected during registration. This makes it possible for unauthenticated attackers to register a new administrative user account. \nSeverity: 9.8 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"12 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-12T08:30:31.000000Z"}, {"uuid": "62257381-26a2-41fe-b0e6-a42cf13ee4d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13422", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2724", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13422\n\ud83d\udd39 Description: The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.\n\ud83d\udccf Published: 2025-01-23T11:13:28.888Z\n\ud83d\udccf Modified: 2025-01-23T11:13:28.888Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/a3e095b5-9c0b-45ac-a78d-e50feda348cb?source=cve\n2. https://plugins.trac.wordpress.org/browser/seo-blogger-to-wordpress-301-redirector/trunk/seo-blogger-to-wordpress.php#L356", "creation_timestamp": "2025-01-23T12:03:33.000000Z"}, {"uuid": "b879f253-7e6a-4f83-87cb-3290b3ed32e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13426", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2513", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13426\n\ud83d\udd39 Description: The WP-Polls plugin for WordPress is vulnerable to SQL Injection via COOKIE in all versions up to, and including, 2.77.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries. Those queries are stored and results are not displayed to the attacker, which means they cannot be exploited to obtain any additional information about the database. However, a properly configured payload allows for the injection of malicious JavaScript resulting in Stored Cross-Site Scripting.\n\ud83d\udccf Published: 2025-01-22T02:20:24.893Z\n\ud83d\udccf Modified: 2025-01-22T02:20:24.893Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/b76de574-2627-46cd-9817-134a009ac3bd?source=cve\n2. https://github.com/lesterchan/wp-polls/blob/97ab44c2d4c3a3d308ce8b87dae8b2a8f7147f0e/wp-polls.php#L1378\n3. https://github.com/lesterchan/wp-polls/blob/97ab44c2d4c3a3d308ce8b87dae8b2a8f7147f0e/wp-polls.php#L1416\n4. https://github.com/lesterchan/wp-polls/blob/97ab44c2d4c3a3d308ce8b87dae8b2a8f7147f0e/polls-logs.php#L97\n5. https://github.com/lesterchan/wp-polls/blob/97ab44c2d4c3a3d308ce8b87dae8b2a8f7147f0e/polls-logs.php#L294\n6. https://github.com/WordPress/wordpress-develop/blob/a82874058f58575dbba64ce09b6dcbd43ccf5fdc/src/wp-includes/default-constants.php#L249\n7. https://wordpress.org/plugins/wp-polls/\n8. https://github.com/lesterchan/wp-polls\n9. https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3224709%40wp-polls%2Ftrunk&old=2949758%40wp-polls%2Ftrunk&sfp_email=&sfph_mail=", "creation_timestamp": "2025-01-22T03:01:39.000000Z"}, {"uuid": "ce528ece-3149-48dd-bdac-5b8ca4ad65b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13424", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/3610", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13424\n\ud83d\udd25 CVSS Score: 4.2 (CVSS_V3)\n\ud83d\udd39 Description: The Ni Sales Commission For WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'niwoosc_ajax' AJAX endpoint in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings and modify commission amounts.\n\ud83d\udccf Published: 2025-01-31T06:30:53Z\n\ud83d\udccf Modified: 2025-01-31T06:30:53Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-13424\n2. https://wordpress.org/plugins/ni-woo-sales-commission\n3. https://www.wordfence.com/threat-intel/vulnerabilities/id/ac4a026b-ed1c-4864-8900-1d70d95af6f4?source=cve", "creation_timestamp": "2025-01-31T08:15:01.000000Z"}, {"uuid": "107f2e5b-3c28-4241-a0fa-ee6f1a8695c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13423", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/6538", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13423\n\ud83d\udd25 CVSS Score: 5.3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\ud83d\udd39 Description: The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions in versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to activate/deactivate arbitrary plugins.\n\ud83d\udccf Published: 2025-03-05T11:22:09.022Z\n\ud83d\udccf Modified: 2025-03-05T11:22:09.022Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/1fa8dba0-0227-428d-a6de-c4247c40e481?source=cve\n2. https://themes.trac.wordpress.org/browser/sparkling/2.4.9/inc/welcome-screen/class-sparkling-welcome.php#L69\n3. https://themes.trac.wordpress.org/browser/sparkling/2.4.9/inc/welcome-screen/class-sparkling-welcome.php#L82", "creation_timestamp": "2025-03-05T11:37:38.000000Z"}, {"uuid": "d7ca9bc4-1a99-4905-8c55-4c005840f71f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13423", "type": "seen", "source": "Telegram/NbjdesIwxivDreZpkwYD6_L7AFIztHQ3rOVx5A6xABF95koF", "content": "", "creation_timestamp": "2025-03-06T02:16:32.000000Z"}, {"uuid": "d58735a8-5dbf-47d2-9e95-1fc7c2f4027b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13424", "type": "seen", "source": "https://t.me/cvedetector/16891", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13424 - Ni Sales Commission For WooCommerce Unauthenticated AJAX Endpoint Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-13424 \nPublished : Jan. 31, 2025, 6:15 a.m. | 1\u00a0hour, 29\u00a0minutes ago \nDescription : The Ni Sales Commission For WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'niwoosc_ajax' AJAX endpoint in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings and modify commission amounts. \nSeverity: 4.3 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"31 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-31T09:30:56.000000Z"}, {"uuid": "9998a9fa-79de-414e-8585-e2d63208cace", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-1342", "type": "seen", "source": "https://t.me/ctinow/186527", "content": "https://ift.tt/C84AMBJ\nCVE-2024-1342", "creation_timestamp": "2024-02-16T17:21:26.000000Z"}, {"uuid": "74130ac2-dc6b-43f9-9502-123672603811", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13424", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113921294185019531", "content": "", "creation_timestamp": "2025-01-31T05:23:18.393322Z"}, {"uuid": "60e83bfb-b292-44c8-ab4f-8e5e38ac2415", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13421", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113989033114600468", "content": "", "creation_timestamp": "2025-02-12T04:30:12.773933Z"}, {"uuid": "e7bacae5-3004-4738-a920-7886116c592a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13421", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lhxg6bzjxd2z", "content": "", "creation_timestamp": "2025-02-12T05:15:44.127795Z"}, {"uuid": "c352d472-9ff2-4cd4-9ab7-79caadb1ea25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13427", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpv5da4usw42", "content": "", "creation_timestamp": "2025-05-24T02:53:43.471496Z"}]}