Threat database

47 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
High	8.5	EPSS 0.5%	CVE-2024-37092Consulting Elementor Widgets · Path Traversal High8.5EPSS 0.5%2024-06-24CVE Database V5CVE-2024-37092 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0. EPSS 0.5%Vulnerability StylemixThemes #cwe-22	CVE Database V5	2024-06-24
Critical	9.9	EPSS 1.2%	CVE-2024-37091Consulting Elementor Widgets · Command Injection Critical9.9EPSS 1.2%2024-06-24CVE Database V5CVE-2024-37091 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixThemes Masterstudy Elementor Widgets allows OS Command Injection.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0; Masterstudy Elementor Widgets: from n/a through 1.2.2. EPSS 1.2%Vulnerability StylemixThemes #cwe-77	CVE Database V5	2024-06-24
Critical	9.0	EPSS 0.6%	CVE-2024-37089Consulting Elementor Widgets · Path Traversal Critical9.0EPSS 0.6%2024-06-24CVE Database V5CVE-2024-37089 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0. EPSS 0.6%Vulnerability StylemixThemes #cwe-22	CVE Database V5	2024-06-24
Medium	5.8	EPSS 0.3%	CVE-2024-4787Cost Calculator Builder PRO · Improper Input Validation Medium5.8EPSS 0.3%2024-06-19CVE Database V5CVE-2024-4787 The Cost Calculator Builder PRO for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 3.1.75. This is due to insufficient limitations on the email recipient and the content in the 'send_pdf' and the 'send_pdf_front' functions which are reachable via AJAX. This makes it possible for unauthenticated attackers to send emails with any content to any recipient. EPSS 0.3%Vulnerability StylemixThemes #cwe-20	CVE Database V5	2024-06-19
Critical	9.0	EPSS 0.5%	CVE-2024-35677MegaMenu · Path Traversal Critical9.0EPSS 0.5%2024-06-10CVE Database V5CVE-2024-35677 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes MegaMenu allows PHP Local File Inclusion.This issue affects MegaMenu: from n/a through 2.3.12. EPSS 0.5%Vulnerability StylemixThemes #cwe-22	CVE Database V5	2024-06-10
Medium	6.4	EPSS 0.3%	CVE-2024-4789Cost Calculator Builder PRO · Server-Side Request Forgery (SSRF) Medium6.4EPSS 0.3%2024-05-17CVE Database V5CVE-2024-4789 Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. EPSS 0.3%Vulnerability StylemixThemes #cwe-918	CVE Database V5	2024-05-17
High	7.2	EPSS 0.6%	CVE-2024-4097Cost Calculator Builder PRO · Cross-site Scripting High7.2EPSS 0.6%2024-05-02CVE Database V5CVE-2024-4097 The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 3.1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. EPSS 0.6%Vulnerability StylemixThemes #cwe-79	CVE Database V5	2024-05-02

Showing 41–47 of 47 results