CISA Adds Two New Exploited Vulnerabilities to Its Catalog: CVE-2024-38475 and CVE-2023-44221

CISA Adds Two New Exploited Vulnerabilities to Its Catalog: CVE-2024-38475 and CVE-2023-44221

The Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) Catalog, adding two vulnerabilities, CVE-2024-38475 and CVE-2023-44221, that are …
Read more

Published Date:
May 02, 2025 (19 hours, 17 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-29824

CVE-2025-30406

CVE-2024-38475

CVE-2023-44221

Read More

CVE-2024-13738 – “Motors Car Dealer, Rental & Listing WordPress Theme Shortcode Execution Vulnerability”

CVE ID : CVE-2024-13738

Published : May 3, 2025, 3:15 a.m. | 2 hours, 15 minutes ago

Description : The The Motors – Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.6.65. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

*It is unclear exactly which version the issue was patched in from the changelog. Therefore, we used the latest version at the time of verification.

Severity: 7.3 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More

CVE-2025-3779 – WordPress Personizely Stored Cross-Site Scripting

CVE ID : CVE-2025-3779

Published : May 3, 2025, 3:15 a.m. | 2 hours, 15 minutes ago

Description : The Personizely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘widgetId’ parameter in all versions up to, and including, 0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More

CVE-2025-3918 – WordPress Job Listings Privilege Escalation

CVE ID : CVE-2025-3918

Published : May 3, 2025, 3:15 a.m. | 2 hours, 16 minutes ago

Description : The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1 to 0.1.1. The plugin’s registration handler reads the client-supplied $_POST[‘user_role’] and passes it directly to wp_insert_user() without restricting to a safe set of roles. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Severity: 9.8 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More