Analysis Summary

CVE-2024-35297 CVSS:5.4

WP Booking plugin for WordPress is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

CVE-2024-3552 CVSS:9.8

Web Directory Free plugin for WordPress is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

CVE-2024-0453 CVSS:5

AI ChatBot Plugin for WordPress could allow a remote authenticated attacker to bypass security restrictions, caused by a missing capability check on the openai_file_delete_callback function. By sending a specially crafted request, an attacker could exploit this vulnerability to update plugin settings.

CVE-2024-0452 CVSS:5

AI ChatBot Plugin for WordPress could allow a remote authenticated attacker to bypass security restrictions, caused by a missing capability check on the openai_file_upload_callback function. By sending a specially crafted request, an attacker could exploit this vulnerability to update plugin settings.

CVE-2024-3495 CVSS:9.8

Trusty Plugins Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements using the cnt and sid parameters, which could allow the attacker to view, add, modify or delete information in the back-end database.

CVE-2023-41665 CVSS:9.8

GiveWP Plugin for WordPress could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper privilege management vulnerability. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to achieve privilege escalation.

Impact

• Cross-Site Scripting
• Data Manipulation
• Security Bypass
• Gain Access

Indicators of Compromise

CVE

• CVE-2024-35297
• CVE-2024-3552
• CVE-2024-0453
• CVE-2024-0452
• CVE-2024-3495
• CVE-2023-41665

Affected Vendors

Remediation

Upgrade to the latest version of plugin for WordPress, available from the Website.

CVE-2024-35297

CVE-2024-3552

CVE-2024-0453

CVE-2024-0452

CVE-2024-3495

CVE-2023-41665