https://vulnerability.circl.lu/sightings/feed 2026-07-08T15:24:50.159468+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/20a42472-ac5c-48ea-8ea0-0025547182fb/export 2026-07-08T15:24:50.186207+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "20a42472-ac5c-48ea-8ea0-0025547182fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11843", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17063", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-11843\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: The Panorama WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).\n\ud83d\udccf Published: 2025-05-15T20:06:51.172Z\n\ud83d\udccf Modified: 2025-05-20T19:33:19.083Z\n\ud83d\udd17 References:\n1. https://wpscan.com/vulnerability/0dd41559-d88a-4018-a0f0-c8944b6d6f0a/", "creation_timestamp": "2025-05-20T19:43:02.000000Z"} 2025-05-20T19:43:02+00:00 https://vulnerability.circl.lu/sighting/27edb520-b8f6-4b30-ad8d-f11bd6ea13ea/export 2026-07-08T15:24:50.187678+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "27edb520-b8f6-4b30-ad8d-f11bd6ea13ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11848", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lmuxxzoo5z27", "content": "", "creation_timestamp": "2025-04-15T21:02:26.004973Z"} 2025-04-15T21:02:26.004973+00:00 https://vulnerability.circl.lu/sighting/4934a8d4-9a0c-43b2-aeb4-edb5a6e98b3d/export 2026-07-08T15:24:50.187802+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "4934a8d4-9a0c-43b2-aeb4-edb5a6e98b3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11847", "type": "seen", "source": "https://t.me/cvedetector/21150", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2024-11847 - WordPress SVG Upload Stored XSS Vulnerability\", \n \"Content\": \"CVE ID : CVE-2024-11847 \nPublished : March 26, 2025, 6:15 a.m. | 2\u00a0hours, 17\u00a0minutes ago \nDescription : The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"26 Mar 2025\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-26T09:42:18.000000Z"} 2025-03-26T09:42:18+00:00 https://vulnerability.circl.lu/sighting/8887ca8e-1c11-47b3-8017-3f983530ab78/export 2026-07-08T15:24:50.187908+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8887ca8e-1c11-47b3-8017-3f983530ab78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11847", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/8809", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-11847\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.\n\ud83d\udccf Published: 2025-03-26T06:00:02.270Z\n\ud83d\udccf Modified: 2025-03-26T06:00:02.270Z\n\ud83d\udd17 References:\n1. https://wpscan.com/vulnerability/f57ecff2-0cff-40c7-b6e4-5b162b847d65/", "creation_timestamp": "2025-03-26T06:25:18.000000Z"} 2025-03-26T06:25:18+00:00 https://vulnerability.circl.lu/sighting/8260a42f-8de8-4bb2-84fd-cd65be49565f/export 2026-07-08T15:24:50.188009+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "8260a42f-8de8-4bb2-84fd-cd65be49565f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11848", "type": "seen", "source": "https://infosec.exchange/users/random_robbie/statuses/114059639239904191", "content": "", "creation_timestamp": "2025-02-24T15:46:16.214842Z"} 2025-02-24T15:46:16.214842+00:00 https://vulnerability.circl.lu/sighting/a07e8058-c4ce-4a2f-9b82-439992b921ae/export 2026-07-08T15:24:50.188103+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a07e8058-c4ce-4a2f-9b82-439992b921ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11848", "type": "seen", "source": "https://t.me/cvedetector/15437", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2024-11848 - NitroPack WordPress Unauthenticated Capabilities Arbitrary Option Modification Vulnerability\", \n \"Content\": \"CVE ID : CVE-2024-11848 \nPublished : Jan. 15, 2025, 12:15 p.m. | 46\u00a0minutes ago \nDescription : The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options to a fixed value of '1' which can activate certain options (e.g., enable user registration) or modify certain options in a way that leads to a denial of service condition. \nSeverity: 8.1 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"15 Jan 2025\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-15T14:16:29.000000Z"} 2025-01-15T14:16:29+00:00 https://vulnerability.circl.lu/sighting/5e46636e-a060-47dd-a531-7822e36a5e0f/export 2026-07-08T15:24:50.188204+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "5e46636e-a060-47dd-a531-7822e36a5e0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11848", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/113832448233551723", "content": "", "creation_timestamp": "2025-01-15T12:48:37.465397Z"} 2025-01-15T12:48:37.465397+00:00 https://vulnerability.circl.lu/sighting/a472af90-2e52-4ce6-a4c2-e40331a55ecb/export 2026-07-08T15:24:50.188291+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "a472af90-2e52-4ce6-a4c2-e40331a55ecb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11848", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lfrserdgmu2e", "content": "", "creation_timestamp": "2025-01-15T12:47:45.807714Z"} 2025-01-15T12:47:45.807714+00:00 https://vulnerability.circl.lu/sighting/25f7117c-c937-4813-a995-1b6994bda7f6/export 2026-07-08T15:24:50.188373+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "25f7117c-c937-4813-a995-1b6994bda7f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11848", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lfrseqgyak2y", "content": "", "creation_timestamp": "2025-01-15T12:47:44.030961Z"} 2025-01-15T12:47:44.030961+00:00 https://vulnerability.circl.lu/sighting/377fd718-3782-496b-83f8-aabb546b7f02/export 2026-07-08T15:24:50.188457+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "377fd718-3782-496b-83f8-aabb546b7f02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11848", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/1736", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-11848\n\ud83d\udd39 Description: The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options to a fixed value of '1' which can activate certain options (e.g., enable user registration) or modify certain options in a way that leads to a denial of service condition.\n\ud83d\udccf Published: 2025-01-15T11:24:35.912Z\n\ud83d\udccf Modified: 2025-01-15T11:24:35.912Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/1e1b06d0-f348-4a8b-8730-a87d8e2ba2a1?source=cve\n2. https://plugins.trac.wordpress.org/changeset/3211235/nitropack", "creation_timestamp": "2025-01-15T12:22:07.000000Z"} 2025-01-15T12:22:07+00:00