CVE-2024-1421 — Cross-site Scripting

Vendor	Product	Version range	Fixed in
devitemsllc	ht_mega_addons_for_elementor_elementor_widgets_template_builder	<= 2.4.4	—
hasthemes	ht_mega	<= 2.4.4	—

GHSA

GHSA-gjp2-jvrj-5pr5: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribute of the P

ghsa_unreviewed·2024-03-13

CVE-2024-1421 [MEDIUM] CWE-79 GHSA-gjp2-jvrj-5pr5: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribute of the P The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribute of the Post Carousel widget in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Red Hat

microcode_ctl: From CVEorg collector

vendor_redhat·2025-05-13·CVSS 5.7

CVE-2024-28956 [MEDIUM] CWE-1421 microcode_ctl: From CVEorg collector microcode_ctl: From CVEorg collector Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. New Spectre-v2 attack classes have been discovered within CPU architectures that enable self-training exploitation of speculative execution within the same privilege domain. These novel techniques bypass existing hardware and software mitigations, including IBPB, eIBRS, and BHI_NO, by leveraging in-kernel gadgets (potentially accessible via SECCOMP/cBPF), Branch Target Buffer (BTB) aliasing, and direct-to-indirect branch predictor training. While the root cause lies in CPU architectural behavior, the vulnerability manifests throug

Red Hat

kernel: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg

vendor_redhat·2024-06-19·CVSS 4.7

CVE-2024-38596 [MEDIUM] CWE-362 kernel: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg kernel: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg A data-race condition has been identified in af_unix. In one data path, the write function unix_release_sock() atomically writes to sk->sk_shutdown using WRITE_ONCE. However, on the reader side, unix_stream_sendmsg() does not read it atomically. Consequently, this issue is causing the following KCSAN splat to occur: BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28: unix_release_sock (net/unix/af_unix.c:640) unix_release (net/unix/af_unix.c:1050) sock_close (net/socket.c:659 net/socket.c:1421) __fput (

CVE-2024-1421: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘border_type’ attribute of the Post…

Affected

CVSS provenance