Chloe Chamberland
May 9, 2024

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 29, 2024 to May 5, 2024)

🎉 Did you know we’re running a Bug Bounty Extravaganza again?

Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!

Last week, there were 164 vulnerabilities disclosed in 145 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 73 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 16,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • WAF-RULE-698 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-696 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-693 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 117
Unpatched 47

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 147
High Severity 14
Critical Severity 3

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 87
Missing Authorization 38
Cross-Site Request Forgery (CSRF) 8
Deserialization of Untrusted Data 5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 5
Exposure of Sensitive Information to an Unauthorized Actor 3
Improper Access Control 2
Improper Control of Generation of Code ('Code Injection') 2
Server-Side Request Forgery (SSRF) 2
URL Redirection to Untrusted Site ('Open Redirect') 2
Authorization Bypass Through User-Controlled Key 1
Exposure of Sensitive System Information to an Unauthorized Control Sphere 1
External Control of Assumed-Immutable Web Parameter 1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 1
Improper Input Validation 1
Insecure Storage of Sensitive Information 1
Insertion of Sensitive Information into Log File 1
Unrestricted Upload of File with Dangerous Type 1
Use of Insufficiently Random Values 1
Use of Less Trusted Source 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
16
15
11
10
8
8
8
7
7
6
5
5
4
4
4
3
3
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery interactive-3d-flipbook-powered-physics-engine
5280 Bootstrap Modal Contact Form 5280-bootstrap-modal-contact-form
AA Cash Calculator aa-calculator
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution academy
ACF Front End Editor acf-front-end-editor
ACF On-The-Go acf-on-the-go
Admin Page Spider admin-page-spider
AJAX Login and Registration modal popup + inline form ajax-login-and-registration-modal-popup
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic all-in-one-seo-pack
All-in-One Addons for Elementor – WidgetKit widgetkit-for-elementor
All-in-One Video Gallery all-in-one-video-gallery
Alt Text AI – Automatically generate image alt text for SEO and accessibility alttext-ai
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) wp-analytify
AnnounceKit announcekit
Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms stop-spammer-registrations-plugin
Archives Calendar Widget archives-calendar-widget
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup armember-membership
AWeber for WooCommerce woocommerce-aweber-newsletter-subscription
Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. barcode-scanner-lite-pos-to-manage-products-inventory-and-orders
Booster Extension booster-extension
Booster for WooCommerce woocommerce-jetpack
Breakdance breakdance
BuddyPress buddypress
Calendar calendar
Call / Contact Button button-contact-vr
Carousel Slider carousel-slider
ChatBot Conversational Forms conversational-forms
CodeBard's Patron Button and Widgets for Patreon patron-button-and-widgets-by-codebard
ConvertPlus convertplug
Cost Calculator Builder PRO cost-calculator-builder-pro
CPO Companion cpo-companion
Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce
Customer Email Verification for WooCommerce emails-verification-for-woocommerce
Debug Log Manager debug-log-manager
Democracy Poll democracy-poll
Different Menu in Different Pages – Control Menu Visibility (All in One) different-menus-in-different-pages
Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings directorist
Drag and Drop Multiple File Upload – Contact Form 7 drag-and-drop-multiple-file-upload-contact-form-7
EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory ean-for-woocommerce
Easy Restaurant Table Booking easy-table-booking
Eleblog – Elementor Blog And Magazine Addons ele-blog
Elementor Addon Elements addon-elements-for-elementor-page-builder
Elementor ImageBox fd-elementor-imagebox
Elementor Website Builder Pro elementor-pro
ElementsKit Elementor addons elementskit-lite
ElementsReady Addons for Elementor element-ready-lite
Embed Google Fonts embed-google-fonts
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders essential-addons-for-elementor-lite
Event Monster – Event Management, Tickets Booking, Upcoming Event event-monster
EventON eventon-lite
Exclusive Addons for Elementor exclusive-addons-for-elementor
Fancy Elementor Flipbox fancy-elementor-flipbox
Flattr flattr
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager folders
Follow Us Badges wpsite-follow-us-badges
Giphypress giphypress
Google Doc Embedder google-document-embedder
Google Typography google-typography
Grid Gallery – Photo Image Grid Gallery new-grid-gallery
Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor front-editor
Gutenberg Blocks with AI by Kadence WP – Page Builder Features kadence-blocks
GWP-Histats gwp-histats
IDonate – Blood Donation, Request And Donor Management System idonate
Import and export users and customers import-users-from-csv-with-meta
Inline Google Spreadsheet Viewer inline-google-spreadsheet-viewer
iPages Flipbook For WordPress ipages-flipbook
iPanorama 360 – WordPress Virtual Tour Builder ipanorama-360-virtual-tour-builder-lite
Jeg Elementor Kit jeg-elementor-kit
JW Player for WordPress jw-player-7-for-wp
LA-Studio Element Kit for Elementor lastudio-element-kit
Last Viewed Posts by WPBeginner last-viewed-posts
LeadConnector leadconnector
Login Logout Register Menu login-logout-register-menu
Login with phone number login-with-phone-number
MailerLite – Signup forms (official) official-mailerlite-sign-up-forms
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations master-addons
Masteriyo LMS – eLearning and Online Course Builder for WordPress learning-management-system
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MDTF – Meta Data and Taxonomies Filter wp-meta-data-filter-and-taxonomy-filter
Media Cleaner: Clean your WordPress! media-cleaner
Mhr Post Ticker mhr-post-ticker
Min and Max Purchase for WooCommerce min-and-max-purchase-for-woocommerce
Mini Loops mini-loops
Mooberry Book Manager mooberry-book-manager
PB MailCrypt – AntiSpam Email Encryption pb-mailcrypt-antispam-email-encryption
Perfect Pullquotes perfect-pullquotes
Pet Manager pet-manager
Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery new-photo-gallery
Photo Gallery, Images, Slider in Rbs Image Gallery robo-gallery
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups ays-popup-box
Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder ajax-filter-posts
Premium Addons for Elementor premium-addons-for-elementor
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce a4-barcode-generator
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin print-my-blog
Print-O-Matic print-o-matic
Progressive WordPress (PWA) progressive-wp
PropertyHive propertyhive
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings seo-by-rank-math
Realtyna Organic IDX plugin + WPL Real Estate real-estate-listing-realtyna-wpl
RegistrationMagic – User Registration Plugin with Custom Registration Forms custom-registration-form-builder-with-submission-manager
ReviewX – Multi-criteria Rating & Reviews for WooCommerce reviewx
RomethemeKit For Elementor rometheme-for-elementor
rtMedia for WordPress, BuddyPress and bbPress buddypress-media
Sailthru Triggermail sailthru-triggermail
SEOPress – On-site SEO wp-seopress
Share This Image share-this-image
Sheets to WP Table Live Sync | Google Sheets Table Plugin for WordPress with Spreadsheet Integration – FlexTable sheets-to-wp-table-live-sync
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +16 Modules – All in One Solution (formerly WooLentor) woolentor-addons
Simple Basic Contact Form simple-basic-contact-form
Simple Image Popup simple-image-popup
Simple Membership simple-membership
SimpleShop simpleshop-cz
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) sina-extension-for-elementor
Slider Revolution revslider
Sliding Widgets sliding-widgets
Social Icons Widget & Block by WPZOOM social-icons-widget-by-wpzoom
Social Share Icons & Social Share Buttons ultimate-social-media-plus
SP Project & Document Manager sp-client-document-manager
Subway – Private Site Option subway
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder supreme-modules-for-divi
Survey Maker survey-maker
SVS Pricing Tables svs-pricing-tables
Swift Framework swift-framework
Sydney Toolbox sydney-toolbox
Tabellen von faustball.com docollipics-faustball-de
Testimonial Slider testimonial-slider
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid the-post-grid
The School Management Pro school-management-pro
TweetScroll Widget tweetscroll-widget
Ultimate Under Construction ultimate-under-construction
Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery new-video-gallery
Web Push Notifications – Webpushr webpushr-web-push-notifications
Where Did You Hear About Us Checkout Field for WooCommerce wc-customer-source
Woo Total Sales woo-total-sales
WordPress Flipbook by Supsystic digital-publications-by-supsystic
WordPress Header Builder Plugin – Pearl pearl-header-builder
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting erp
WP Recipe Maker wp-recipe-maker
WP Shortcodes Plugin — Shortcodes Ultimate shortcodes-ultimate
WP Video Lightbox wp-video-lightbox
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More wpforms-lite
WPify Woo Czech wpify-woo
WTI Like Post wti-like-post
XServer Migrator xserver-migrator
ZD YouTube FLV Player zd-youtube-flv-player

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Adventure Journal adventure-journal
Blocksy blocksy
Edge edge
Freesia Empire freesia-empire
Pliska pliska
Restaurant and Cafe restaurant-and-cafe
Unique unique

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Last Viewed Posts by WPBeginner <= 1.0.0 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-3070
Patch Status
Patched
Published
May 2, 2024
Affected Software
Last Viewed Posts by WPBeginner
Researcher
More Details >

School Management Pro <= 10.3.4 - Authenticated (School Admin+) SQL Injection

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-33911
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
The School Management Pro
Researcher
More Details >

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.2 - Unauthenticated Arbitrary Shortcode Execution

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-34434
Patch Status
Patched
Published
May 3, 2024
Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher
More Details >

All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-4033
Patch Status
Patched
Published
May 1, 2024
Affected Software
All-in-One Video Gallery
Researcher
More Details >

Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Authenticated (Subscriber+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-2661
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.
Researcher
More Details >

Calendar <= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-2831
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Calendar
Researcher
More Details >

ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-3240
Patch Status
Patched
Published
May 3, 2024
Affected Software
ConvertPlus
Researcher
More Details >

rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Subscriber+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
Unknown
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
rtMedia for WordPress, BuddyPress and bbPress
Researcher
More Details >

Sina Extension for Elementor <= 3.5.1 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-34384
Patch Status
Patched
Published
May 3, 2024
Affected Software
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)
Researcher
More Details >

Xserver Migrator <= 1.6.2 - Cross-Site Request Forgery to Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-33913
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
XServer Migrator
Researcher
More Details >

ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgery

8.3
CVSS Rating
High (8.3)
CVE-ID
CVE-2024-2663
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
ZD YouTube FLV Player
Researcher
More Details >

Customer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient Randomness

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-4185
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Customer Email Verification for WooCommerce
Researcher
More Details >

Event Monster <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Custom Meta

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-1895
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Event Monster – Event Management, Tickets Booking, Upcoming Event
Researcher
More Details >

Grid Gallery – Photo Image Grid Gallery <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-1897
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Grid Gallery – Photo Image Grid Gallery
Researcher
More Details >

Photo Gallery <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-1896
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery
Researcher
More Details >

Cost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-4097
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Cost Calculator Builder PRO
Researcher
More Details >

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-1173
Patch Status
Patched
Published
May 1, 2024
Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher
More Details >

Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-3957
Patch Status
Patched
Published
May 1, 2024
Affected Software
Booster for WooCommerce
Researcher
More Details >

LeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-1371
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
LeadConnector
Researcher
More Details >

3D FlipBook <= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URL

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3883
Patch Status
Patched
Published
May 1, 2024
Affected Software
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
Researcher
More Details >

Adventure Journal <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33953
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Adventure Journal
Researcher
More Details >

AJAX Login and Registration modal popup + inline form <= 2.23 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33918
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
AJAX Login and Registration modal popup + inline form
Researcher
More Details >

All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3554
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
Researcher
More Details >

All in One SEO <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3368
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic
Researcher
More Details >

Blocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4158
Patch Status
Patched
Published
May 3, 2024
Affected Software
Blocksy
Researcher
More Details >

Breakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2023-6854
Patch Status
Patched
Published
May 3, 2024
Affected Software
Breakdance
Researcher
More Details >

BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3974
Patch Status
Patched
Published
May 3, 2024
Affected Software
BuddyPress
Researcher
More Details >

CPO Companion <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33916
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
CPO Companion
Researcher
More Details >

Edge <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-34376
Patch Status
Patched
Published
May 3, 2024
Affected Software
Edge
Researcher
More Details >

Eleblog – Elementor Blog And Magazine Addons <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33945
Patch Status
Unpatched
Published
Apr 30, 2024
Affected Software
Eleblog – Elementor Blog And Magazine Addons
Researcher
More Details >

Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3743
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Elementor Addon Elements
Researcher
More Details >

Elementor ImageBox <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3074
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Elementor ImageBox
Researchers
More Details >

Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4107
Patch Status
Patched
Published
May 2, 2024
Affected Software
Elementor Website Builder Pro
Researcher
More Details >

ElementsKit Elementor addons 3.0.7 - 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3650
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
ElementsKit Elementor addons
Researcher
More Details >

ElementsReady Addons for Elementor <= 5.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-34374
Patch Status
Patched
Published
May 3, 2024
Affected Software
ElementsReady Addons for Elementor
Researcher
More Details >

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4156
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders
Researcher
More Details >

Fancy Elementor Flipbox <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2349
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Fancy Elementor Flipbox
Researcher
More Details >

Follow Us Badges <= 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3280
Patch Status
Patched
Published
May 1, 2024
Affected Software
Follow Us Badges
Researcher
More Details >

Freesia Empire <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33955
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Freesia Empire
Researcher
More Details >

Giphypress <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33927
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Giphypress
Researcher
More Details >

Google Doc Embedder <= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0216
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Google Doc Embedder
Researcher
More Details >

Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2273
Patch Status
Patched
Published
May 1, 2024
Affected Software
Gutenberg Blocks with AI by Kadence WP – Page Builder Features
Researcher
More Details >

GWP-Histats <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33926
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
GWP-Histats
Researcher
More Details >

Inline Google Spreadsheet Viewer <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3674
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Inline Google Spreadsheet Viewer
Researcher
More Details >

Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0334
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Jeg Elementor Kit
Researcher
More Details >

Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3161
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Jeg Elementor Kit
Researcher
More Details >

LA-Studio Element Kit for Elementor <= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3005
Patch Status
Patched
Published
May 1, 2024
Affected Software
LA-Studio Element Kit for Elementor
Researcher
More Details >

Login Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33932
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Login Logout Register Menu
Researcher
More Details >

MailerLite – Signup forms (official) 1.5.0 - 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1386
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
MailerLite – Signup forms (official)
Researcher
More Details >

Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4265
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
Researcher
More Details >

Mini Loops <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33934
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Mini Loops
Researcher
More Details >

PB MailCrypt <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33935
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
PB MailCrypt – AntiSpam Email Encryption
Researcher
More Details >

Perfect Pullquotes <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33951
Patch Status
Unpatched
Published
Apr 30, 2024
Affected Software
Perfect Pullquotes
Researcher
More Details >

Pliska <= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33954
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Pliska
Researcher
More Details >

Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Templates

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1679
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce
Researcher
More Details >

Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33936
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Print-O-Matic
Researcher
More Details >

PropertyHive <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-34381
Patch Status
Patched
Published
May 3, 2024
Affected Software
PropertyHive
Researcher
More Details >

Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4335
Patch Status
Patched
Published
May 3, 2024
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Researcher
More Details >

ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3991
Patch Status
Patched
Published
May 2, 2024
Affected Software
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +16 Modules – All in One Solution (formerly WooLentor)
Researcher
More Details >

Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4383
Patch Status
Patched
Published
May 3, 2024
Affected Software
Simple Membership
Researcher
More Details >

Slider Revolution <= 6.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via htmltag Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4092
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Slider Revolution
Researcher
More Details >

Sliding Widgets <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33938
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Sliding Widgets
Researcher
More Details >

Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4334
Patch Status
Patched
Published
May 1, 2024
Affected Software
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
Researcher
More Details >

Swift Framework <= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3916
Patch Status
Unpatched
Published
May 3, 2024
Affected Software
Swift Framework
Researcher
More Details >

Sydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4036
Patch Status
Patched
Published
May 1, 2024
Affected Software
Sydney Toolbox
Researcher
More Details >

Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4193
Patch Status
Patched
Published
May 3, 2024
Affected Software
Testimonial Slider
Researcher
More Details >

TweetScroll Widget <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33948
Patch Status
Unpatched
Published
Apr 30, 2024
Affected Software
TweetScroll Widget
Researcher
More Details >

Unique <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33952
Patch Status
Unpatched
Published
Apr 30, 2024
Affected Software
Unique
Researcher
More Details >

WordPress Header Builder Plugin – Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4000
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
WordPress Header Builder Plugin – Pearl
Researcher
More Details >

WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3490
Patch Status
Patched
Published
May 1, 2024
Affected Software
WP Recipe Maker
Researcher
More Details >

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3550
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
WP Shortcodes Plugin — Shortcodes Ultimate
Researcher
More Details >

WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4324
Patch Status
Patched
Published
May 1, 2024
Affected Software
WP Video Lightbox
Researcher
More Details >

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization

6.3
CVSS Rating
Medium (6.3)
CVE-ID
CVE-2024-3942
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Researcher
More Details >

Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Improper Authorization

6.3
CVSS Rating
Medium (6.3)
CVE-ID
CVE-2024-1677
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce
Researcher
More Details >

AA Cash Calculator <= 1.0 - Reflected Cross-Site Scripting via invoice

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-0848
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
AA Cash Calculator
Researcher
More Details >

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-4133
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
Researcher
More Details >

CodeBard's Patron Button and Widgets for Patreon <= 2.2.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-33928
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
CodeBard's Patron Button and Widgets for Patreon
Researcher
More Details >

Pet Manager <= 1.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-3917
Patch Status
Unpatched
Published
May 2, 2024
Affected Software
Pet Manager
Researcher
More Details >

Popup box <= 4.1.2 - Cross-Site Request Forgery

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-34367
Patch Status
Patched
Published
May 3, 2024
Affected Software
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
Researcher
More Details >

Realtyna Organic IDX plugin <= 4.14.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-33924
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Realtyna Organic IDX plugin + WPL Real Estate
Researcher
More Details >

RegistrationMagic <= 5.3.2.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-33947
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
RegistrationMagic – User Registration Plugin with Custom Registration Forms
Researcher
More Details >

Sailthru Triggermail <= 1.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-4289
Patch Status
Unpatched
Published
Apr 30, 2024
Affected Software
Sailthru Triggermail
Researcher
More Details >

Simple Basic Contact Form <= 20221201 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-4150
Patch Status
Patched
Published
May 3, 2024
Affected Software
Simple Basic Contact Form
Researcher
More Details >

Webpushr <= 4.35.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-34369
Patch Status
Patched
Published
May 3, 2024
Affected Software
Web Push Notifications – Webpushr
Researcher
More Details >

WPify Woo Czech <= 4.0.10 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-33946
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
WPify Woo Czech
Researcher
More Details >

Carousel Slider <= 2.2.10 - Authenticated (Editor+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-4372
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Carousel Slider
Researcher
More Details >

Where Did You Hear About Us Checkout Field for WooCommerce <= 1.3.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-2752
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Where Did You Hear About Us Checkout Field for WooCommerce
Researcher
More Details >

Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorization

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1809
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy)
Researcher
More Details >

ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-3237
Patch Status
Patched
Published
May 3, 2024
Affected Software
ConvertPlus
Researcher
More Details >

Exclusive Addons Elementor <= 2.6.9.1 - Missing Authorization to Post Duplication

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-33914
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Exclusive Addons for Elementor
Researcher
More Details >

Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-3868
Patch Status
Patched
Published
May 3, 2024
Affected Software
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
Researcher
More Details >

Min and Max Purchase for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-33949
Patch Status
Unpatched
Published
Apr 30, 2024
Affected Software
Min and Max Purchase for WooCommerce
Researcher
More Details >

Pet Manager <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-3918
Patch Status
Unpatched
Published
May 2, 2024
Affected Software
Pet Manager
Researcher
More Details >

Premium Addons for Elementor <= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-4203
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Premium Addons for Elementor
Researcher
More Details >

Share This Image <= 1.98 - Open Redirect

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-33930
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Share This Image
Researcher
More Details >

Stop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2023-7065
Patch Status
Patched
Published
May 3, 2024
Affected Software
Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms
Researcher
More Details >

Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2109
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Booster Extension
Researcher
More Details >

Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3649
Patch Status
Patched
Published
May 1, 2024
Affected Software
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
Researcher
More Details >

Democracy Poll <= 6.0.3 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33920
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Democracy Poll
Researcher
More Details >

Digital Publications by Supsystic <= 1.7.7 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33910
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
WordPress Flipbook by Supsystic
Researcher
More Details >

Directorist <= 7.8.6 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33929
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings
Researcher
More Details >

Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3717
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Drag and Drop Multiple File Upload – Contact Form 7
Researcher
More Details >

EAN for WooCommerce <= 4.8.9 - Authenticated (Shop Manager+) Arbitrary Options Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-34370
Patch Status
Patched
Published
May 3, 2024
Affected Software
EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory
Researcher
More Details >

iPages Flipbook <= 1.5.1 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33909
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
iPages Flipbook For WordPress
Researcher
More Details >

iPanorama 360 WordPress Virtual Tour Builder <= 1.8.1 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33941
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
iPanorama 360 – WordPress Virtual Tour Builder
Researcher
More Details >

JW Player for WordPress <= 2.3.3 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33931
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
JW Player for WordPress
Researcher
More Details >

MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2797
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
MailerLite – Signup forms (official)
Researcher
More Details >

Masteriyo - LMS <= 1.7.3 - Insecure Direct Object Reference

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33939
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Masteriyo LMS – eLearning and Online Course Builder for WordPress
Researcher
More Details >

Media Cleaner: Clean your WordPress! <= 6.7.2 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33922
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Media Cleaner: Clean your WordPress!
Researcher
More Details >

Mooberry Book Manager <= 4.15.12 - Unauthenticated Information Exposure via Export Files

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-34368
Patch Status
Patched
Published
May 3, 2024
Affected Software
Mooberry Book Manager
Researcher
More Details >

Post Grid Master <= 3.4.7 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-34372
Patch Status
Patched
Published
May 3, 2024
Affected Software
Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder
Researcher
More Details >

Print My Blog – Print, PDF, & eBook Converter WordPress Plugin <= 3.26.2 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33907
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin
Researcher
More Details >

Robo Gallery <= 3.2.18 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-34382
Patch Status
Patched
Published
May 3, 2024
Affected Software
Photo Gallery, Images, Slider in Rbs Image Gallery
Researcher
More Details >

RomethemeKit For Elementor <= 1.4.1 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33919
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
RomethemeKit For Elementor
Researcher
More Details >

SEOPress <= 7.6.1 - Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-34383
Patch Status
Patched
Published
May 3, 2024
Affected Software
SEOPress – On-site SEO
Researcher
More Details >

ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2023-6327
Patch Status
Patched
Published
May 3, 2024
Affected Software
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +16 Modules – All in One Solution (formerly WooLentor)
Researcher
More Details >

SimpleShop <= 2.10.2 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1229
Patch Status
Patched
Published
May 3, 2024
Affected Software
SimpleShop
Researcher
More Details >

Social Share Icons & Social Share Buttons <= 3.6.2 - Missing Authorization to Notice Dismissal

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-32820
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Social Share Icons & Social Share Buttons
Researcher
More Details >

Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1678
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Subway – Private Site Option
Researcher
More Details >

Swift Framework <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3915
Patch Status
Unpatched
Published
May 3, 2024
Affected Software
Swift Framework
Researcher
More Details >

Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery <= 1.5.3 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-34377
Patch Status
Patched
Published
May 3, 2024
Affected Software
Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery
Researcher
More Details >

WidgetKit <= 2.5.1 - Missing Authorization to Notice Dismissal

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33908
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
All-in-One Addons for Elementor – WidgetKit
Researcher
More Details >

Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1688
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Woo Total Sales
Researcher
More Details >

WooCommerce AWeber Newsletter Subscription <= 4.0.2 - Missing Authorization to Access Token Modification

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33944
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
AWeber for WooCommerce
Researcher
More Details >

WTI Like Post <= 1.4.6 - IP Spoofing

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-33917
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
WTI Like Post
Researcher
More Details >

Admin Page Spider <= 3.31 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2401
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Admin Page Spider
Researcher
More Details >

AnnounceKit <= 2.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3023
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
AnnounceKit
Researcher
More Details >

Archives Calendar Widget <= 1.0.15 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-33950
Patch Status
Unpatched
Published
Apr 30, 2024
Affected Software
Archives Calendar Widget
Researcher
More Details >

Button contact VR <= 4.7 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2220
Patch Status
Patched
Published
May 2, 2024
Affected Software
Call / Contact Button
Researcher
More Details >

Conversational Forms for ChatBot <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-34380
Patch Status
Patched
Published
May 3, 2024
Affected Software
ChatBot Conversational Forms
Researcher
More Details >

Download Alt Text AI <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-34366
Patch Status
Patched
Published
May 3, 2024
Affected Software
Alt Text AI – Automatically generate image alt text for SEO and accessibility
Researcher
More Details >

EventON <= 2.2.14 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-33940
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
EventON
Researcher
More Details >

Flattr <= 1.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3920
Patch Status
Unpatched
Published
May 2, 2024
Affected Software
Flattr
Researcher
More Details >

Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor <= 4.4.7 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2967
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor
Researcher
More Details >

IDonate – blood request management system <= 1.9.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3594
Patch Status
Patched
Published
May 1, 2024
Affected Software
IDonate – Blood Donation, Request And Donor Management System
Researcher
More Details >

Mhr Post Ticker <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3021
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Mhr Post Ticker
Researcher
More Details >

Sailthru Triggermail <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4290
Patch Status
Unpatched
Published
Apr 30, 2024
Affected Software
Sailthru Triggermail
Researcher
More Details >

Sheets To WP Table Live Sync <= 3.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-34375
Patch Status
Patched
Published
May 3, 2024
Affected Software
Sheets to WP Table Live Sync | Google Sheets Table Plugin for WordPress with Spreadsheet Integration – FlexTable
Researcher
More Details >

Simple Image Popup <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4433
Patch Status
Unpatched
Published
May 2, 2024
Affected Software
Simple Image Popup
Researcher
More Details >

Social Icons Widget & Block <= 4.2.17 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2189
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Social Icons Widget & Block by WPZOOM
Researcher
More Details >

Survey Maker – Customer Satisfaction Survey, Chat Survey, Calculaton Form, Payment Surveys <= 4.2.8 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4061
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Survey Maker
Researcher
More Details >

SVS Pricing Tables <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2958
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
SVS Pricing Tables
Researcher
More Details >

Tabellen von faustball.com <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4085
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Tabellen von faustball.com
Researcher
More Details >

Ultimate Under Construction <= 1.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-33943
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Ultimate Under Construction
Researcher
More Details >

5280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-0847
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
5280 Bootstrap Modal Contact Form
Researcher
More Details >

Academy LMS <= 1.9.16 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-33912
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Researcher
More Details >

ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3072
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
ACF Front End Editor
Researcher
More Details >

ACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3071
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
ACF On-The-Go
Researcher
More Details >

Custom WooCommerce Checkout Fields Editor <= 1.3.1 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-33956
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
Custom WooCommerce Checkout Fields Editor
Researcher
More Details >

Debug Log Manager <= 2.3.1 - Missing Authorization via toggle_debugging

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-33915
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Debug Log Manager
Researcher
More Details >

Different Menu in Different Pages – Control Menu Visibility (All in One) <= 2.3.2 - Missing Authorization to Menu Duplication

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3206
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
Different Menu in Different Pages – Control Menu Visibility (All in One)
Researcher
More Details >

Easy Restaurant Table Booking <= 1.0.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4083
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Easy Restaurant Table Booking
Researcher
More Details >

Embed Google Fonts <= 3.1.0 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-33925
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Embed Google Fonts
Researcher
More Details >

Google Typography <= 1.1.2 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-33942
Patch Status
Unpatched
Published
Apr 30, 2024
Affected Software
Google Typography
Researcher
More Details >

Import and export users and customers <= 1.26.5 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1050
Patch Status
Patched
Published
May 3, 2024
Affected Software
Import and export users and customers
Researcher
More Details >

Login with phone number <= 1.7.18 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-34371
Patch Status
Patched
Published
May 3, 2024
Affected Software
Login with phone number
Researcher
More Details >

Progressive WordPress (PWA) <= 2.1.13 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-33937
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
Progressive WordPress (PWA)
Researcher
More Details >

Restaurant and Cafe <= 1.2.1 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-34379
Patch Status
Patched
Published
May 3, 2024
Affected Software
Restaurant and Cafe
Researcher
More Details >

ReviewX <= 1.6.21 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-33921
Patch Status
Patched
Published
Apr 29, 2024
Affected Software
ReviewX – Multi-criteria Rating & Reviews for WooCommerce
Researcher
More Details >

SimpleShop <= 2.10.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1230
Patch Status
Patched
Published
May 3, 2024
Affected Software
SimpleShop
Researcher
More Details >

SP Project & Document Manager <= 4.69 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-33923
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
SP Project & Document Manager
Researcher
More Details >

SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2960
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
SVS Pricing Tables
Researcher
More Details >

SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2959
Patch Status
Unpatched
Published
Apr 29, 2024
Affected Software
SVS Pricing Tables
Researcher
More Details >

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3936
Patch Status
Patched
Published
Apr 30, 2024
Affected Software
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Trust Your Site
to the Leader in WordPress Security

Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.

Protect Your Site

Did you enjoy this post? Share it!

LinkedIn 

Comments

No Comments

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.