Chloe Chamberland
July 11, 2024

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 1, 2024 to July 7, 2024)

📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest. For a limited time, all high risk issues are in-scope for all researchers! 

Last week, there were 131 vulnerabilities disclosed in 101 WordPress Plugins and 18 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 46 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 17,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 119
Unpatched 12

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 2
Medium Severity 106
High Severity 19
Critical Severity 4

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 63
Missing Authorization 23
Cross-Site Request Forgery (CSRF) 17
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 8
Exposure of Sensitive Information to an Unauthorized Actor 3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 3
Unrestricted Upload of File with Dangerous Type 3
Improper Privilege Management 2
Deserialization of Untrusted Data 1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 1
Incorrect Privilege Assignment 1
Server-Side Request Forgery (SSRF) 1
Uncontrolled Resource Consumption 1
Unprotected Alternate Channel 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
15
14
11
9
7
4
4
4
4
4
4
4
3
3
3
3
2
2
2
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro
AI Power: Complete AI Pack gpt3-ai-content-generator
Apollo13 Framework Extensions apollo13-framework-extensions
AWSM Team – Team Showcase Plugin awsm-team
bbPress Notify (No-Spam) bbpress-notify-nospam
Beaver Builder Addons by WPZOOM wpzoom-addons-for-beaver-builder
Beaver Builder – WordPress Page Builder beaver-builder-lite-version
CC & BCC for Woocommerce Order Emails cc-bcc-for-woocommerce-order-emails
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More charitable
Church Admin church-admin
CM Pop-Up Banners for WordPress cm-pop-up-banners
Comment Reply Email comment-reply-email
Community Events community-events
CopySafe Web Protection wp-copysafe-web
Cost Calculator Builder cost-calculator-builder
Create by Mediavine mediavine-create
CRM Perks Forms – WordPress Form Builder crm-perks-forms
Easy Custom Code (LESS/CSS/JS) – Live editing easy-custom-code
Easy Google Maps google-maps-easy
Elementor Addons by Livemesh addons-for-elementor
Elementor Header & Footer Builder header-footer-elementor
Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce email-subscribers
Event Manager, Events Calendar, Tickets, Registrations – Eventin wp-event-solution
Featured Image from URL (FIFU) featured-image-from-url
FileBird Document Library filebird-document-library
Floating Social Media Links floating-social-media-links
Get Better Reviews for WooCommerce more-better-reviews-for-woocommerce
Happy WooCommerce FAQs & AI FAQ Generator (Formarly XPlainer) faq-for-woocommerce
HelloAsso helloasso
Hide My WP Ghost – Security & Firewall hide-my-wp
HTML Forms – Simple WordPress Forms Plugin html-forms
IdeaPush ideapush
IMGspider – 图片采集抓取插件 imgspider
JetThemeCore for Elementor jet-theme-core
LA-Studio Element Kit for Elementor lastudio-element-kit
Leaky Paywall leaky-paywall
LearnPress – WordPress LMS Plugin learnpress
Link To Bible link-to-bible
Login Logo Editor login-logo-editor-by-oizuled
MakeCommerce for WooCommerce makecommerce
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
Media Library Assistant media-library-assistant
Mega Elements – Addons for Elementor mega-elements-addons-for-elementor
Meks Easy Ads Widget meks-easy-ads-widget
Motors – Car Dealer, Classifieds & Listing motors-car-dealership-classified-listings
Nested Pages wp-nested-pages
Newspack Ads newspack-ads
Newspack Campaigns newspack-popups
Newspack Content Converter newspack-content-converter
Newspack Newsletters newspack-newsletters
NEX-Forms – Ultimate Form Builder – Contact forms and much more nex-forms-express-wp-form-builder
Ninja Forms – The Contact Form Builder That Grows With You ninja-forms
Ocean Extra ocean-extra
One Click Order Re-Order one-click-order-reorder
Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita
Page Builder Gutenberg Blocks – CoBlocks coblocks
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions paid-memberships-pro
PayPlus Payment Gateway payplus-payment-gateway
Post Meta Data Manager post-meta-data-manager
Premium Addons for Elementor premium-addons-for-elementor
Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
PZ Frontend Manager pz-frontend-manager
Request a Quote request-a-quote
Rife Elementor Extensions & Templates rife-elementor-extensions
Save as PDF Plugin by Pdfcrowd save-as-pdf-by-pdfcrowd
ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder
Simple Job Board simple-job-board
Simple Newsletter Plugin – Noptin newsletter-optin-box
Simple Social Share simple-social-share
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) sina-extension-for-elementor
Snippet Shortcodes shortcode-variables
Social Media Share Buttons & Social Sharing Icons ultimate-social-media-icons
Spectra – WordPress Gutenberg Blocks ultimate-addons-for-gutenberg
SuperSaaS – online appointment scheduling supersaas-appointment-scheduling
Swift Performance Lite swift-performance-lite
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent tablesome
Template Kit – Export template-kit-export
Testimonials Widget testimonials-widget
The Events Calendar the-events-calendar
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce the-plus-addons-for-elementor-page-builder
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid the-post-grid
Ultimate Addons for Elementor ultimate-elementor
Ultimate Blocks – WordPress Blocks Plugin ultimate-blocks
Ultimate Bootstrap Elements for Elementor ultimate-bootstrap-elements-for-elementor
Ultimate WordPress Auction Plugin ultimate-auction
Void Contact Form 7 Widget For Elementor Page Builder cf7-widget-elementor
Woffice Core woffice-core
WooCommerce - Social Login woo-social-login
WordPress Notification Bar wordpress-notification-bar
WP Cookie Law Info wp-cookie-law-info
WP Directory Kit wpdirectorykit
WP Lightbox 2 wp-lightbox-2
WP QuickLaTeX wp-quicklatex
WP To Do wp-todo
WP ULike – All-in-One Engagement Toolkit wp-ulike
WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce wp-cafe
WPFavicon wpfavicon
WS Contact Form ws-contact-form
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress youzify
Zephyr Project Manager zephyr-project-manager

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Ashe ashe
Bakes And Cakes bakes-and-cakes
Bard bard
Book Your Travel bookyourtravel
Boot Store boot-store
Business One Page business-one-page
Construction Landing Page construction-landing-page
Hestia hestia
Highlight highlight
Lawyer Landing Page lawyer-landing-page
Metro Magazine metro-magazine
Newsmatic newsmatic
Posterity posterity
Rara Business rara-business
Rife Free rife-free
Trendy News trendy-news
Woffice CRM woffice
zBench zbench

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Youzify <= 1.2.5 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-37494
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
Researcher
More Details >

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6172
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce
Researcher
More Details >

WooCommerce Social Login <= 2.6.3 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-37502
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
WooCommerce - Social Login
Researcher
More Details >

Paid Memberships Pro <= 3.0.5 - Authenticated (Administrator+) SQL Injection

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-37486
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Researcher
More Details >

Advanced Classifieds & Directory Pro <= 3.1.3 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37501
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Advanced Classifieds & Directory Pro
Researcher
More Details >

AWSM Team <= 1.3.1 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37454
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
AWSM Team – Team Showcase Plugin
Researcher
More Details >

Book Your Travel <= 8.18.17 - Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37952
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Book Your Travel
Researcher
More Details >

Church Admin <= 4.4.6 - Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37418
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Church Admin
Researcher
More Details >

Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-2385
Patch Status
Patched
Published
Jul 3, 2024
Affected Software
Elementor Addons by Livemesh
Researcher
More Details >

IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6318
Patch Status
Patched
Published
Jul 3, 2024
Affected Software
IMGspider – 图片采集抓取插件
Researcher
More Details >

IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6319
Patch Status
Patched
Published
Jul 3, 2024
Affected Software
IMGspider – 图片采集抓取插件
Researcher
More Details >

LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5349
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
LA-Studio Element Kit for Elementor
Researcher
More Details >

Nested Pages <= 3.2.7 - Cross-Site Request Forgery to Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5943
Patch Status
Patched
Published
Jul 3, 2024
Affected Software
Nested Pages
Researcher
More Details >

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.2 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37499
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Online Booking & Scheduling Calendar for WordPress by vcita
Researcher
More Details >

ShopBuilder – Elementor WooCommerce Builder Addons <= 2.1.12 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37520
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
ShopBuilder – Elementor WooCommerce Builder Addons
Researcher
More Details >

Ultimate Addons for Elementor <= 1.36.31 - Authenticated (Contributor+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37455
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Ultimate Addons for Elementor
Researcher
More Details >

Ultimate Bootstrap Elements for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37462
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Ultimate Bootstrap Elements for Elementor
Researcher
More Details >

WPCafe <= 2.2.27 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37513
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce
Researcher
More Details >

Zephyr Project Manager <= 3.3.97 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37484
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Zephyr Project Manager
Researcher
More Details >

JetThemeCore for Elementor <= 2.2.0 - Authenticated (Subscriber+) Arbitrary File Deletion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-37497
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
JetThemeCore for Elementor
Researcher
More Details >

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-5973
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Researcher
More Details >

Beaver Builder Addons by WPZOOM <= 1.3.5 - Authenticated (Editor+) Local File Inclusion

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-37464
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Beaver Builder Addons by WPZOOM
Researcher
More Details >

IdeaPush <= 8.65 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-37461
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
IdeaPush
Researcher
More Details >

Apollo13 Framework Extensions <= 1.9.3 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37480
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Apollo13 Framework Extensions
Researcher
More Details >

Beaver Builder <= 2.8.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37500
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Beaver Builder – WordPress Page Builder
Researcher
More Details >

Boot Store <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5938
Patch Status
Unpatched
Published
Jul 1, 2024
Affected Software
Boot Store
Researcher
More Details >

CM Popup Plugin for WordPress – Popup Maker <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5004
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
CM Pop-Up Banners for WordPress
Researcher
More Details >

CopySafe Web Protection <= 3.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37514
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
CopySafe Web Protection
Researcher
More Details >

Create by Mediavine <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37495
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Create by Mediavine
Researcher
More Details >

Easy Google Maps <= 1.11.15 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5219
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Easy Google Maps
Researcher
More Details >

Elementor – Header, Footer & Blocks Template <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-33933
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Elementor Header & Footer Builder
Researcher
More Details >

Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3639
Patch Status
Patched
Published
Jul 3, 2024
Affected Software
Elementor Addons by Livemesh
Researcher
More Details >

Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2926
Patch Status
Patched
Published
Jul 3, 2024
Affected Software
Elementor Addons by Livemesh
Researcher
More Details >

Elementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3638
Patch Status
Patched
Published
Jul 3, 2024
Affected Software
Elementor Addons by Livemesh
Researcher
More Details >

Eventin <= 3.3.57 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37507
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Event Manager, Events Calendar, Tickets, Registrations – Eventin
Researcher
More Details >

GPT3 AI Content Writer <= 1.8.66 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37465
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
AI Power: Complete AI Pack
Researcher
More Details >

HelloAsso <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37488
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
HelloAsso
Researcher
More Details >

Mega Elements <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37466
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Mega Elements – Addons for Elementor
Researcher
More Details >

Newspack Ads <= 1.47.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37474
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Newspack Ads
Researcher
More Details >

Newspack Campaigns <= 2.31.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37476
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Newspack Campaigns
Researcher
More Details >

NEX-Forms – Ultimate Form Builder <= 8.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37512
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Researcher
More Details >

Ocean Extra <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37489
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Ocean Extra
Researcher
More Details >

One Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5641
Patch Status
Patched
Published
Jul 3, 2024
Affected Software
One Click Order Re-Order
Researcher
More Details >

Post Meta Data Manager <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6264
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Post Meta Data Manager
Researcher
More Details >

Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6340
Patch Status
Patched
Published
Jul 2, 2024
Affected Software
Premium Addons for Elementor
Researcher
More Details >

Premium Blocks – Gutenberg Blocks for WordPress <= 2.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37519
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
Premium Blocks – Gutenberg Blocks for WordPress
Researcher
More Details >

Rife Elementor Extensions & Templates <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5504
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Rife Elementor Extensions & Templates
Researcher
More Details >

Sina Extension for Elementor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5260
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)
Researcher
More Details >

SuperSaaS – online appointment scheduling <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37460
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
SuperSaaS – online appointment scheduling
Researcher
More Details >

Testimonials Widget <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37553
Patch Status
Unpatched
Published
Jul 6, 2024
Affected Software
Testimonials Widget
Researcher
More Details >

The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4482
Patch Status
Patched
Published
Jul 2, 2024
Affected Software
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Researcher
More Details >

The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1427
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Researcher
More Details >

Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attribute

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3513
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Ultimate Blocks – WordPress Blocks Plugin
Researchers
More Details >

Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Multiple Blocks

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4268
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Ultimate Blocks – WordPress Blocks Plugin
Researcher
More Details >

Void Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5419
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Void Contact Form 7 Widget For Elementor Page Builder
Researcher
More Details >

WP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6263
Patch Status
Patched
Published
Jul 2, 2024
Affected Software
WP Lightbox 2
Researcher
More Details >

WP To Do <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37539
Patch Status
Unpatched
Published
Jul 6, 2024
Affected Software
WP To Do
Researchers
More Details >

zBench <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37521
Patch Status
Unpatched
Published
Jul 5, 2024
Affected Software
zBench
Researcher
More Details >

bbPress Notify <= 2.18.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37485
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
bbPress Notify (No-Spam)
Researcher
More Details >

Comment Reply Email <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35773
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
Comment Reply Email
Researcher
More Details >

MakeCommerce for WooCommerce <= 3.5.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37509
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
MakeCommerce for WooCommerce
Researcher
More Details >

Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5544
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Media Library Assistant
Researcher
More Details >

PayPlus Payment Gateway <= 6.6.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37459
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
PayPlus Payment Gateway
Researcher
More Details >

Woffice <= 5.4.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37472
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Woffice CRM
Researcher
More Details >

Woffice Core <= 5.4.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37471
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Woffice Core
Researcher
More Details >

WP Directory Kit <= 1.3.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37487
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
WP Directory Kit
Researcher
More Details >

XPlainer - WooCommerce Product FAQ <= 1.6.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37515
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
Happy WooCommerce FAQs & AI FAQ Generator (Formarly XPlainer)
Researcher
More Details >

LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type'

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-37479
Patch Status
Patched
Published
Jul 2, 2024
Affected Software
LA-Studio Element Kit for Elementor
Researcher
More Details >

ProfileGrid <= 5.8.7 - Missing Authorization

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-37453
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
ProfileGrid – User Profiles, Groups and Communities
Researcher
More Details >

Charitable <= 1.8.1.7 - Missing Authorization to Unauthorized Donation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37506
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Researcher
More Details >

Charitable <= 1.8.1.7 - Missing Authorization via ajax_license_check()

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37510
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Researcher
More Details >

CRM Perks Forms <= 1.1.5 - Missing Authorization to Unauthenticated Form Submission

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37463
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
CRM Perks Forms – WordPress Form Builder
Researcher
More Details >

FileBird Document Library <= 2.0.6 - Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37504
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
FileBird Document Library
Researcher
More Details >

Hide My WP Ghost – Security & Firewall <= 5.2.01 - Login Page Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6420
Patch Status
Patched
Published
Jul 2, 2024
Affected Software
Hide My WP Ghost – Security & Firewall
Researcher
More Details >

LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6088
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
LearnPress – WordPress LMS Plugin
Researcher
More Details >

LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6099
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
LearnPress – WordPress LMS Plugin
Researcher
More Details >

Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-5545
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Motors – Car Dealer, Classifieds & Listing
Researcher
More Details >

Newsmatic <= 1.3.1 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37468
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Newsmatic
Researcher
More Details >

Newspack Newsletters <= 2.13.2 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37475
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Newspack Newsletters
Researcher
More Details >

Noptin <= 3.4.2 - Missing Authorization to Unauthenticated Form Submission

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37456
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Simple Newsletter Plugin – Noptin
Researcher
More Details >

Table & Contact Form 7 Database – Tablesome <= 1.0.33 - Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37498
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
Researcher
More Details >

The Post Grid <= 7.7.4 - Missing Authorization via REST API

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37481
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Researcher
More Details >

Woffice Core <= 5.4.8 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37470
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Woffice Core
Researcher
More Details >

CC & BCC for Woocommerce Order Emails <= 1.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37522
Patch Status
Unpatched
Published
Jul 5, 2024
Affected Software
CC & BCC for Woocommerce Order Emails
Researcher
More Details >

Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6011
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Cost Calculator Builder
Researcher
More Details >

Easy Custom Code (LESS/CSS/JS) – Live editing <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37536
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
Easy Custom Code (LESS/CSS/JS) – Live editing
Researcher
More Details >

Floating Social Media Links <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37545
Patch Status
Unpatched
Published
Jul 6, 2024
Affected Software
Floating Social Media Links
Researcher
More Details >

HTML Forms – Simple WordPress Forms <= 1.3.32 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6243
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
HTML Forms – Simple WordPress Forms Plugin
Researcher
More Details >

Link To Bible <= 2.5.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37538
Patch Status
Patched
Published
Jul 6, 2024
Affected Software
Link To Bible
Researcher
More Details >

Login Logo Editor <= 1.3.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37523
Patch Status
Unpatched
Published
Jul 5, 2024
Affected Software
Login Logo Editor
Researcher
More Details >

Meks Easy Ads Widget <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37548
Patch Status
Patched
Published
Jul 6, 2024
Affected Software
Meks Easy Ads Widget
Researcher
More Details >

Request a Quote <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6231
Patch Status
Patched
Published
Jul 2, 2024
Affected Software
Request a Quote
Researcher
More Details >

Save as PDF plugin by Pdfcrowd <= 4.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37549
Patch Status
Patched
Published
Jul 6, 2024
Affected Software
Save as PDF Plugin by Pdfcrowd
Researcher
More Details >

Simple Job Board <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-7761
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Simple Job Board
Researcher
More Details >

Simple Social Share <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37551
Patch Status
Unpatched
Published
Jul 6, 2024
Affected Software
Simple Social Share
Researcher
More Details >

Social Media & Share Icons <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37552
Patch Status
Patched
Published
Jul 6, 2024
Affected Software
Social Media Share Buttons & Social Sharing Icons
Researcher
More Details >

Template Kit – Export <= 1.0.21 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37550
Patch Status
Patched
Published
Jul 6, 2024
Affected Software
Template Kit – Export
Researcher
More Details >

WordPress Notification Bar <= 1.3.10 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37556
Patch Status
Unpatched
Published
Jul 6, 2024
Affected Software
WordPress Notification Bar
Researcher
More Details >

WP Cookie Law Info <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37557
Patch Status
Unpatched
Published
Jul 6, 2024
Affected Software
WP Cookie Law Info
Researcher
More Details >

WP QuickLaTeX <= 3.8.7 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-5529
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
WP QuickLaTeX
Researcher
More Details >

WP ULike <= 4.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6094
Patch Status
Patched
Published
Jul 3, 2024
Affected Software
WP ULike – All-in-One Engagement Toolkit
Researcher
More Details >

WS Contact Form <= 1.3.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37537
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
WS Contact Form
Researchers
More Details >

Ashe <= 2.233 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37478
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Ashe
Researcher
More Details >

Bard <= 2.210 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37490
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Bard
Researcher
More Details >

Business One Page <= 1.2.9 - Missing Authorization to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37505
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
Business One Page
Researcher
More Details >

Community Events <= 1.4.9 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6271
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Community Events
Researcher
More Details >

Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6012
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Cost Calculator Builder
Researcher
More Details >

Featured Image from URL <= 4.8.2 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37516
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
Featured Image from URL (FIFU)
Researcher
More Details >

Get Better Reviews for WooCommerce <= 4.0.6 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37544
Patch Status
Unpatched
Published
Jul 6, 2024
Affected Software
Get Better Reviews for WooCommerce
Researcher
More Details >

Hestia <= 3.1.2 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37467
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Hestia
Researcher
More Details >

Highlight <= 1.0.29 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37458
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Highlight
Researcher
More Details >

Lawyer Landing Page <= 1.2.4 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37503
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
Lawyer Landing Page
Researcher
More Details >

Leaky Paywall <= 4.21.2 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37540
Patch Status
Patched
Published
Jul 6, 2024
Affected Software
Leaky Paywall
Researcher
More Details >

Newspack Content Converter <= 0.1.5 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37477
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Newspack Content Converter
Researcher
More Details >

Ninja Forms <= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37934
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Ninja Forms – The Contact Form Builder That Grows With You
Researcher
More Details >

Page Builder Gutenberg Blocks – CoBlocks <= 3.1.11 - Authenticated (Contributor+) Server-Side Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4260
Patch Status
Patched
Published
Jul 2, 2024
Affected Software
Page Builder Gutenberg Blocks – CoBlocks
Researcher
More Details >

Posterity <= 3.3 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37493
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Posterity
Researcher
More Details >

PZ Frontend Manager <= 1.0.5 - Cross-Site Request Forgery to Profile Picture Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6244
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
PZ Frontend Manager
Researcher
More Details >

Rara Business <= 1.2.5 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37937
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Rara Business
Researcher
More Details >

Rife Free <= 2.4.18 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37491
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Rife Free
Researcher
More Details >

Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4543
Patch Status
Patched
Published
Jul 2, 2024
Affected Software
Snippet Shortcodes
Researcher
More Details >

Spectra <= 2.13.7 - Missing Authorization via generate_ai_content

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37517
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
Spectra – WordPress Gutenberg Blocks
Researcher
More Details >

Swift Performance Lite <= 2.3.6.20 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37511
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
Swift Performance Lite
Researcher
More Details >

The Events Calendar <= 6.5.1.4 - Cross-Site Request Forgery via action_restore_events

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37518
Patch Status
Patched
Published
Jul 5, 2024
Affected Software
The Events Calendar
Researcher
More Details >

The Post Grid <= 7.7.4 - Missing Authorization via AJAX

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37482
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Researcher
More Details >

The Post Grid <= 7.7.4 - Missing Authorization via save_block_css

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37483
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Researcher
More Details >

themedropbox Themes <= Various Versions - Missing Authorization to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37496
Patch Status
Patched
Published
Jul 4, 2024
Affected Software
Metro Magazine
Bakes And Cakes
Construction Landing Page
Researcher
More Details >

Trendy News <= 1.0.15 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37473
Patch Status
Patched
Published
Jul 1, 2024
Affected Software
Trendy News
Researcher
More Details >

Ultimate Auction <= 4.2.5 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37543
Patch Status
Patched
Published
Jul 6, 2024
Affected Software
Ultimate WordPress Auction Plugin
Researcher
More Details >

Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service

3.1
CVSS Rating
Low (3.1)
CVE-ID
CVE-2024-6434
Patch Status
Patched
Published
Jul 3, 2024
Affected Software
Premium Addons for Elementor
Researcher
More Details >

WPFavicon <= 2.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

3.1
CVSS Rating
Low (3.1)
CVE-ID
CVE-2024-37558
Patch Status
Unpatched
Published
Jul 6, 2024
Affected Software
WPFavicon
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Trust Your Site
to the Leader in WordPress Security

Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.

Protect Your Site

Did you enjoy this post? Share it!

LinkedIn 

Comments

No Comments

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.