Chloe Chamberland
October 10, 2024

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 30, 2024 to October 6, 2024)

🦸 👻 Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024:

  • All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
  • Top-tier researchers earn automatic bonuses of between 10% to 120% for valid submissions
  • Pending report limits are increased for all
  • It’s possible to earn up to $31,200 for high impact vulnerabilities!

Last week, there were 161 vulnerabilities disclosed in 147 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 46 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 19,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 122
Unpatched 39

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 141
High Severity 15
Critical Severity 5

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 121
Missing Authorization 9
Deserialization of Untrusted Data 5
Cross-Site Request Forgery (CSRF) 4
Unrestricted Upload of File with Dangerous Type 4
URL Redirection to Untrusted Site ('Open Redirect') 4
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 3
Authentication Bypass Using an Alternate Path or Channel 2
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 2
Improper Control of Generation of Code ('Code Injection') 2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 2
Improper Neutralization of Alternate XSS Syntax 1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 1
Improper Privilege Management 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
22
21
12
8
6
6
5
5
4
4
4
4
4
3
3
3
3
3
Leo
3
3
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
123.chat - Video Chat 123-chat-videochat
Advanced Woo Labels – Product Labels for WooCommerce advanced-woo-labels
Affiliate Program Suite — SliceWP Affiliates slicewp
Aggregator Advanced Settings aggregator-advanced-settings
Author Avatars List/Block author-avatars
Auto Amazon Links – Amazon Associates Affiliate Plugin amazon-auto-links
Auto Featured Image from Title auto-featured-image-from-title
Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu
AVIF Uploader avif-support
BA Book Everything ba-book-everything
BerqWP – Automated All-In-One PageSpeed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript searchpro
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress file-manager
Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed blockspare
Bold Page Builder bold-page-builder
Broken Link Checker broken-link-checker
BSK Forms Blacklist bsk-gravityforms-blacklist
CartBounty – Save and recover abandoned carts for WooCommerce woo-save-abandoned-carts
Checkout Field Editor (Checkout Manager) for WooCommerce woo-checkout-field-editor-pro
Clio Grow clio-grow-form
Code Embed simple-embed-code
Confetti Fall Animation confetti-fall-animation
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder fluentform
Copyscape Premium copyscape-premium
Cozy Blocks – Page Builder for Gutenberg & Site Editor, Post Blocks, WooCommerce Blocks, Magazine Blocks, WordPress Gutenberg Blocks, Patterns and Templates Library cozy-addons
Custom Banners custom-banners
Demo Importer Plus demo-importer-plus
DethemeKit For Elementor dethemekit-for-elementor
Display Medium Posts display-medium-posts
DK PDF dk-pdf
Easy Demo Importer – A Modern One-Click Demo Import Solution easy-demo-importer
Easy Load More easy-load-more
Easy WordPress Subscribe – Optin Hound opt-in-hound
Echo RSS Feed Post Generator rss-feed-post-generator-echo
Elastik Page Builder elastik-page-builder
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) bdthemes-element-pack-lite
ElementInvader Addons for Elementor elementinvader-addons-for-elementor
Elementor Addon Elements addon-elements-for-elementor-page-builder
ElementsReady Addons for Elementor element-ready-lite
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce email-subscribers
Enter Addons – Ultimate Template Builder for Elementor enteraddons
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates essential-blocks
EventPrime – Events Calendar, Bookings and Tickets eventprime-event-calendar-management
FAQ / Accordion / Docs – Helpie WordPress FAQ Accordion plugin helpie-faq
Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate fish-and-ships
Form plugin for WordPress – Zoho Forms zoho-forms
Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials stars-testimonials-with-slider-and-masonry-grid
Gallery Lightbox gallery-lightbox-slider
Geo Mashup geo-mashup
Gravity Forms Toolbar gravity-forms-toolbar
Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg guten-post-layout
Happy Addons for Elementor happy-elementor-addons
Hash Form – Drag & Drop Form Builder hash-form
Hello World hello-world
Ibtana – WordPress Website Builder ibtana-visual-editor
Iconize iconize
Include Fussball.de Widgets include-fussball-de-widgets
Jeg Elementor Kit jeg-elementor-kit
JobSearch WP Job Board wp-jobsearch
KB Support – WordPress Help Desk and Knowledge Base kb-support
Keap Official Opt-in Forms infusionsoft-official-opt-in-forms
LA-Studio Element Kit for Elementor lastudio-element-kit
LH Copy Media File lh-copy-media-file
LiteSpeed Cache litespeed-cache
LocateAndFilter locateandfilter
Loggedin – Limit Active Logins loggedin
Login Logout Shortcode login-logout-shortcode
Logo Carousel – Clients logo carousel for WP responsive-client-logo-carousel-slider
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid magazine-blocks
MaxSlider maxslider
MC4WP: Mailchimp Top Bar mailchimp-top-bar
Memberful – Membership Plugin memberful-wp
Move Addons for Elementor move-addons
NEX-Forms – Ultimate Form Builder – Contact forms and much more nex-forms-express-wp-form-builder
Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita
Page-list page-list
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Payflex Payment Gateway payflex-payment-gateway
PDF Image Generator pdf-image-generator
Popularis Extra popularis-extra
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder popup-maker
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) buddyforms
Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg
Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite
PWA — easy way to Progressive Web App iworks-pwa
QS Dark Mode Plugin qs-dark-mode
Quantity Dynamic Pricing & Bulk Discounts for WooCommerce wholesale-pricing-woocommerce
Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress quillforms
R Animated Icon Plugin r-animated-icon
RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more rabbit-loader
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings seo-by-rank-math
Re:WP rewp
Relogo relogo
Robokassa payment gateway for Woocommerce robokassa
RomethemeKit For Elementor rometheme-for-elementor
RumbleTalk Live Group Chat – HTML5 rumbletalk-chat-a-chat-with-themes
Search Analytics for WP search-analytics
Search Atlas SEO – Best SEO Plugin for One-Click WP Publishing & Integrated AI Optimization metasync
SEOPress – On-site SEO wp-seopress
ShiftController Employee Shift Scheduling shiftcontroller
Shortcodes and extra features for Phlox theme auxin-elements
Simple Membership After Login Redirection simple-membership-after-login-redirection
Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel depicter
Slider Revolution revslider
Slideshow Gallery LITE slideshow-gallery
Smart Custom 404 Error Page 404page
Social Auto Poster social-auto-poster
Social Web Suite – Social Media Auto Post, Social Media Auto Publish social-web-suite
Soumettre.fr soumettre-fr
Spice Starter Sites spice-starter-sites
Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More woocommerce-exporter
Strong Testimonials strong-testimonials
SVG Complete svg-complete
The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) the-pack-addon
The Ultimate WordPress Toolkit – WP Extended wpextended
Themify Builder themify-builder
TinyPNG – JPEG, PNG & WebP image compression tiny-compress-images
TNC PDF viewer pdf-viewer-by-themencode
Top Bar – PopUps – by WPOptin wpoptin
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member
Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider ultimate-store-kit
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor
VdoCipher: Secure Video Player and Hosting vdocipher
Visual CSS Style Editor yellow-pencil-visual-theme-customizer
Web Directory Free web-directory-free
Wechat Social login 微信QQ钉钉登录插件 wechat-social-login
WordPress & WooCommerce Affiliate Program wp-wc-affiliate-program
WordPress Captcha Plugin by Captcha Bank captcha-bank
WordPress Infinite Scroll – Ajax Load More ajax-load-more
WP Blocks Hub wp-blocks-hub
WP Booking Calendar booking
WP Bulk Delete wp-bulk-delete
WP Cleanup and Basic Functions wp-cleanup-and-basic-functions
WP Compress – Instant Performance & Speed Optimization wp-compress-image-optimizer
WP Easy Gallery – WordPress Gallery Plugin wp-easy-gallery
WP Hotel Booking wp-hotel-booking
WP MyLinks wp-mylinks
WP Travel Gutenberg Blocks wp-travel-blocks
WP-Lister Lite for eBay wp-lister-for-ebay
WP-WebAuthn wp-webauthn
WPCOM Member wpcom-member
WPMobile.App — Android and iOS Mobile Application wpappninja
XLTab – Accordions and Tabs for Elementor Page Builder xl-tab
XO Slider xo-liteslider
YITH WooCommerce Ajax Search yith-woocommerce-ajax-search
YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons
YML for Yandex Market yml-for-yandex-market
Zotpress zotpress

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Create create
Empowerment empowerment
Full Frame full-frame
UltraPress ultrapress
Unseen Blog unseen-blog

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Echo RSS Feed Post Generator <= 5.4.6 - Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-9265
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Echo RSS Feed Post Generator
Researcher
More Details >

JobSearch <= 2.5.9 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-47636
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
JobSearch WP Job Board
Researcher
More Details >

Wechat Social login <= 1.3.0 - Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-9106
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Wechat Social login 微信QQ钉钉登录插件
Researcher
More Details >

Wechat Social login <= 1.3.0 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-9108
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Wechat Social login 微信QQ钉钉登录插件
Researcher
More Details >

WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-9289
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
WordPress & WooCommerce Affiliate Program
Researcher
More Details >

Empowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-7433
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Empowerment
Researcher
More Details >

MaxSlider <= 1.2.3 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-47351
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
MaxSlider
Researcher
More Details >

UltraPress <= 1.2.1 - Authenticated (Contributor+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-7434
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
UltraPress
Researcher
More Details >

Unseen Blog <= 1.0.0 - Authenticated (Contributor+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-7432
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Unseen Blog
Researcher
More Details >

WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-9018
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
WP Easy Gallery – WordPress Gallery Plugin
Researcher
More Details >

WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-7855
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
WP Hotel Booking
Researcher
More Details >

KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-8548
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
KB Support – WordPress Help Desk and Knowledge Base
Researcher
More Details >

Top Bar – PopUps – by WPOptin <= 2.0.1 - Unauthenticated Local File Inclusion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-47645
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Top Bar – PopUps – by WPOptin
Researcher
More Details >

Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-8352
Patch Status
Patched
Published
Oct 2, 2024
Affected Software
Social Web Suite – Social Media Auto Post, Social Media Auto Publish
Researcher
More Details >

YITH WooCommerce Ajax Search <= 2.8.0 - Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-47350
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
YITH WooCommerce Ajax Search
Researcher
More Details >

123.chat - Video Chat <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-7869
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
123.chat - Video Chat
Researcher
More Details >

Iconize <= 1.2.4 - Authenticated (Admin+) Remote Code Execution

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-47649
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Iconize
Researcher
More Details >

LiteSpeed Cache <= 6.1 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-47374
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
LiteSpeed Cache
Researcher
More Details >

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-9314
Patch Status
Patched
Published
Oct 4, 2024
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Researcher
Leo
More Details >

Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting

7.1
CVSS Rating
High (7.1)
CVE-ID
CVE-2024-8981
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Broken Link Checker
Researcher
More Details >

Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload

6.8
CVSS Rating
Medium (6.8)
CVE-ID
CVE-2024-8743
Patch Status
Patched
Published
Oct 4, 2024
Affected Software
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress
Researcher
More Details >

Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-9224
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Hello World
Researcher
More Details >

KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-8632
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
KB Support – WordPress Help Desk and Knowledge Base
Researcher
More Details >

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-9161
Patch Status
Patched
Published
Oct 4, 2024
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Researcher
Leo
More Details >

Advanced Woo Labels <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47622
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Advanced Woo Labels – Product Labels for WooCommerce
Researcher
More Details >

Aggregator Advanced Settings <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9368
Patch Status
Unpatched
Published
Oct 3, 2024
Affected Software
Aggregator Advanced Settings
Researcher
More Details >

Author Avatars List/Block <= 2.1.21 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47370
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Author Avatars List/Block
Researcher
More Details >

Automatically Hierarchic Categories in Menu <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47365
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Automatically Hierarchic Categories in Menu
Researcher(s): Unknown
More Details >

AVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9060
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
AVIF Uploader
Researcher
More Details >

Blockspare <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47363
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed
Researcher
More Details >

Bold Page Builder <= 5.1.- - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47391
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Bold Page Builder
Researcher
More Details >

Code Embed <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8804
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Code Embed
Researcher
Leo
More Details >

Confetti Fall Animation <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47641
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Confetti Fall Animation
Researcher
More Details >

Cozy Blocks <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47355
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Cozy Blocks – Page Builder for Gutenberg & Site Editor, Post Blocks, WooCommerce Blocks, Magazine Blocks, WordPress Gutenberg Blocks, Patterns and Templates Library
Researcher
More Details >

Create <= 2.9.1 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47356
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Create
Researcher
More Details >

Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9172
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
Demo Importer Plus
Researcher
More Details >

DethemeKit For Elementor <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47632
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
DethemeKit For Elementor
Researcher
More Details >

Display Medium Posts <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9445
Patch Status
Unpatched
Published
Oct 3, 2024
Affected Software
Display Medium Posts
Researcher
More Details >

Easy Demo Importer – A Modern One-Click Demo Import Solution <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9071
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Easy Demo Importer – A Modern One-Click Demo Import Solution
Researcher
More Details >

Elastik Page Builder <= 0.27.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9274
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Elastik Page Builder
Researcher
More Details >

Element Pack Elementor Addons <= 5.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47392
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Researcher
More Details >

ElementInvader Addons for Elementor <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47630
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
ElementInvader Addons for Elementor
Researcher
More Details >

Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47366
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Elementor Addon Elements
Researcher
More Details >

Enter Addons <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47625
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Enter Addons – Ultimate Template Builder for Elementor
Researcher
More Details >

Essential Blocks for Gutenberg <= 4.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47385
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Researcher
More Details >

Full frame <= 2.7.2 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-44010
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Full Frame
Researcher
More Details >

Gallery Lightbox <= 1.0.0.39 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47623
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Gallery Lightbox
Researcher
More Details >

Geo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8990
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Geo Mashup
Researcher
More Details >

Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8288
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg
Researcher
More Details >

Happy Addons for Elementor <= 3.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47357
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Happy Addons for Elementor
Researcher
More Details >

Ibtana – WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8282
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
Ibtana – WordPress Website Builder
Researcher
More Details >

Include Fussball.de Widgets <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47643
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Include Fussball.de Widgets
Researcher
More Details >

Jeg Elementor Kit <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47390
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Jeg Elementor Kit
Researcher
More Details >

Keap Official Opt-in Forms <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47642
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Keap Official Opt-in Forms
Researcher
More Details >

LA-Studio Element Kit for Elementor <= 1.3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47628
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
LA-Studio Element Kit for Elementor
Researcher
More Details >

LiteSpeed Cache <= 6.5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47373
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
LiteSpeed Cache
Researcher
More Details >

LocateAndFilter <= 1.6.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9304
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
LocateAndFilter
Researcher
More Details >

Login Logout Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9421
Patch Status
Unpatched
Published
Oct 3, 2024
Affected Software
Login Logout Shortcode
Researcher
More Details >

Logo Carousel – Clients logo carousel for WP <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47631
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Logo Carousel – Clients logo carousel for WP
Researcher
More Details >

Memberful – Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9242
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Memberful – Membership Plugin
Researcher
More Details >

Move Addons for Elementor <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47364
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Move Addons for Elementor
Researcher
More Details >

Page-list <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47382
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Page-list
Researcher
More Details >

Premium Blocks – Gutenberg Blocks for WordPress <= 2.1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47368
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Premium Blocks – Gutenberg Blocks for WordPress
Researcher
More Details >

PWA — easy way to Progressive Web App <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8967
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
PWA — easy way to Progressive Web App
Researcher
More Details >

QS Dark Mode Plugin <= 2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9118
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
QS Dark Mode Plugin
Researcher
More Details >

Quill Forms <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47393
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress
Researcher
More Details >

R Animated Icon Plugin <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9272
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
R Animated Icon Plugin
Researcher
More Details >

Re:WP <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9271
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Re:WP
Researcher
More Details >

Relogo <= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9269
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Relogo
Researcher
More Details >

RomethemeKit For Elementor <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47626
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
RomethemeKit For Elementor
Researcher
More Details >

RumbleTalk Live Group Chat – HTML5 <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8720
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
RumbleTalk Live Group Chat – HTML5
Researchers
More Details >

Shortcodes and extra features for Phlox theme <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8486
Patch Status
Patched
Published
Oct 4, 2024
Affected Software
Shortcodes and extra features for Phlox theme
Researcher
More Details >

Slider Revolution <= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8107
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Slider Revolution
Researcher
More Details >

Stars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8989
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials
Researcher
More Details >

SVG Complete <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9119
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
SVG Complete
Researcher
More Details >

The Pack Elementor addons <= 2.0.8.8 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47383
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library)
Researcher
More Details >

Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8519
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Researcher
More Details >

Ultimate Store Kit Elementor Addons <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47629
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider
Researcher
More Details >

VdoCipher <= 1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47639
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
VdoCipher: Secure Video Player and Hosting
Researcher
More Details >

WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8505
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
WordPress Infinite Scroll – Ajax Load More
Researcher
More Details >

WP Blocks Hub <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9372
Patch Status
Unpatched
Published
Oct 3, 2024
Affected Software
WP Blocks Hub
Researcher
More Details >

WP Cleanup and Basic Functions <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9455
Patch Status
Unpatched
Published
Oct 4, 2024
Affected Software
WP Cleanup and Basic Functions
Researcher
More Details >

WP Travel Gutenberg Blocks <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47627
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
WP Travel Gutenberg Blocks
Researcher
More Details >

WP-WebAuthn <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47650
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
WP-WebAuthn
Researcher
More Details >

XLTab – Accordions and Tabs for Elementor Page Builder <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47375
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
XLTab – Accordions and Tabs for Elementor Page Builder
Researcher
More Details >

XO Slider <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8324
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
XO Slider
Researcher
More Details >

Zoho Forms <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47633
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Form plugin for WordPress – Zoho Forms
Researcher
More Details >

Zotpress <= 7.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-47621
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Zotpress
Researcher
More Details >

Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9349
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Auto Amazon Links – Amazon Associates Affiliate Plugin
Researcher
More Details >

Auto Featured Image from Title <= 2.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-8786
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Auto Featured Image from Title
Researcher
More Details >

BA Book Everything <= 1.6.20 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47360
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
BA Book Everything
Researcher
More Details >

BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript <= 2.1.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9344
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
BerqWP – Automated All-In-One PageSpeed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
Researcher
More Details >

BSK Forms Blacklist <= 3.8.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47624
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
BSK Forms Blacklist
Researcher
More Details >

Clio Grow <= 1.0.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-8802
Patch Status
Unpatched
Published
Oct 3, 2024
Affected Software
Clio Grow
Researcher
More Details >

Copyscape Premium <= 1.3.6 - Cross-Site Request Forgery

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47644
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Copyscape Premium
Researcher
More Details >

Custom Banners <= 3.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-8799
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Custom Banners
Researcher
More Details >

DK PDF <= 1.9.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-8727
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
DK PDF
Researcher
More Details >

Easy Load More <= 1.0.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-8728
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Easy Load More
Researcher
More Details >

Easy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9267
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Easy WordPress Subscribe – Optin Hound
Researcher
More Details >

ElementsReady Addons for Elementor 6.4.2 - Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47353
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
ElementsReady Addons for Elementor
Researcher
More Details >

EventPrime <= 4.0.4.5 - Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47648
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
EventPrime – Events Calendar, Bookings and Tickets
Researcher
More Details >

Fish and Ships <= 1.5.9 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9237
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Fish and Ships – Most flexible shipping table rate. A WooCommerce shipping rate
Researcher
More Details >

Gravity Forms Toolbar <= 1.7.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-8718
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Gravity Forms Toolbar
Researcher
More Details >

Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9417
Patch Status
Patched
Published
Oct 4, 2024
Affected Software
Hash Form – Drag & Drop Form Builder
Researcher
More Details >

JobSearch <= 2.5.9 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47394
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
JobSearch WP Job Board
Researcher
More Details >

LH Copy Media File <= 1.08 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9220
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
LH Copy Media File
Researcher
More Details >

Loggedin – Limit Active Logins <= 1.3.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9228
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Loggedin – Limit Active Logins
Researcher
More Details >

Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.3.14 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9218
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
Researcher
More Details >

MC4WP: Mailchimp Top Bar <= 1.6.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9210
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
MC4WP: Mailchimp Top Bar
Researcher
More Details >

NEX-Forms – Ultimate Form Builder <= 8.7.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47389
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
NEX-Forms – Ultimate Form Builder – Contact forms and much more
Researcher
More Details >

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.4.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47638
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Online Booking & Scheduling Calendar for WordPress by vcita
Researcher
More Details >

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9222
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Researcher
More Details >

Payflex Payment Gateway <= 2.6.1 - Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47646
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Payflex Payment Gateway
Researcher
More Details >

PDF Image Generator <= 1.5.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9241
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
PDF Image Generator
Researcher
More Details >

Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9353
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Popularis Extra
Researcher
More Details >

Product Delivery Date for WooCommerce – Lite <= 2.7.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9345
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Product Delivery Date for WooCommerce – Lite
Researcher
More Details >

Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 3.8.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9384
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Quantity Dynamic Pricing & Bulk Discounts for WooCommerce
Researcher
More Details >

RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more <= 2.21.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-8800
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more
Researcher
More Details >

Robokassa payment gateway for Woocommerce <= 1.6.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47395
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Robokassa payment gateway for Woocommerce
Researcher
More Details >

SEOPress – On-site SEO <= 8.1.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9225
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
SEOPress – On-site SEO
Researcher
More Details >

ShiftController Employee Shift Scheduling <= 4.9.66 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9435
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
ShiftController Employee Shift Scheduling
Researcher
More Details >

Simple Membership After Login Redirection <= 1.6 - Open Redirect

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47354
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Simple Membership After Login Redirection
Researcher
More Details >

SliceWP <= 1.1.18 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47388
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Affiliate Program Suite — SliceWP Affiliates
Researcher
More Details >

Smart Custom 404 Error Page <= 11.4.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9204
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Smart Custom 404 Error Page
Researcher
More Details >

Social Auto Poster <= 5.3.15 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47369
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Social Auto Poster
Researcher
More Details >

Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More <= 2.7.2.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-8793
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More
Researcher
More Details >

The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47386
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
The Ultimate WordPress Toolkit – WP Extended
Researcher
More Details >

Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9385
Patch Status
Patched
Published
Oct 4, 2024
Affected Software
Themify Builder
Researcher
More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.121 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-45454
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher
More Details >

Web Directory Free <= 1.7.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47379
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Web Directory Free
Researcher
More Details >

WordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9375
Patch Status
Unpatched
Published
Oct 3, 2024
Affected Software
WordPress Captcha Plugin by Captcha Bank
Researcher
More Details >

WP Bulk Delete <= 1.3.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47352
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
WP Bulk Delete
Researcher
More Details >

WP Compress – Image Optimizer [All-In-One] <= 6.20.13 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47384
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
WP Compress – Instant Performance & Speed Optimization
Researcher
More Details >

WP Search Analytics <= 1.4.10 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9209
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Search Analytics for WP
Researcher
More Details >

WP-Lister Lite for eBay <= 3.6.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47380
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
WP-Lister Lite for eBay
Researcher
More Details >

WPCOM Member <= 1.5.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47378
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
WPCOM Member
Researcher
More Details >

WPMobile.App <= 11.50 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47349
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
WPMobile.App — Android and iOS Mobile Application
Researcher
More Details >

YellowPencil Visual CSS Style Editor <= 7.6.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47348
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Visual CSS Style Editor
Researcher
More Details >

YITH WooCommerce Product Add-Ons <= 4.13.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-47367
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
YITH WooCommerce Product Add-Ons
Researcher
More Details >

YML for Yandex Market <= 4.7.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9378
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
YML for Yandex Market
Researcher
More Details >

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-8254
Patch Status
Patched
Published
Oct 1, 2024
Affected Software
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Researcher
More Details >

Depicter Slider <= 3.2.2 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-47359
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel
Researcher
More Details >

Popup Maker <= 1.19.2 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-47358
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder
Researcher
More Details >

Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-8430
Patch Status
Unpatched
Published
Sep 30, 2024
Affected Software
Spice Starter Sites
Researcher
More Details >

Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-8520
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Researcher
More Details >

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-9528
Patch Status
Patched
Published
Oct 4, 2024
Affected Software
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Researcher
More Details >

Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_notice

4.7
CVSS Rating
Medium (4.7)
CVE-ID
CVE-2024-8499
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
Checkout Field Editor (Checkout Manager) for WooCommerce
Researcher
More Details >

Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin <= 1.27 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-47647
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
FAQ / Accordion / Docs – Helpie WordPress FAQ Accordion plugin
Researcher
More Details >

BuddyForms <= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-47377
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Researcher
More Details >

Depicter Slider <= 3.2.2 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-47381
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel
Researcher
More Details >

Search Atlas SEO <= 1.8.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-47387
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Search Atlas SEO – Best SEO Plugin for One-Click WP Publishing & Integrated AI Optimization
Researcher
More Details >

Slideshow Gallery <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-47376
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Slideshow Gallery LITE
Researcher
More Details >

TNC PDF viewer <= 3.1.0 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-47372
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
TNC PDF viewer
Researcher
More Details >

WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-9306
Patch Status
Patched
Published
Oct 3, 2024
Affected Software
WP Booking Calendar
Researcher
More Details >

WP MyLinks <= 1.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-47371
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
WP MyLinks
Researcher
More Details >

CartBounty – Save and recover abandoned carts for WooCommerce <= 8.2 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-47634
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
CartBounty – Save and recover abandoned carts for WooCommerce
Researcher
More Details >

Elementor Addon Elements <= 1.13.6 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-47361
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Elementor Addon Elements
Researcher
More Details >

LiteSpeed Cache <= 6.4.1 - Authenticated (Author+) Path Traversal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-47637
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
LiteSpeed Cache
Researcher
More Details >

Soumettre.fr <= 2.1.3 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-8675
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Soumettre.fr
Researcher
More Details >

Strong Testimonials <= 3.1.16 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-47362
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
Strong Testimonials
Researcher
More Details >

TinyPNG <= 3.4.3 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-47635
Patch Status
Patched
Published
Sep 30, 2024
Affected Software
TinyPNG – JPEG, PNG & WebP image compression
Researcher(s): Unknown
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Trust Your Site
to the Leader in WordPress Security

Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.

Protect Your Site

Did you enjoy this post? Share it!

LinkedIn 

Comments

No Comments

All comments are moderated before being published. Inappropriate or off-topic comments may not be approved.

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.