Chloe Chamberland
June 27, 2024

Wordfence Intelligence Weekly WordPress Vulnerability Report (June 17, 2024 to June 23, 2024)

📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest. For a limited time, all high risk issues are in-scope for all researchers! 

Last week, there were 234 vulnerabilities disclosed in 166 WordPress Plugins and 16 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 69 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 17,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • WAF-RULE-707 – data redacted while we work with the vendor on a patch.
  • WAF-RULE-708 – data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 184
Unpatched 50

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 189
High Severity 25
Critical Severity 20

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 108
Cross-Site Request Forgery (CSRF) 37
Missing Authorization 29
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 9
Unrestricted Upload of File with Dangerous Type 9
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 7
Deserialization of Untrusted Data 4
Exposure of Sensitive Information to an Unauthorized Actor 4
Authorization Bypass Through User-Controlled Key 3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 3
Server-Side Request Forgery (SSRF) 3
Improper Control of Generation of Code ('Code Injection') 2
Improper Input Validation 2
Insertion of Sensitive Information into Log File 2
URL Redirection to Untrusted Site ('Open Redirect') 2
Use of Less Trusted Source 2
Authentication Bypass Using an Alternate Path or Channel 1
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') 1
Improper Neutralization of Formula Elements in a CSV File 1
Incorrect Authorization 1
Incorrect Privilege Assignment 1
Protection Mechanism Failure 1
Uncontrolled Resource Consumption 1
Weak Password Recovery Mechanism for Forgotten Password 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
31
13
11
11
10
9
9
9
8
8
8
7
5
5
4
4
4
3
3
3
3
3
3
3
3
3
2
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
tom
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution academy
Accordion – Multiple Accordion or FAQs Builder accordions-or-faqs
affiliate-toolkit – WP Affiliate Plugin with Amazon affiliate-toolkit-starter
AliExpress Dropshipping Plugin for WooCommerce – AliNext ali2woo-lite
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup armember
Bible Text bible-text
Blogmentor – Blog Layouts for Elementor blogmentor
BlossomThemes Email Newsletter blossomthemes-email-newsletter
Booking for Appointments and Events Calendar – Amelia ameliabooking
Booking for Appointments and Events Calendar – Amelia Pro amelia
Branda – Branda – White Label & Branding, Custom Login Page Customizer branda-white-labeling
Bricks Builder bricksbuilder
Bug Library bug-library
Business Directory Plugin – Easy Listing Directories for WordPress business-directory-plugin
Church Admin church-admin
Consulting Elementor Widgets consulting-elementor-widgets
ContentLock contentlock
Cost Calculator Builder PRO cost-calculator-builder-pro
Custom Field Suite custom-field-suite
Custom Product List Table custom-product-list-table
Demo Awesome demo-awesome
DImage 360 dimage-360
Ditty – Responsive News Tickers, Sliders, and Lists ditty-news-ticker
Easy Table of Contents easy-table-of-contents
Elegant Themes Icons elegant-themes-icons
Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce email-subscribers
Embed Peertube Playlist embed-peertube-playlist
EmbedSocial – Social Media Feeds, Reviews and Galleries embedalbum-pro
Empty Cart Button for WooCommerce empty-cart-button-for-woocommerce
Event Monster – Event Management, Tickets Booking, Upcoming Event event-monster
Export WP Page to Static HTML/CSS export-wp-page-to-static-html
Falang multilanguage for WordPress falang
Footer Contacts Bar dn-footer-contacts
FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest] fs-poster
Gallery Plugin for WordPress – Envira Photo Gallery envira-gallery-lite
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers rafflepress
Greenshift – animation and page builder blocks greenshift-animation-and-page-builder-blocks
Hercules Core hercules-core
Hide Dashboard Notifications wp-hide-backed-notices
Hostel hostel
Ibtana – WordPress Website Builder ibtana-visual-editor
If-So Dynamic Content Personalization if-so
Image Optimizer, Resizer and CDN – Sirv sirv
Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite
Index WP MySQL For Speed index-wp-mysql-for-speed
Inline Related Posts intelly-related-posts
InstaWP Connect – 1-click WP Staging & Migration instawp-connect
JetWidgets For Elementor jetwidgets-for-elementor
Kanban Boards for WordPress kanban
Kimili Flash Embed kimili-flash-embed
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Subscribers and Landing Pages convertkit
Laybuy Payment Extension for WooCommerce laybuy-gateway-for-woocommerce
License Manager for WooCommerce license-manager-for-woocommerce
Lifeline Donation lifeline-donation
Live Composer – Free WordPress Website Builder live-composer-page-builder
Loco Translate loco-translate
Login with phone number login-with-phone-number
Master Slider – Responsive Touch Slider master-slider
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MaxGalleria maxgalleria
Media Library Assistant media-library-assistant
MIMO Woocommerce Order Tracking mimo-woocommerce-order-tracking
My Favorites my-favorites
Name: CM E-Mail Registration Blacklist cm-email-blacklist
Newsletters newsletters-lite
Newspack Blocks newspack-blocks
Newspack Newsletters newspack-newsletters
Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita
OpenPGP Form Encryption for WordPress openpgp-form-encryption
Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms optinly
Orbit Fox by ThemeIsle themeisle-companion
OSM Map Widget for Elementor osm-map-elementor
Page Builder Sandwich – Front End WordPress Page Builder Plugin page-builder-sandwich
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions paid-memberships-pro
PDF Viewer for Elementor pdf-viewer-for-elementor
Pexels: Free Stock Photos wp-pexels-free-stock-photos
Photo Gallery, Images, Slider in Rbs Image Gallery robo-gallery
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery nextgen-gallery
Photo Video Gallery Master photo-video-gallery-master
phpinfo() WP phpinfo-wp
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio play-ht
Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer promolayer-popup-builder
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups ays-popup-box
Product Enquiry for WooCommerce product-enquiry-for-woocommerce
PropertyHive propertyhive
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker quiz-master-next
Quotes and Tips by BestWebSoft quotes-and-tips
Replace Image replace-image
Restaurant Reservations nd-restaurant-reservations
Salon Booking System salon-booking-system
Scheduling Plugin – Online Booking for WordPress calendar-booking
Secure Copy Content Protection and Content Locking secure-copy-content-protection
SEOPress – On-site SEO wp-seopress
Serious Slider cryout-serious-slider
Seriously Simple Podcasting seriously-simple-podcasting
Shariff Wrapper shariff
Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension shortcode-addons
Shortcodes by United Themes ut-shortcodes
Shortcodes Ultimate Pro shortcodes-ultimate-pro
Simple Video Directory simple-media-directory
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) sina-extension-for-elementor
SiteGuard WP Plugin siteguard
Sketchfab Embed sketchfab-oembed
Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel depicter
Slider by 10Web – Responsive Image Slider slider-wd
Slideshow SE slideshow-se
Smart Image Gallery photoshow
Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP | Image CDN wp-smushit
Social Media Widget social-media-widget
Solid Security – Password, Two Factor Authentication, and Brute Force Protection better-wp-security
SP Project & Document Manager sp-client-document-manager
Sparkle Demo Importer sparkle-demo-importer
Squeeze squeeze
SULly sully
Support SVG – Upload svg files in wordpress without hassle support-svg
SVG Block svg-block
Swift Framework socialdriver-framework
Table Addons for Elementor table-addons-for-elementor
Tabs – Responsive Tabs with WooCommerce Product Tab Extension vc-tabs
The Plus Addons for Elementor Page Builder theplus_elementor_addon
Themify – WooCommerce Product Filter themify-wc-product-filter
Tickera – WordPress Event Ticketing tickera-event-ticketing-system
Tournamatch tournamatch
Transition Slider – Responsive Image Slider and Gallery transition-slider-lite
Typing Text typing-text
UberMenu ubermenu
Ultimate Blocks – WordPress Blocks Plugin ultimate-blocks
Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter custom-add-to-cart-button-for-woocommerce
Universal Slider fusion-slider
URL Shortener by MyThemeShop mts-url-shortener
User Profile Picture metronet-profile-picture
User Rights Access Manager user-rights-access-manager
User Submitted Posts – Enable Users to Submit Posts from the Front End user-submitted-posts
Vimeography: Vimeo Video Gallery WordPress Plugin vimeography
Watu Quiz watu
Website Content in Page or Post show-website-content-in-wordpress-page-or-post
Wheel of Life: Coaching and Assessment Tool for Life Coach wheel-of-life
Wishlist Member wishlist-member-x
WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce cartflows
Woocommerce Customers Order History woo-customers-order-history
Word Balloon word-balloon
WordPress Button Plugin MaxButtons maxbuttons
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg groundhogg
WordPress Picture / Portfolio / Media Gallery nimble-portfolio
WP 2FA – Two-factor authentication for WordPress wp-2fa
WP Affiliate Platform wp-affiliate-platform
WP Blog Post Layouts wp-blog-post-layouts
WP Child Theme Generator wp-child-theme-generator
Wp EMember wp-emember
WP Hotel Booking wp-hotel-booking
WP Job Manager - Resume Manager wp-job-manager-resumes
WP Job Portal – A Complete Recruitment System for Company or Job Board website wp-job-portal
WP Magazine Modules Lite wp-magazine-modules-lite
WP Maintenance wp-maintenance
WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder wp-post-author
WP QuickLaTeX wp-quicklatex
WP Recipe Maker wp-recipe-maker
WP Scraper wp-scraper
WP Secure Maintenance wp-secure-maintainance
WP SVG Images wp-svg-images
WPAdverts – Classifieds Plugin wpadverts
WPPizza – A Restaurant Plugin wppizza
WPZOOM Addons for Elementor (Templates, Widgets) wpzoom-elementor-addons
YARPP – Yet Another Related Posts Plugin yet-another-related-posts-plugin
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress youzify
Zoho Marketing Automation zoho-marketinghub

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Book Landing Page book-landing-page
Chic Lite chic-lite
Customizr customizr
Digital Newspaper digital-newspaper
Divi Divi
Education Zone education-zone
Enfold - Responsive Multi-Purpose Theme enfold
Excellent excellent
Flatsome flatsome
Grey Opaque grey-opaque
Hueman hueman
Interface interface
Materialis materialis
Mosaic mosaic
Sinatra sinatra
Vilva vilva

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

InstaWP Connect <= 0.1.0.38 - Unauthenticated Arbitrary File Upload

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-37228
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
InstaWP Connect – 1-click WP Staging & Migration
Researcher
More Details >

WishList Member X <= 3.25.1 - Unauthenticated Arbitrary SQL Execution

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-37112
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Wishlist Member
Researcher
More Details >

WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-3605
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
WP Hotel Booking
Researcher
More Details >

Consulting Elementor Widgets <= 1.3.0 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-37090
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Consulting Elementor Widgets
Researcher
More Details >

Image Optimizer, Resizer and CDN – Sirv <= 7.2.6 - Authenticated (Contributor+) Arbitrary File Upload

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-5853
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Image Optimizer, Resizer and CDN – Sirv
Researcher
More Details >

WishList Member X <= 3.25.1 - Authenticated (Subscriber+) Remote Code Execution

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-37109
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Wishlist Member
Researcher
More Details >

Zoho Marketing Automation <= 1.2.7 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-37225
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Zoho Marketing Automation
Researcher
More Details >

Bug Library <= 2.1 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-5450
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Bug Library
Researcher
More Details >

Consulting Elementor Widgets <= 1.3.0 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-37089
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Consulting Elementor Widgets
Researcher
More Details >

Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-5756
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Email Subscribers by Icegram Express – Affordable, Powerful Email Marketing for WordPress & WooCommerce
Researcher
More Details >

Lifeline Donation <= 1.2.6 - Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-5432
Patch Status
Unpatched
Published
Jun 19, 2024
Affected Software
Lifeline Donation
Researcher
More Details >

Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-3229
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Salon Booking System
Researcher
More Details >

Shariff Wrapper <= 4.6.13 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-4098
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Shariff Wrapper
Researcher
More Details >

Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6027
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Themify – WooCommerce Product Filter
Researcher
More Details >

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-4742
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
Researcher
More Details >

Ali2Woo Lite <= 3.4.4 - Cross-Site Request Forgery to PHP Object Injection

9.6
CVSS Rating
Critical (9.6)
CVE-ID
CVE-2024-37212
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
AliExpress Dropshipping Plugin for WooCommerce – AliNext
Researcher
More Details >

WordPress Picture / Portfolio / Media Gallery <= 3.0.1 - Unauthenticated Server-Side Request Forgery

9.3
CVSS Rating
Critical (9.3)
CVE-ID
CVE-2024-5021
Patch Status
Unpatched
Published
Jun 18, 2024
Affected Software
WordPress Picture / Portfolio / Media Gallery
Researcher
More Details >

Squeeze <= 1.4 - Authenticated (Admin+) Arbitrary File Upload

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-35767
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Squeeze
Researcher
More Details >

Wp EMember <= 10.6.5 - Authenticated (Admin+) Arbitrary File Upload

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-5080
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Wp EMember
Researcher
More Details >

SEOPress <= 7.8 - Unauthenticated PHP Object Injection

9.0
CVSS Rating
Critical (9.0)
CVE-ID
CVE-2024-5488
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
SEOPress – On-site SEO
Researcher(s): Unknown
More Details >

AliExpress Dropshipping with AliNext Lite <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-2381
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
AliExpress Dropshipping Plugin for WooCommerce – AliNext
Researcher
More Details >

Consulting Elementor Widgets <= 1.3.0 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37092
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Consulting Elementor Widgets
Researcher
More Details >

Consulting Elementor Widgets <= 1.3.0 - Authenticated (Contributor+) Remote Code Execution

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37091
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Consulting Elementor Widgets
Researcher
More Details >

Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Field

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-3562
Patch Status
Unpatched
Published
Jun 19, 2024
Affected Software
Custom Field Suite
Researcher
More Details >

Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom Field

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-3561
Patch Status
Unpatched
Published
Jun 19, 2024
Affected Software
Custom Field Suite
Researcher
More Details >

Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5605
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Media Library Assistant
Researcher
More Details >

Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6132
Patch Status
Unpatched
Published
Jun 18, 2024
Affected Software
Pexels: Free Stock Photos
Researcher
More Details >

Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Cross-Site Request Forgery to Post Creation and Limited Data Loss

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5343
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Photo Gallery, Images, Slider in Rbs Image Gallery
Researcher
More Details >

Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5724
Patch Status
Unpatched
Published
Jun 18, 2024
Affected Software
Photo Video Gallery Master
Researcher
More Details >

Slideshow SE <= 2.5.17 - Authenticated (Author+) Limited Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-35778
Patch Status
Unpatched
Published
Jun 19, 2024
Affected Software
Slideshow SE
Researcher
More Details >

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5455
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
The Plus Addons for Elementor Page Builder
Researcher
More Details >

WishList Member X <= 3.25.1 - Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37107
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Wishlist Member
Researcher
More Details >

Word Balloon <= 4.21.1 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-35781
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Word Balloon
Researcher
More Details >

WP Blog Post Layouts <= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5503
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
WP Blog Post Layouts
Researcher
More Details >

Academy LMS <= 2.0.10 - Open Redirect

8.3
CVSS Rating
High (8.3)
CVE-ID
CVE-2024-37234
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Researcher
More Details >

Login with phone number <= 1.7.34 - Insecure Password Reset Mechanism

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-6125
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Login with phone number
Researcher
More Details >

WishList Member X <= 3.25.1 - Authenticated (Subscriber+) Arbitrary File Deletion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-37108
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Wishlist Member
Researcher
More Details >

Page Builder: Live Composer <= 1.5.42 - Authenticated (Contributor+) PHP Object Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-35780
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Live Composer – Free WordPress Website Builder
Researcher
More Details >

WP Magazine Modules Lite <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-5574
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
WP Magazine Modules Lite
Researcher
More Details >

Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injection

7.4
CVSS Rating
High (7.4)
CVE-ID
CVE-2023-5527
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
Business Directory Plugin – Easy Listing Directories for WordPress
Researcher
More Details >

Appointment Booking and Online Scheduling <= 4.4.2 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-5791
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Online Booking & Scheduling Calendar for WordPress by vcita
Researcher
More Details >

Quotes and Tips by BestWebSoft <= 1.44 - Authenticated (Admin+) Arbitrary File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-3112
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Quotes and Tips by BestWebSoft
Researcher
More Details >

UberMenu <= 3.8.3 - Cross-Site Request Forgery to Settings Reset

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-3593
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
UberMenu
Researcher
More Details >

WishList Member X <= 3.25.1 - Missing Authorization to Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-37106
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Wishlist Member
Researcher
More Details >

Export WP Page to Static HTML/CSS <= 2.2.2 - Open Redirect

7.1
CVSS Rating
High (7.1)
CVE-ID
CVE-2024-3597
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Export WP Page to Static HTML/CSS
Researcher
More Details >

Depicter <= 3.0.2 - Authenticated (Contributor+) Arbitrary Nonce Generation

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-4390
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel
Researcher
More Details >

License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-1639
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
License Manager for WooCommerce
Researcher
More Details >

Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2023-3204
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Materialis
Researcher
More Details >

Scheduling Plugin – Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-1634
Patch Status
Unpatched
Published
Jun 17, 2024
Affected Software
Scheduling Plugin – Online Booking for WordPress
Researcher
More Details >

Sparkle Demo Importer <= 1.4.7 - Missing Authorization to Authorized(Subscriber+) Post/Pages/Attachements Deletion and Demo Data Import

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-6120
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Sparkle Demo Importer
Researcher
More Details >

Ali2Woo Lite <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37214
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
AliExpress Dropshipping Plugin for WooCommerce – AliNext
Researcher
More Details >

Bible Text <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5444
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Bible Text
Researcher
More Details >

Blogmentor – Blog Layouts for Elementor <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4623
Patch Status
Unpatched
Published
Jun 18, 2024
Affected Software
Blogmentor – Blog Layouts for Elementor
Researcher
More Details >

Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5191
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Branda – Branda – White Label & Branding, Custom Login Page Customizer
Researcher
More Details >

Church Admin <= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35764
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
Church Admin
Researcher
More Details >

Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3558
Patch Status
Unpatched
Published
Jun 19, 2024
Affected Software
Custom Field Suite
Researcher
More Details >

DImage 360 <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35774
Patch Status
Unpatched
Published
Jun 18, 2024
Affected Software
DImage 360
Researcher
More Details >

Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.42 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5575
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Ditty – Responsive News Tickers, Sliders, and Lists
Researcher
More Details >

Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5533
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
Divi
Researcher
More Details >

Elegant Themes Icons <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37100
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Elegant Themes Icons
Researcher
More Details >

EmbedSocial – Social Media Feeds, Reviews and Galleries <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3984
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
EmbedSocial – Social Media Feeds, Reviews and Galleries
Researcher
More Details >

Empty Cart Button for WooCommerce <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37217
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
Empty Cart Button for WooCommerce
Researcher
More Details >

Excellent <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35763
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
Excellent
Researcher
More Details >

Flatsome <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5156
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Flatsome
Researcher
More Details >

Flatsome | Multi-Purpose Responsive WooCommerce Theme <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5346
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Flatsome
Researcher
More Details >

Greenshift – animation and page builder blocks <= 8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35765
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
Greenshift – animation and page builder blocks
Researcher
More Details >

Grey Opaque <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5966
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
Grey Opaque
Researcher
More Details >

Image Photo Gallery Final Tiles Grid <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3710
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Image Photo Gallery Final Tiles Grid
Researcher
More Details >

Interface <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35758
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
Interface
Researcher
More Details >

JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4626
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
JetWidgets For Elementor
Researcher
More Details >

Kimili Flash Embed <= 2.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37221
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
Kimili Flash Embed
Researcher
More Details >

Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4375
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
Master Slider – Responsive Touch Slider
Researcher
More Details >

MaxGalleria <= 6.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5970
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
MaxGalleria
Researcher
More Details >

MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5768
Patch Status
Unpatched
Published
Jun 18, 2024
Affected Software
MIMO Woocommerce Order Tracking
Researcher
More Details >

Mosaic <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5965
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
Mosaic
Researcher
More Details >

My Favorites <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37114
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
My Favorites
Researcher
More Details >

Orbit Fox by ThemeIsle <= 2.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2484
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Orbit Fox by ThemeIsle
Researcher
More Details >

OSM Map Widget for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4663
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
OSM Map Widget for Elementor
Researcher
More Details >

Page Builder Sandwich – Front-End Page Builder <= 5.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37219
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
Page Builder Sandwich – Front End WordPress Page Builder Plugin
Researcher
More Details >

Page Builder: Live Composer <= 1.5.42 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35779
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Live Composer – Free WordPress Website Builder
Researcher
More Details >

Page Builder: Live Composer <= 1.5.47 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35768
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Live Composer – Free WordPress Website Builder
Researcher
More Details >

PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0845
Patch Status
Unpatched
Published
Jun 17, 2024
Affected Software
PDF Viewer for Elementor
Researchers
More Details >

Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3894
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Photo Gallery, Images, Slider in Rbs Image Gallery
Researcher
More Details >

Quiz and Survey Master <= 9.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6025
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
Researcher
More Details >

Restaurant Reservations <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37223
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
Restaurant Reservations
Researcher
More Details >

SEOPress – On-site SEO <= 7.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URL

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1168
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
SEOPress – On-site SEO
Researcher
More Details >

Shortcodes Ultimate Pro <= 7.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4217
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Shortcodes Ultimate Pro
Researcher
More Details >

Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5036
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)
Researcher
More Details >

Sinatra <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37116
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Sinatra
Researcher
More Details >

Sketchfab Embed <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37216
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
Sketchfab Embed
Researcher
More Details >

Slideshow SE <= 2.5.20 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35769
Patch Status
Unpatched
Published
Jun 18, 2024
Affected Software
Slideshow SE
Researcher
More Details >

Support SVG <= 1.0.0 - Authenticated (Author+) Stored Cross-site Scripting via SVG

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4272
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Support SVG – Upload svg files in wordpress without hassle
Researcher
More Details >

SVG Block <= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4269
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
SVG Block
Researcher
More Details >

Swift Framework < 2024.04.30 Authenticated (Contributor+) Stored Cross-Site Scripting via Caption Title

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2872
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Swift Framework
Researcher
More Details >

Table Addons for Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4313
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Table Addons for Elementor
Researcher
More Details >

Transition Slider – Responsive Image Slider and Gallery <= 2.20.3 - Authenticated (Editor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37215
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Transition Slider – Responsive Image Slider and Gallery
Researcher
More Details >

Typing Text <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5058
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Typing Text
Researcher
More Details >

Ultimate Blocks – WordPress Blocks Plugin <= 3.0.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via metabox

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2023-6692
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Ultimate Blocks – WordPress Blocks Plugin
Researcher
More Details >

Ultimate Blocks – WordPress Blocks Plugin <= 3.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4655
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Ultimate Blocks – WordPress Blocks Plugin
Researcher
More Details >

Watu Quiz <= 3.4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2640
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Watu Quiz
Researcher
More Details >

Website Content in Page or Post <= 2024.03.27 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2430
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Website Content in Page or Post
Researcher
More Details >

WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4632
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce
Researcher
More Details >

WordPress Plugin Tournamatch < 4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5627
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Tournamatch
Researcher
More Details >

WP Post Author <= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37101
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder
Researcher
More Details >

WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag'

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0383
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
WP Recipe Maker
Researcher
More Details >

WP Scraper <= 5.8 - Authenticated (Subscriber+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37208
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
WP Scraper
Researcher
More Details >

WP SVG Images <= 4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5945
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
WP SVG Images
Researcher
More Details >

WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5686
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
WPZOOM Addons for Elementor (Templates, Widgets)
Researcher
More Details >

AliExpress Dropshipping with AliNext Lite <= 3.3.6 - Missing Authorization via Several Functions

6.3
CVSS Rating
Medium (6.3)
CVE-ID
CVE-2024-4450
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
AliExpress Dropshipping Plugin for WooCommerce – AliNext
Researcher
More Details >

ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions

6.3
CVSS Rating
Medium (6.3)
CVE-ID
CVE-2024-5596
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
Researcher
More Details >

Ali2Woo Lite <= 3.3.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37211
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
AliExpress Dropshipping Plugin for WooCommerce – AliNext
Researcher
More Details >

Ali2Woo Lite <= 3.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37213
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
AliExpress Dropshipping Plugin for WooCommerce – AliNext
Researcher
More Details >

Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5859
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Online Booking & Scheduling Calendar for WordPress by vcita
Researcher
More Details >

Demo Awesome <= 1.0.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37206
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Demo Awesome
Researcher
More Details >

Enfold <= 5.6.9 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37199
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Enfold - Responsive Multi-Purpose Theme
Researcher
tom
More Details >

Hostel <= 1.1.5.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-3753
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Hostel
Researcher
More Details >

If-So Dynamic Content Personalization <= 1.8.0.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5713
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
If-So Dynamic Content Personalization
Researcher
More Details >

Index WP MySQL For Speed <= 1.4.17 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-4977
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Index WP MySQL For Speed
Researcher
More Details >

Inline Related Posts <= 3.6.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5626
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Inline Related Posts
Researcher
More Details >

Master Slider <= 3.10.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37222
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Master Slider – Responsive Touch Slider
Researcher
More Details >

Shortcodes by United Themes < 5.0.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37097
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Shortcodes by United Themes
Researcher
More Details >

SULly <= 4.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5032
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
SULly
Researcher
More Details >

SULly <= 4.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5033
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
SULly
Researcher
More Details >

Swift Framework < 2024.04.30 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-2870
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Swift Framework
Researcher
More Details >

The Plus Addons for Elementor Page Builder <= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5344
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
The Plus Addons for Elementor Page Builder
Researcher
More Details >

WP Affiliate Platform < 6.5.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5287
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
WP Affiliate Platform
Researcher
More Details >

WP Affiliate Platform < 6.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5284
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
WP Affiliate Platform
Researcher
More Details >

WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Affiliate Editing

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5281
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
WP Affiliate Platform
Researcher
More Details >

WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Banner Editing

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5286
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
WP Affiliate Platform
Researcher
More Details >

WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Lead Editing

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5283
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
WP Affiliate Platform
Researcher
More Details >

WP Affiliate Platform < 6.5.1 - Reflected Cross-Site Scripting via Registration Form

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5282
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
WP Affiliate Platform
Researcher
More Details >

WP Affiliate Platform <= 6.5.0 - Cross-Site Request Forgery to Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5280
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
WP Affiliate Platform
Researcher
More Details >

Wp EMember <= 10.6.5 - Cross-Site Request Forgery

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5077
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Wp EMember
Researcher
More Details >

WP eMember <= 10.6.5 - Reflected Cross-Site Scripting via 'editrecord'

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5075
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Wp EMember
Researcher
More Details >

WP eMember <= 10.6.5 - Reflected Cross-Site Scripting via 'login_pwd'

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5074
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Wp EMember
Researcher
More Details >

WP eMember <= 10.6.6 - Reflected Cross-Site Scripting via Member Edit

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5715
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Wp EMember
Researcher
More Details >

Wp EMember <= 10.6.6 - Unauthenticated Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5079
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Wp EMember
Researcher
More Details >

WPPizza – A Restaurant Plugin <= 3.18.13 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35766
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
WPPizza – A Restaurant Plugin
Researcher
More Details >

Cost Calculator Builder PRO <= 3.1.75 - Unauthenticated Arbitrary Email Sending

5.8
CVSS Rating
Medium (5.8)
CVE-ID
CVE-2024-4787
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Cost Calculator Builder PRO
Researcher
More Details >

BlossomThemes Email Newsletter <= 2.2.6 - Authenticated (Admin+) Server-Side Request Forgery

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-37098
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
BlossomThemes Email Newsletter
Researcher
More Details >

Slider by 10Web <= 1.2.55 - Authenticated (Editor+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-6026
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Slider by 10Web – Responsive Image Slider
Researcher
More Details >

WordPress Button Plugin MaxButtons <= 9.7.7 - Authenticated (Editor+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-3026
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
WordPress Button Plugin MaxButtons
Researcher
More Details >

Hercules Core <= 6.5 - Missing Authorization to Settings Update

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-37232
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Hercules Core
Researcher
More Details >

OpenPGP Form Encryption for WordPress <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-3919
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
OpenPGP Form Encryption for WordPress
Researcher
More Details >

Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1407
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Researcher
More Details >

Universal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injection

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-5649
Patch Status
Unpatched
Published
Jun 18, 2024
Affected Software
Universal Slider
Researcher
More Details >

Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-3627
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Wheel of Life: Coaching and Assessment Tool for Life Coach
Researcher
More Details >

WP Affiliate Platform < 6.5.1 - Cross-Site Request Forgery to Profile Update

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-5287
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
WP Affiliate Platform
Researcher
More Details >

affiliate-toolkit <= 3.4.4 - Unauthenticated Sensitive Information Exposure via Logs

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37205
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
affiliate-toolkit – WP Affiliate Plugin with Amazon
Researcher
More Details >

ConvertKit <= 2.4.9 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3961
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Subscribers and Landing Pages
Researcher
More Details >

Event Management Tickets Booking <= 1.4.2 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-5059
Patch Status
Unpatched
Published
Jun 19, 2024
Affected Software
Event Monster – Event Management, Tickets Booking, Upcoming Event
Researcher
More Details >

Ibtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-5541
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
Ibtana – WordPress Website Builder
Researcher
More Details >

MasterStudy LMS <= 3.2.12 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37094
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Researcher
More Details >

Newspack Blocks <= 3.0.8 - Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37115
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Newspack Blocks
Researcher
More Details >

Optinly <= 1.0.18 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37220
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms
Researcher
More Details >

phpinfo() WP <= 5.0 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35776
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
phpinfo() WP
Researcher
More Details >

SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37881
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
SiteGuard WP Plugin
Researcher
More Details >

Solid Security <= 9.3.1 - IP Address Spoofing to Denial of Service

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2022-44593
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Solid Security – Password, Two Factor Authentication, and Brute Force Protection
Researcher
More Details >

WishList Member X <= 3.25.1 - Missing Authorization to Information Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37110
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Wishlist Member
Researcher
More Details >

WishList Member X <= 3.25.1 - Unauthenticated Denial of Service

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37111
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Wishlist Member
Researcher
More Details >

WishList Member X <= 3.25.1 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37113
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Wishlist Member
Researcher
More Details >

WP 2FA <= 2.6.3 - Unauthenticated Information Exposure via Log File

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2022-44587
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
WP 2FA – Two-factor authentication for WordPress
Researcher
More Details >

WP Child Theme Generator <= 1.1.1 - Missing Authorization to Unauthenticated Child Theme Creation/Activation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3610
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
WP Child Theme Generator
Researcher
More Details >

WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypass

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-0789
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
WP Maintenance
Researcher
More Details >

Accordions <= 2.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37122
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Accordion – Multiple Accordion or FAQs Builder
Researcher
More Details >

Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6225
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Booking for Appointments and Events Calendar – Amelia
Booking for Appointments and Events Calendar – Amelia Pro
Researcher
More Details >

DN Footer Contacts <= 1.6.2 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3410
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Footer Contacts Bar
Researcher
More Details >

Easy Table of Contents <= 2.0.67 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6334
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Easy Table of Contents
Researcher
More Details >

Embed Peertube Playlist <= 1.07 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4602
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Embed Peertube Playlist
Researcher
More Details >

Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.13 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3963
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
Researcher
More Details >

If-So Dynamic Content Personalization <= 1.8.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6070
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
If-So Dynamic Content Personalization
Researcher
More Details >

Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Gallery

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-5442
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Researcher
More Details >

Product Enquiry for WooCommerce <= 3.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3964
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Product Enquiry for WooCommerce
Researcher
More Details >

Secure Copy Content Protection and Content Locking <= 4.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6138
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Secure Copy Content Protection and Content Locking
Researcher
More Details >

Serious Slider <= 1.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-35762
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
Serious Slider
Researcher
More Details >

Seriously Simple Podcasting <= 3.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3751
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Seriously Simple Podcasting
Researcher
More Details >

Shortcode Addons <= 3.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37121
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension
Researcher
More Details >

Simple Video Directory <= 1.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-5811
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Simple Video Directory
Researcher
More Details >

Social Media Widget <= 4.0.8 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-0974
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Social Media Widget
Researcher
More Details >

SULly <= 4.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-5151
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
SULly
Researcher
More Details >

Swift Framework < 2024.04.30 Authenticated (Admin+) Stored Cross-Site Scripting via Auth

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2696
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Swift Framework
Researcher
More Details >

Tabs <= 4.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37120
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Tabs – Responsive Tabs with WooCommerce Product Tab Extension
Researcher
More Details >

URL Shortener by MyShop <= 1.0.17 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-5802
Patch Status
Unpatched
Published
Jun 18, 2024
Affected Software
URL Shortener by MyThemeShop
Researcher
More Details >

User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20240319 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-5002
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
User Submitted Posts – Enable Users to Submit Posts from the Front End
Researcher
More Details >

WordPress Plugin Tournamatch < 4.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-5644
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Tournamatch
Researcher
More Details >

WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-35760
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Researcher
More Details >

WP Job Portal <= 2.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-35759
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Researcher
More Details >

WP QuickLaTeX <= 3.8.6 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-5472
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
WP QuickLaTeX
Researcher
More Details >

WP Secure Maintenance <= 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4753
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
WP Secure Maintenance
Researcher
More Details >

YARPP – Yet Another Related Posts Plugin <= 5.30.9 - Authenticated(Administrator+) Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2023-6495
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
YARPP – Yet Another Related Posts Plugin
Researcher
More Details >

Book Landing Page <= 1.2.3 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37230
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Book Landing Page
Researcher
More Details >

Bricks Builder <= 1.9.8 - Insecure Direct Object Reference

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4874
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Bricks Builder
Researcher
More Details >

Chic Lite <= 1.1.3 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37104
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Chic Lite
Researcher
More Details >

CM Email Registration Blacklist and Whitelist <= 1.4.8 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5167
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Name: CM E-Mail Registration Blacklist
Researcher
More Details >

ContentLock <= 1.0.3 - Cross-Site Request Forgery to Email Adding

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6023
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
ContentLock
Researcher
More Details >

ContentLock <= 1.0.3 - Cross-Site Request Forgery to Group/Email Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6024
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
ContentLock
Researcher
More Details >

ContentLock <= 1.0.3 - Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6022
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
ContentLock
Researcher
More Details >

Custom Product List Table <= 3.0.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4541
Patch Status
Unpatched
Published
Jun 18, 2024
Affected Software
Custom Product List Table
Researcher
More Details >

Customizr <= 4.4.21 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35771
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Customizr
Researcher
More Details >

Demo Awesome <= 1.0.2 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37207
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Demo Awesome
Researcher
More Details >

Digital Newspaper <= 1.1.5 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37198
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Digital Newspaper
Researcher
More Details >

Education Zone <= 1.3.4 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37103
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Education Zone
Researcher
More Details >

Envira Photo Gallery <= 1.8.7.3 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37095
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Gallery Plugin for WordPress – Envira Photo Gallery
Researcher
More Details >

Falang multilanguage <= 1.3.51 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37240
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Falang multilanguage for WordPress
Researcher
More Details >

FS Poster <= 6.5.8 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37237
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
FS Poster - WordPress Social media Auto Poster & Scheduler [Facebook, Instagram, Twitter, Pinterest]
Researcher
More Details >

Groundhogg <= 3.4.2.3 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37235
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg
Researcher
More Details >

Hide Dashboard Notifications <= 1.3 - Missing Authorization to Authenticated(Contributor+) Plugin Settings Modification

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1955
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Hide Dashboard Notifications
Researcher
More Details >

Hueman <= 3.7.24 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35772
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Hueman
Researcher
More Details >

Kanban Boards for WordPress <= 2.5.21 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37226
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
Kanban Boards for WordPress
Researcher
More Details >

Laybuy Payment Extension for WooCommerce <= 5.3.9 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37203
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Laybuy Payment Extension for WooCommerce
Researcher
More Details >

Loco Translate <= 2.6.9 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37236
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Loco Translate
Researcher
More Details >

MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37093
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Researcher
More Details >

Newsletters <= 4.9.7 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37227
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Newsletters
Researcher
More Details >

Newspack Newsletters <= 2.13.2 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37242
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
Newspack Newsletters
Researcher
More Details >

Page Builder Sandwich – Front-End Page Builder <= 5.1.0 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37218
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
Page Builder Sandwich – Front End WordPress Page Builder Plugin
Researcher
More Details >

Play.ht <= 3.6.4 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37233
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio
Researcher
More Details >

Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer <= 1.1.0 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3602
Patch Status
Patched
Published
Jun 19, 2024
Affected Software
Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer
Researcher
More Details >

Popup box <= 4.5.1 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37096
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
Researcher
More Details >

PropertyHive <= 2.0.9 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37204
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
PropertyHive
Researcher
More Details >

Replace Image <= 1.1.10 - Insecure Direct Object Reference

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4873
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Replace Image
Researcher
More Details >

Smart Image Gallery <= 1.0.18 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3632
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Smart Image Gallery
Researcher
More Details >

Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2023-3352
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP | Image CDN
Researchers
More Details >

SP Project & Document Manager <= 4.71 - Authenticated (Subscriber+) Directory Traversal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37224
Patch Status
Unpatched
Published
Jun 21, 2024
Affected Software
SP Project & Document Manager
Researcher
More Details >

SULly <= 4.3.0 - Cross-Site Request Forgery to Plugin Reset

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5034
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
SULly
Researcher
More Details >

Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5860
Patch Status
Patched
Published
Jun 17, 2024
Affected Software
Tickera – WordPress Event Ticketing
Researcher
More Details >

Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter <= 1.222.16 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37202
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter
Researcher
More Details >

User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5639
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
User Profile Picture
Researcher
More Details >

User Rights Access Manager <= 1.1.2 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37209
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
User Rights Access Manager
Researcher
More Details >

Vilva <= 1.2.2 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37102
Patch Status
Patched
Published
Jun 20, 2024
Affected Software
Vilva
Researcher
More Details >

Vimeography: Vimeo Video Gallery WordPress Plugin <= 2.4.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35770
Patch Status
Patched
Published
Jun 18, 2024
Affected Software
Vimeography: Vimeo Video Gallery WordPress Plugin
Researcher
More Details >

Woocommerce Customers Order History <= 5.2.2 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37201
Patch Status
Unpatched
Published
Jun 20, 2024
Affected Software
Woocommerce Customers Order History
Researcher
More Details >

Wp EMember <= 10.6.5 - Cross-Site Request Forgery to Bulk Delete

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5076
Patch Status
Patched
Published
Jun 22, 2024
Affected Software
Wp EMember
Researcher
More Details >

WP Job Manager - Resume Manager <= 2.1.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37241
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
WP Job Manager - Resume Manager
Researcher
More Details >

WPAdverts – Classifieds Plugin <= 2.1.2 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37238
Patch Status
Patched
Published
Jun 21, 2024
Affected Software
WPAdverts – Classifieds Plugin
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Trust Your Site
to the Leader in WordPress Security

Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.

Protect Your Site

Did you enjoy this post? Share it!

LinkedIn 

Comments

No Comments

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.