Chloe Chamberland
July 18, 2024

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 8, 2024 to July 14, 2024)

📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest. 

Last week, there were 261 vulnerabilities disclosed in 212 WordPress Plugins and 14 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 75 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 17,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 193
Unpatched 68

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 203
High Severity 34
Critical Severity 23

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 112
Missing Authorization 41
Cross-Site Request Forgery (CSRF) 37
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 14
Exposure of Sensitive Information to an Unauthorized Actor 12
Unrestricted Upload of File with Dangerous Type 9
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 6
Server-Side Request Forgery (SSRF) 6
Insertion of Sensitive Information into Log File 5
Authentication Bypass Using an Alternate Path or Channel 4
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 4
Improper Privilege Management 3
Authorization Bypass Through User-Controlled Key 2
Improper Control of Generation of Code ('Code Injection') 2
Deserialization of Untrusted Data 1
Insertion of Sensitive Information into Externally-Accessible File or Directory 1
Use of Hard-coded Credentials 1
Use of Less Trusted Source 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
18
15
14
14
14
13
12
11
9
7
6
6
6
6
5
5
4
4
4
4
4
4
3
3
3
3
3
3
3
3
3
2
2
2
2
2
2
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution academy
Admin Dashboard RSS Feed admin-dashboard-rss-feed
AdPush adsense-plugin
Advanced AJAX Page Loader advanced-ajax-page-loader
Advanced File Manager Shortcodes file-manager-advanced-shortcode
Advanced post slider advanced-post-slider
Amazing Hover Effects amazing-hover-effects
Animated Typed JS Shortcode animated-typed-js-shortcode
Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps appmaker-woocommerce-mobile-app-manager
Arkhe Blocks arkhe-blocks
Attachment File Icons (AF Icons) attachment-file-icons
Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail
Backup and Staging by WP Time Capsule wp-time-capsule
Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. barcode-scanner-lite-pos-to-manage-products-inventory-and-orders
BerqWP – Automated All-In-One PageSpeed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript searchpro
Blog, Posts and Category Filter for Elementor blog-posts-and-category-for-elementor
Booking Ultra Pro Appointments Booking Calendar Plugin booking-ultra-pro
Bradmax Player bradmax-player
Branda – Branda – White Label & Branding, Custom Login Page Customizer branda-white-labeling
Business Card business-card-by-esterox-100
Calendar.online / Kalender.digital – Plugin kalender-digital
Caxton – Create Pro page layouts in Gutenberg caxton
Chained Quiz chained-quiz
Change From Email wp-from-email
Cliengo – Chatbot cliengo
CodePen Embedded Pens Shortcode codepen-embedded-pen-shortcode
codoc codoc
Coming Soon Page – Responsive Coming Soon & Maintenance Mode responsive-coming-soon-page
Comment Images Reloaded comment-images-reloaded
ConeBlog – Elementor Blog Widgets coneblog-widgets
Contact Form 7 To PDF Viewer cf7-summary-and-print
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder bit-form
Contact Form, Survey, Quiz & Popup Form Builder – ARForms arforms-form-builder
CZ Loan Management cz-loan-management
Default Thumbnail Plus default-thumbnail-plus
DirectoryPress – Business Directory And Classified Ad Listing directorypress
Donation Block For PayPal donations-block
Download Button for Elementor download-button-for-elementor
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More duplicator
Dynamic Word Spinner: CSS3 Animated Rotation css3-rotating-words
Easy Google Adsense and Banner Ads Manager – AdsforWP ads-for-wp
Easy Pixels easy-pixels-by-jevnet
EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin eazydocs
EleForms – All In One Form Integration including DB for Elementor all-contact-form-integration-for-elementor
ElementInvader Addons for Elementor elementinvader-addons-for-elementor
Email Encoder – Protect Email Addresses and Phone Numbers email-encoder-bundle
EmbedPress – Embed PDF, PDF 3D FlipBook, Instagram Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Maps & Upload PDF Documents embedpress
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates essential-blocks
Event post event-post
Event Tickets and Registration event-tickets
EventON eventon-lite
Events Calendar for Google events-calendar-for-google
ExS Widgets exs-widgets
Extensions for Elementor extensions-for-elementor
FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor post-block
Featured Image Generator featured-image-generator
Feeds for YouTube (YouTube video, channel, and gallery plugin) feeds-for-youtube
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme – My Sticky Bar (formerly myStickymenu) mystickymenu
Form Vibes – Database Manager for Forms form-vibes
FULL – Cliente full-customer
Fusion Page Builder fusion
GD Rating System gd-rating-system
Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7
Genesis Blocks genesis-blocks
Get Use APIs – JSON Content Importer json-content-importer
Goftino goftino
Gravity Forms: Multiple Form Instances gravity-forms-multiple-form-instances
Gum Elementor Addon gum-elementor-addon
Gutenberg Forms – WordPress Form Builder Plugin forms-gutenberg
GutSlider – All in One Block Slider for Gutenberg slider-blocks
Happy WooCommerce FAQs & AI FAQ Generator (Formarly XPlainer) faq-for-woocommerce
HitPay Payment Gateway for WooCommerce hitpay-payment-gateway
Houzez CRM houzez-crm
Houzez Theme - Functionality houzez-theme-functionality
HT Mega – Absolute Addons For Elementor ht-mega-for-elementor
HTML Forms – Simple WordPress Forms Plugin html-forms
Image Optimizer, Resizer and CDN – Sirv sirv
Import Spreadsheets from Microsoft Excel import-spreadsheets-from-microsoft-excel
Inline Related Posts intelly-related-posts
InstaWP Connect – 1-click WP Staging & Migration instawp-connect
Internal Link Juicer: SEO Auto Linker for WordPress internal-links
iPanorama 360 – Advanced Virtual Tour Builder ipanorama-360-virtual-tour-builder-lite
IQ Testimonials iq-testimonials
Jetpack Boost – Website Speed, Performance and Critical CSS jetpack-boost
Job Board Manager job-board-manager
JSON API User json-api-user
Just Custom Fields just-custom-fields
Laposta laposta
LearnDash LMS – Reports wisdm-reports-for-learndash
Light Poll light-poll
Link Library link-library
Login by Auth0 auth0
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) magical-addons-for-elementor
Magical Posts Display – Elementor Advanced Posts widgets magical-posts-display
MakeStories (for Google Web Stories) makestories-helper
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations master-addons
Master Popups master-popups-lite
Matomo Analytics – Ethical Stats. Powerful Insights. matomo
MBE eShip mail-boxes-etc
Media Hygiene: Remove or Delete Unused Images and More! media-hygiene
Meks Smart Author Widget meks-smart-author-widget
Meks Video Importer meks-video-importer
Metorik – Reports & Email Automation for WooCommerce metorik-helper
Modern Events Calendar modern-events-calendar
Modern Events Calendar Lite modern-events-calendar-lite
Moloni moloni
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar mp3-music-player-by-sonaar
MStore API – Create Native Android & iOS Apps On The Cloud mstore-api
oik oik
Olive One Click Demo Import olive-one-click-demo-import
Openpos - WooCommerce Point Of Sale(POS) woocommerce-openpos
OSM – OpenStreetMap osm
Packlink PRO shipping module packlink-pro-shipping
Paid Memberships Pro - Member Directory Add On pmpro-member-directory
Panda Video pandavideo
Payflex Payment Gateway payflex-payment-gateway
PayPlus Payment Gateway payplus-payment-gateway
Plugin Notes Plus plugin-notes-plus
Plum: Spin Wheel & Email Pop-up qodeblock
Post Layouts for Gutenberg post-layouts
Power BI Embedded for WordPress embed-power-bi
PowerPress Podcasting plugin by Blubrry powerpress
Predictive Search for WooCommerce woocommerce-predictive-search
Premium Addons for Elementor premium-addons-for-elementor
Pricing Table elfsight-pricing-table
Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite
Product Designer product-designer
Product Table by WBW woo-product-tables
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
Qi Blocks qi-blocks
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker quiz-master-next
Realtyna Organic IDX plugin + WPL Real Estate real-estate-listing-realtyna-wpl
ReCaptcha Integration for WordPress wp-recaptcha-integration
ReDi Restaurant Reservation redi-restaurant-reservation
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction pie-register
Responsive Tabs responsive-tabs
REVIEWS.io for WooCommerce reviewscouk-for-woocommerce
ScrollTo Bottom scrollto-bottom
ScrollTo Top scrollto-top
SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue happy-scss-compiler
Search & Replace search-and-replace
Send email only on Reply to My Comment send-email-only-on-reply-to-my-comment
Send Users Email – Email Subscribers, Email Marketing Newsletter send-users-email
Seraphinite Accelerator Pro seraphinite-accelerator-ext
Seraphinite Post .DOCX Source seraphinite-post-docx-source
Simple Alert Boxes simple-alert-boxes
Simple Popup Plugin simple-popup-plugin
Simple Post Notes simple-post-notes
Simple Responsive Slider simple-responsive-slider
Simple WhatsApp form- Quick Custom WhatsApp & WordPress Form Builder simple-form
SKT Addons for Elementor skt-addons-for-elementor
SKT Skill Bar skt-skill-bar
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) sky-elementor-addons
Slider by 10Web – Responsive Image Slider slider-wd
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) slingblocks
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer smartcrawl-seo
Social Sharing Plugin – Kiwi kiwi-social-share
SpiderContacts spider-contacts
Spiffy Calendar spiffy-calendar
SportsPress – Sports Club & League Manager sportspress
Squelch Tabs and Accordions Shortcodes squelch-tabs-and-accordions-shortcodes
Tabs For WPBakery Page Builder (formerly Visual Composer) tabs-for-visual-composer
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics taggbox-widget
Team Manager – WordPress Showcase Team Members wp-team-manager
Team Members team-members
Timeline Module for Beaver Builder timeline-for-beaver-builder
Titan Anti-spam & Security anti-spam
TOCHAT.BE tochat-be
Tutor LMS – eLearning and online course solution tutor
Typebot | Create advanced chat experiences without coding typebot
Ultimate Classified Listings ultimate-classified-listings
UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) ultraaddons-elementor-lite
Uncanny Automator Pro uncanny-automator-pro
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor
User Activity Log Pro user-activity-log-pro
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds userfeedback-lite
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor profile-builder
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP userswp
VK All in One Expansion Unit vk-all-in-one-expansion-unit
Wallet for WooCommerce woo-wallet
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction wallet-system-for-woocommerce
WANotifier – Send Message Notifications Using Cloud API notifier
WappPress – Create Mobile App for any WordPress site with our Mobile App Builder in just 1 minute wapppress-builds-android-app-for-website
Web Directory Free web-directory-free
Webico Slider Flatsome Addons webico-slider-flatsome-addons
Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More woocommerce-wholesale-prices
WooCommerce Customers Manager woocommerce-customers-manager
WooCommerce Report ithemelandco-woo-report
WordPress Multisite Content Copier/Updater wp-multisite-content-copier
WP Accessibility Helper (WAH) wp-accessibility-helper
WP Affiliate Platform wp-affiliate-platform
WP Ajax Contact Form wp-ajax-contact-form
WP Announcement | Dynamic Announcement, Banner, & Countdown Timer for Effective Promotions sp-announcement
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting erp
WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into WordPress wp-event-aggregator
WP Fast Total Search – The Power of Indexed Search fulltext-search
WP GoToWebinar wp-gotowebinar
WP Links Page wp-links-page
WP Photo Album Plus wp-photo-album-plus
WP Popups – WordPress Popup builder wp-popups-lite
WP Total Branding – Complete branding solution for WordPress wp-total-branding
WP Travel Engine – Tour Booking Plugin – Tour Operator Software wp-travel-engine
WP User Switch wp-user-switch
WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 wp2speed
WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor
WPCS – WordPress Currency Switcher Professional currency-switcher
WpStickyBar – Sticky Bar, Sticky Header wpstickybar-sticky-bar-sticky-header
YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation
Zephyr Project Manager zephyr-project-manager
Zoho Campaigns zoho-campaigns
Zoho CRM Lead Magnet zoho-crm-forms
پلاگین پرداخت دلخواه pardakht-delkhah

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
BuddyBoss Theme buddyboss-theme
Counterpoint counterpoint
i-amaze i-amaze
i-transform i-transform
Noo JobMonster noo-jobmonster
Oceanic oceanic
OnePress onepress
Patricia Blog patricia-blog
Patricia Lite patricia-lite
Point point
Popularis Verse popularis-verse
Responsive Mobile responsive-mobile
SmartMag smartmag-responsive-retina-wordpress-magazine
SociallyViral sociallyviral

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

CZ Loan Management <= 1.1 - Unauthenticated SQL Injection

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-5975
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
CZ Loan Management
Researcher
More Details >

Woocommerce OpenPos <= 6.4.4 - Unauthenticated SQL Injection

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-37933
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Openpos - WooCommerce Point Of Sale(POS)
Researcher
More Details >

WpStickyBar – Sticky Bar, Sticky Header <= 2.1.0 - Unauthenticated SQL Injection

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-5765
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
WpStickyBar – Sticky Bar, Sticky Header
Researcher
More Details >

DirectoryPress <= 3.6.10 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-38755
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
DirectoryPress – Business Directory And Classified Ad Listing
Researcher
More Details >

OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-3604
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
OSM – OpenStreetMap
Researcher
More Details >

PayPlus Payment Gateway <= 7.0.7 - Authenticated (Subscriber+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-37564
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
PayPlus Payment Gateway
Researcher
More Details >

Backup and Staging by WP Time Capsule <= 1.22.20 - Authentication Bypass to Account Takeover

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-38770
Patch Status
Patched
Published
Jul 13, 2024
Affected Software
Backup and Staging by WP Time Capsule
Researcher
More Details >

Booking Ultra Pro <= 1.1.13 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-38717
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Booking Ultra Pro Appointments Booking Calendar Plugin
Researcher
More Details >

Event post <= 5.9.5 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-38735
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Event post
Researcher
More Details >

Gutenberg Forms <= 2.2.9 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6313
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Gutenberg Forms – WordPress Form Builder Plugin
Researcher
More Details >

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6397
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
InstaWP Connect – 1-click WP Staging & Migration
Researcher
More Details >

IQ Testimonials <= 2.2.7 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6314
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
IQ Testimonials
Researcher
More Details >

Jobmonster <= 4.7.0 - Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-37927
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
Noo JobMonster
Researcher
More Details >

JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6624
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
JSON API User
Researcher
More Details >

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6328
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
MStore API – Create Native Android & iOS Apps On The Cloud
Researcher
More Details >

Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Execution

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6365
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Product Table by WBW
Researcher
More Details >

Search & Replace <= 3.2.2 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-38759
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Search & Replace
Researcher
More Details >

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.8 - Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6695
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Researcher
More Details >

Import Spreadsheets from Microsoft Excel <= 10.1.4 - Authenticated (Editor+) Arbitrary File Upload

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-38734
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Import Spreadsheets from Microsoft Excel
Researcher
More Details >

Jobmonster <= 4.7.0 - Unauthenticated Arbitrary File Deletion

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-37928
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
Noo JobMonster
Researcher
More Details >

Realtyna Organic IDX plugin <= 4.14.13 - Authenticated (Admin+) Arbitrary File Upload

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-38736
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Realtyna Organic IDX plugin + WPL Real Estate
Researcher
More Details >

Spiffy Calendar <= 4.9.11 - Authenticated (Administrator+) SQL Injection

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-38692
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Spiffy Calendar
Researcher
More Details >

Woocommerce OpenPos <= 6.4.4 - Unauthenticated Arbitrary File Deletion

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-37932
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Openpos - WooCommerce Point Of Sale(POS)
Researcher
More Details >

Advanced AJAX Page Loader <= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6310
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Advanced AJAX Page Loader
Researcher
More Details >

Advanced File Manager Shortcode <= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2023-7061
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Advanced File Manager Shortcodes
Researcher
More Details >

Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory Traversal

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2023-7062
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Advanced File Manager Shortcodes
Researcher
More Details >

Attachment File Icons (AF Icons) <= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6309
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Attachment File Icons (AF Icons)
Researcher
More Details >

Default Thumbnail Plus <= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6161
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Default Thumbnail Plus
Researcher
More Details >

Events Calendar for Google <= 2.1.0 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-38716
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Events Calendar for Google
Researcher
More Details >

ExS Widgets <= 0.3.1 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-38715
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
ExS Widgets
Researcher
More Details >

Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5325
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Form Vibes – Database Manager for Forms
Researcher
More Details >

GD Rating System <= 3.6 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-38709
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
GD Rating System
Researcher
More Details >

Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6317
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Generate PDF using Contact Form 7
Researcher
More Details >

Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6316
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Generate PDF using Contact Form 7
Researcher
More Details >

Houzez CRM <= 1.4.2 - Authenticated (Seller+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5792
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Houzez CRM
Researcher
More Details >

Houzez Theme - Functionality <= 3.2.2 - Authenticated (Seller+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5793
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Houzez Theme - Functionality
Researcher
More Details >

Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5441
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Modern Events Calendar
Modern Events Calendar Lite
Researcher
More Details >

Panda Video <= 1.4.0 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5456
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Panda Video
Researcher
More Details >

Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6069
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction
Researcher
More Details >

ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6411
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
ProfileGrid – User Profiles, Groups and Communities
Researchers
More Details >

ScrollTo Bottom <= 1.1.1 - Cross-Site Request Forgery to Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6321
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
ScrollTo Bottom
Researcher
More Details >

ScrollTo Top <= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6320
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
ScrollTo Top
Researcher
More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6166
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher
More Details >

Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6353
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Wallet for WooCommerce
Researcher
More Details >

WordPress Team Manager <= 2.1.12 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-38704
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Team Manager – WordPress Showcase Team Members
Researcher
More Details >

WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6666
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher
More Details >

WP User Switch <= 1.1.0 - Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37560
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
WP User Switch
Researcher
More Details >

Barcode Scanner with Inventory & Order Manager <= 1.6.1 - Authenticated (Subscriber+) SQL Injection

8.5
CVSS Rating
High (8.5)
CVE-ID
CVE-2024-38708
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.
Researcher
More Details >

BerqWP <= 1.7.5 - Unauthenticated Server-Side Request Forgery

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-37942
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
BerqWP – Automated All-In-One PageSpeed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
Researcher
More Details >

Bit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-6123
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
Researcher
More Details >

Business Card <= 1.0.0 - Authenticated (Admin+) Arbitrary File Uplaod

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-5807
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
Business Card
Researcher
More Details >

Donation Block For PayPal <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-6021
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Donation Block For PayPal
Researcher
More Details >

Easy Pixels by JEVNET <= 2.13 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-5479
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Easy Pixels
Researcher
More Details >

EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-6180
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
EventON
Researcher
More Details >

FULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-6447
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
FULL – Cliente
Researcher
More Details >

TOCHAT.BE <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-37563
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
TOCHAT.BE
Researcher
More Details >

UserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-5902
Patch Status
Patched
Published
Jul 12, 2024
Affected Software
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
Researcher
More Details >

Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-5992
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Cliengo – Chatbot
Researcher
More Details >

Premium Addons for Elementor <= 4.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-37922
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Premium Addons for Elementor
Researcher
More Details >

WPCS <= 1.2.0.3 - Unauthenticated Arbitrary Shortcode Execution

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-38700
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
WPCS – WordPress Currency Switcher Professional
Researcher
More Details >

Advanced post slider <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38750
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Advanced post slider
Researcher
More Details >

Amazing Hover Effects <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38741
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Amazing Hover Effects
Researcher
More Details >

Animated Typed JS Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38679
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Animated Typed JS Shortcode
Researcher(s): Unknown
More Details >

Arkhe Blocks <= 2.22.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38675
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Arkhe Blocks
Researcher
More Details >

Blog, Posts and Category Filter for Elementor <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4667
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Blog, Posts and Category Filter for Elementor
Researcher
More Details >

Booking Ultra Pro <= 1.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38676
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Booking Ultra Pro Appointments Booking Calendar Plugin
Researcher
More Details >

Bradmax Player <= 1.1.27 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37957
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Bradmax Player
Researcher
More Details >

Calendar.online / Kalender.digital <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38678
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Calendar.online / Kalender.digital – Plugin
Researcher
More Details >

Caxton – Create Pro page layouts in Gutenberg <= 1.30.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37948
Patch Status
Unpatched
Published
Jul 10, 2024
Affected Software
Caxton – Create Pro page layouts in Gutenberg
Researcher
More Details >

CodePen Embedded Pens Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37960
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
CodePen Embedded Pens Shortcode
Researcher
More Details >

ConeBlog – WordPress Blog Widgets <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37918
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
ConeBlog – Elementor Blog Widgets
Researcher
More Details >

Download Button for Elementor <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38718
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Download Button for Elementor
Researcher
More Details >

EazyDocs <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38720
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin
Researcher
More Details >

ElementInvader Addons for Elementor <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38705
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
ElementInvader Addons for Elementor
Researcher
More Details >

Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5595
Patch Status
Patched
Published
Jul 12, 2024
Affected Software
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Researcher
More Details >

Extensions for Elementor <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4868
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Extensions for Elementor
Researcher
More Details >

FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 5.3.1 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38686
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor
Researcher
More Details >

Feeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6256
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Feeds for YouTube (YouTube video, channel, and gallery plugin)
Researcher
More Details >

Fusion <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37962
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Fusion Page Builder
Researcher
More Details >

Genesis Blocks <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3563
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Genesis Blocks
Researchers
More Details >

Goftino <= 1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38697
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Goftino
Researcher
More Details >

GutSlider – All in One Block Slider <= 2.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37955
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
GutSlider – All in One Block Slider for Gutenberg
Researcher
More Details >

Job Board Manager <= 2.1.58 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38722
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Job Board Manager
Researchers
More Details >

JSON Content Importer <= 1.5.6 - Authenticated (Contributor+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38723
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Get Use APIs – JSON Content Importer
Researcher
More Details >

Magical Addons For Elementor <= 1.1.41 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38681
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )
Researcher
More Details >

Magical Addons For Elementor <= 1.1.41 - Authenticated (Subscriber+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38730
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )
Researcher
More Details >

Magical Posts Display – Elementor & Gutenberg Posts Blocks <= 1.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37951
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Magical Posts Display – Elementor Advanced Posts widgets
Researcher
More Details >

Master Addons for Elementor <= 2.0.6.2 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38710
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations
Researcher
More Details >

Meks Smart Author Widget <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37958
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Meks Smart Author Widget
Researcher
More Details >

MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5664
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Researcher
More Details >

oik <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6391
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
oik
Researcher
More Details >

OnePress <= 2.3.8 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38739
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
OnePress
Researcher
More Details >

OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3603
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
OSM – OpenStreetMap
Researcher
More Details >

Panda Video <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5457
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Panda Video
Researcher
More Details >

Post Layouts for Gutenberg <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38682
Patch Status
Unpatched
Published
Jul 10, 2024
Affected Software
Post Layouts for Gutenberg
Researcher
More Details >

Power BI Embedded for WordPress <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37959
Patch Status
Unpatched
Published
Jul 10, 2024
Affected Software
Power BI Embedded for WordPress
Researcher
More Details >

PowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6588
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
PowerPress Podcasting plugin by Blubrry
Researcher
More Details >

Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6495
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Premium Addons for Elementor
Researcher
More Details >

Qi Blocks <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38712
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Qi Blocks
Researcher
More Details >

Quiz and Survey Master <= 9.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6390
Patch Status
Patched
Published
Jul 13, 2024
Affected Software
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
Researcher
More Details >

Responsive Mobile <= 1.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37949
Patch Status
Unpatched
Published
Jul 10, 2024
Affected Software
Responsive Mobile
Researcher
More Details >

Responsive Tabs <= 4.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4096
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Responsive Tabs
Researcher
More Details >

REVIEWS.io <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38677
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
REVIEWS.io for WooCommerce
Researcher
More Details >

Seraphinite Post .DOCX Source <= 2.16.9 - Authenticated (Subscriber+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38728
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Seraphinite Post .DOCX Source
Researcher
More Details >

Simple Alert Boxes <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5937
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Simple Alert Boxes
Researcher
More Details >

SKT Addons for Elementor <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38674
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
SKT Addons for Elementor
Researcher
More Details >

SKT Skill Bar <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38698
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
SKT Skill Bar
Researcher
More Details >

Sky Addons for Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38687
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery)
Researcher
More Details >

SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38684
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)
Researcher
More Details >

Squelch Tabs and Accordions Shortcodes <= 0.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via tab Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5946
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Squelch Tabs and Accordions Shortcodes
Researcher
More Details >

Tabs For WPBakery Page Builder <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37936
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
Tabs For WPBakery Page Builder (formerly Visual Composer)
Researcher
More Details >

Team Members <= 5.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38670
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Team Members
Researcher
More Details >

Typebot <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38757
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Typebot | Create advanced chat experiences without coding
Researcher
More Details >

UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4866
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode)
Researcher
More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6170
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher
More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6169
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher
More Details >

VK All in One Expansion Unit <= 9.99.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37956
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
VK All in One Expansion Unit
Researcher
More Details >

WappPress <= 6.0.4 - Authenticated (Subscriber+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38758
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
WappPress – Create Mobile App for any WordPress site with our Mobile App Builder in just 1 minute
Researcher
More Details >

Webico Slider Flatsome Addons <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5881
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Webico Slider Flatsome Addons
Researcher
More Details >

WooCommerce Customers Manager <= 30.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1747
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
WooCommerce Customers Manager
Researcher
More Details >

WP Event Aggregator <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38703
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into WordPress
Researcher
More Details >

WP GoToWebinar <= 15.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38671
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
WP GoToWebinar
Researcher
More Details >

WP Photo Album Plus <= 8.8.02.002 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38713
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
WP Photo Album Plus
Researcher
More Details >

WP Travel Engine <= 5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37944
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Researcher
More Details >

WPBITS Addons For Elementor Page Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4862
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
WPBITS Addons For Elementor Page Builder
Researcher
More Details >

XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5669
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Happy WooCommerce FAQs & AI FAQ Generator (Formarly XPlainer)
Researcher
More Details >

Zoho Campaigns <= 2.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38752
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Zoho Campaigns
Researcher
More Details >

AdPush <= 1.50 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38672
Patch Status
Unpatched
Published
Jul 10, 2024
Affected Software
AdPush
Researcher
More Details >

Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps <= 1.36.12 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38680
Patch Status
Unpatched
Published
Jul 10, 2024
Affected Software
Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps
Researcher
More Details >

ARForms Form Builder <= 1.6.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37920
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Contact Form, Survey, Quiz & Popup Form Builder – ARForms
Researcher
More Details >

codoc <= 0.9.51.12 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37961
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
codoc
Researcher
More Details >

Contact Form 7 Summary and Print <= 1.2.5 - Cross-Site Request Forgery

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38724
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Contact Form 7 To PDF Viewer
Researcher
More Details >

Counterpoint <= 1.8.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37559
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Counterpoint
Researcher
More Details >

Link Library <= 7.7.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38711
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Link Library
Researcher
More Details >

Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2023-6813
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Login by Auth0
Researcher
More Details >

MBE eShip <= 2.2.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37953
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
MBE eShip
Researcher
More Details >

Moloni <= 4.7.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38694
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Moloni
Researcher
More Details >

Multisite Content Copier/Updater <= 2.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38673
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
WordPress Multisite Content Copier/Updater
Researcher
More Details >

Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38744
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Plum: Spin Wheel & Email Pop-up
Researcher
More Details >

Send email only on Reply to My Comment <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-6224
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
Send email only on Reply to My Comment
Researcher
More Details >

Send email only on Reply to My Comment <= 1.0.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-6223
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
Send email only on Reply to My Comment
Researcher
More Details >

Simple Responsive Slider <= 0.2.2.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37954
Patch Status
Unpatched
Published
Jul 10, 2024
Affected Software
Simple Responsive Slider
Researcher
More Details >

SpiderContacts <= 1.1.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-6272
Patch Status
Unpatched
Published
Jul 10, 2024
Affected Software
SpiderContacts
Researcher
More Details >

Ultimate Classified Listings <= 1.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5883
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Ultimate Classified Listings
Researcher
More Details >

Ultimate Classified Listings <= 1.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-6529
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Ultimate Classified Listings
Researcher
More Details >

Ultimate Classified Listings <= 1.3 - Unauthenticated Local File Inclusion

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5882
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Ultimate Classified Listings
Researcher
More Details >

Uncanny Automator Pro <= 5.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37117
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Uncanny Automator Pro
Researcher
More Details >

Web Directory Free <= 1.7.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-3669
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Web Directory Free
Researchers
More Details >

WooCommerce Predictive Search <= 6.0.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38669
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Predictive Search for WooCommerce
Researcher
More Details >

WooCommerce Report <= 1.4.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38683
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
WooCommerce Report
Researcher
More Details >

WP Ajax Contact Form <= 2.2.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5809
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
WP Ajax Contact Form
Researcher
More Details >

WpStickyBar – Sticky Bar, Sticky Header <= 2.1.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-6226
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
WpStickyBar – Sticky Bar, Sticky Header
Researcher
More Details >

YITH WooCommerce Ajax Product Filter <= 5.1.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37943
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
YITH WooCommerce Ajax Product Filter
Researcher
More Details >

Zoho CRM Lead Magnet <= 1.7.8.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38696
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Zoho CRM Lead Magnet
Researcher
More Details >

Jetpack Boost <= 3.4.6 - Authenticated (Admin+) Server-Side Request Forgery

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-6584
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Jetpack Boost – Website Speed, Performance and Critical CSS
Researcher
More Details >

Tutor LMS <= 2.7.2 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-37947
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Tutor LMS – eLearning and online course solution
Researcher
More Details >

WP Total Branding <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-6625
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
WP Total Branding – Complete branding solution for WordPress
Researcher
More Details >

Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-5993
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Cliengo – Chatbot
Researcher
More Details >

Cliengo – Chatbot <= 3.0.1 - Cross-Site Request Forgery

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-37923
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Cliengo – Chatbot
Researcher
More Details >

Happy SCSS Compiler - Compile SCSS to CSS automatically <= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-5600
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue
Researcher
More Details >

Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-6392
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Image Optimizer, Resizer and CDN – Sirv
Researcher
More Details >

LearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-5648
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
LearnDash LMS – Reports
Researcher
More Details >

Pricing Table <= 2.0.1 - Missing Authorization

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-4102
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Pricing Table
Researcher
More Details >

WooCommerce Customers Manager < 30.1 - Cross-Site Request Forgery to Customer Deletion

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-3983
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
WooCommerce Customers Manager
Researcher
More Details >

WooCommerce Customers Manager < 30.1 - Cross-Site Request Forgery to Customer Deletion via 'Delete'

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2843
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
WooCommerce Customers Manager
Researcher
More Details >

WP Affiliate Platform <= 6.5.1 - Cross-Site Request Forgery to Afilliate Deletion

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-5285
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
WP Affiliate Platform
Researcher
More Details >

Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6554
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Branda – Branda – White Label & Branding, Custom Login Page Customizer
Researcher
More Details >

Chained Quiz <= 1.3.2.8 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37921
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Chained Quiz
Researcher
More Details >

Coming Soon <= 1.6.3 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38756
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
Researcher
More Details >

Duplicator <= 1.5.9 - Full Path Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6210
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
Researcher
More Details >

EleForms <= 2.9.9.9 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38748
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
EleForms – All In One Form Integration including DB for Elementor
Researcher
More Details >

EmbedPress <= 4.0.4 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38707
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
EmbedPress – Embed PDF, PDF 3D FlipBook, Instagram Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Maps & Upload PDF Documents
Researcher
More Details >

Gravity Forms: Multiple Form Instances <= 1.1.1 - Unauthenticated Full Path Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6550
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Gravity Forms: Multiple Form Instances
Researcher
More Details >

HitPay Payment Gateway for WooCommerce <= 4.1.3 - Information Exposure via Log Files

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38747
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
HitPay Payment Gateway for WooCommerce
Researcher
More Details >

iPanorama 360 WordPress Virtual Tour Builder <= 1.8.3 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38690
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
iPanorama 360 – Advanced Virtual Tour Builder
Researcher
More Details >

Laposta <= 1.12 - Unauthenticated Full Path Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6574
Patch Status
Unpatched
Published
Jul 12, 2024
Affected Software
Laposta
Researcher
More Details >

MBE eShip <= 2.1.2 - Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38742
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
MBE eShip
Researcher
More Details >

Olive One Click Demo Import <= 1.1.2 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38749
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Olive One Click Demo Import
Researcher
More Details >

Payflex Payment Gateway <= 2.5.0 - Missing Authorization to Order Status Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-0619
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Payflex Payment Gateway
Researcher
More Details >

Plum: Spin Wheel & Email Pop-up <= 2.0 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38743
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Plum: Spin Wheel & Email Pop-up
Researcher
More Details >

Pricing Table <= 2.0.1 - Cross-Site Request Forgery via ajax()

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-4100
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Pricing Table
Researcher
More Details >

Product Delivery Date for WooCommerce – Lite <= 2.7.2 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38702
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Product Delivery Date for WooCommerce – Lite
Researcher
More Details >

Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3608
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Product Designer
Researcher
More Details >

ReDi Restaurant Reservation <= 24.0422 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38737
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
ReDi Restaurant Reservation
Researcher
More Details >

Send Users Email <= 1.5.1 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38760
Patch Status
Patched
Published
Jul 12, 2024
Affected Software
Send Users Email – Email Subscribers, Email Marketing Newsletter
Researcher
More Details >

SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 - Unauthenticated Full Path Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6556
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer
Researcher
More Details >

SmartMag <= 9.3.0 - Unauthenticated Sensitive Information Exposure via Log Files

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37930
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
SmartMag
Researcher
More Details >

Social Sharing Plugin – Kiwi <= 2.1.7 - Information Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3228
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Social Sharing Plugin – Kiwi
Researcher
More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6171
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher
More Details >

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.7 - Missing Authorization to Unauthenticated Media Upload

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6366
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Researcher
More Details >

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6477
Patch Status
Patched
Published
Jul 13, 2024
Affected Software
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
Researcher
More Details >

Wallet System for WooCommerce <= 2.5.13 - Information Exposure via Log Files

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38699
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction
Researcher
More Details >

Wholesale Suite <= 2.1.12 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38745
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More
Researcher
More Details >

Woocommerce OpenPos <= 7.0.1 - Missing Authorization to Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37935
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Openpos - WooCommerce Point Of Sale(POS)
Researcher
More Details >

WP Accessibility Helper (WAH) <= 0.6.2.9 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37926
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
WP Accessibility Helper (WAH)
Researcher
More Details >

WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6555
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
WP Popups – WordPress Popup builder
Researcher
More Details >

WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-5810
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
WP2Speed Faster – Optimize PageSpeed Insights Score 90-100
Researcher
More Details >

WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37924
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
WP2Speed Faster – Optimize PageSpeed Insights Score 90-100
Researcher
More Details >

Zephyr Project Manager <= 3.3.99 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38761
Patch Status
Patched
Published
Jul 12, 2024
Affected Software
Zephyr Project Manager
Researcher
More Details >

Admin Dashboard RSS Feed <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-38725
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Admin Dashboard RSS Feed
Researchers
More Details >

Change From Email <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-38738
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Change From Email
Researcher
More Details >

Email Encoder – Protect Email Addresses and Phone Numbers <= 2.2.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4483
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Email Encoder – Protect Email Addresses and Phone Numbers
Researcher
More Details >

FormFlow <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3113
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Simple WhatsApp form- Quick Custom WhatsApp & WordPress Form Builder
Researchers
More Details >

Gum Elementor Addon <= 1.3.5 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37565
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Gum Elementor Addon
Researcher
More Details >

Inline Related Posts <= 3.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6487
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Inline Related Posts
Researcher
More Details >

Master Popups <= 1.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37950
Patch Status
Unpatched
Published
Jul 10, 2024
Affected Software
Master Popups
Researcher
More Details >

My Sticky Bar (formerly myStickymenu) <= 2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4090
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme – My Sticky Bar (formerly myStickymenu)
Researcher
More Details >

Plugin Notes Plus <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37561
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Plugin Notes Plus
Researcher
More Details >

ReCaptcha Integration for WordPress <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37946
Patch Status
Unpatched
Published
Jul 10, 2024
Affected Software
ReCaptcha Integration for WordPress
Researcher
More Details >

Simple Popup <= 4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-38689
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Simple Popup Plugin
Researcher
More Details >

Simple Post Notes <= 1.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37562
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Simple Post Notes
Researcher
More Details >

Slider by 10Web <= 1.2.56 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6408
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Slider by 10Web – Responsive Image Slider
Researcher
More Details >

SportsPress – Sports Club & League Manager <= 2.7.21 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3986
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
SportsPress – Sports Club & League Manager
Researcher
More Details >

Timeline Module for Beaver Builder <= 1.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37919
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Timeline Module for Beaver Builder
Researcher
More Details >

WANotifier – Send Message Notifications Using WhatsApp API <= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6165
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
WANotifier – Send Message Notifications Using Cloud API
Researcher
More Details >

WP Announcement <= 2.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-38685
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
WP Announcement | Dynamic Announcement, Banner, & Countdown Timer for Effective Promotions
Researcher
More Details >

Zephyr Project Manager <= 3.3.97 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6536
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Zephyr Project Manager
Researcher
More Details >

Auto Featured Image (Auto Post Thumbnail) <= 4.0.0 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38719
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Auto Featured Image (Auto Post Thumbnail)
Researcher
More Details >

BuddyBoss Theme <= 2.4.61 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37925
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
BuddyBoss Theme
Researcher
More Details >

Comment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5856
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Comment Images Reloaded
Researcher
More Details >

Dynamic Word Spinner: CSS3 Animated Rotation <= 5.6 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38753
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Dynamic Word Spinner: CSS3 Animated Rotation
Researcher
More Details >

EazyDocs <= 2.5.0 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38721
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin
Researcher
More Details >

Event post <= 5.9.6 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1375
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Event post
Researcher
More Details >

Event Tickets <= 5.11.0.4 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38762
Patch Status
Patched
Published
Jul 12, 2024
Affected Software
Event Tickets and Registration
Researcher
More Details >

Featured Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5677
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Featured Image Generator
Researcher
More Details >

Google Adsense & Banner Ads by AdsforWP <= 1.9.28 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38751
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Easy Google Adsense and Banner Ads Manager – AdsforWP
Researcher
More Details >

HT Mega <= 2.5.7 - Authenticated (Contributor+) JSON File Directory Traversal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38706
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
HT Mega – Absolute Addons For Elementor
Researcher
More Details >

HTML Forms – Simple WordPress Forms Plugin <= 1.3.33 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6412
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
HTML Forms – Simple WordPress Forms Plugin
Researcher
More Details >

i-amaze <= 1.3.7 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38731
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
i-amaze
Researcher
More Details >

i-transform <= 3.0.9 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38764
Patch Status
Unpatched
Published
Jul 12, 2024
Affected Software
i-transform
Researcher
More Details >

Internal Link Juicer: SEO Auto Linker for WordPress <= 2.24.3 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37941
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Internal Link Juicer: SEO Auto Linker for WordPress
Researcher
More Details >

Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery via AJAX actions

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6168
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Just Custom Fields
Researcher
More Details >

Just Custom Fields <= 3.3.2 - Missing Authorization via AJAX actions

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6167
Patch Status
Unpatched
Published
Jul 8, 2024
Affected Software
Just Custom Fields
Researcher
More Details >

Light Poll <= 1.0.0 - Cross-Site Request Forgery to Poll Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6496
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Light Poll
Researcher
More Details >

MakeStories (for Google Web Stories) <= 3.0.3 - Authenticated (Subscriber+) Arbitrary File Download and Server-Side Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38746
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
MakeStories (for Google Web Stories)
Researcher
More Details >

Matomo Analytics <= 5.1.0 - Cross-Site Request Forgery to Notice Dismissal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38766
Patch Status
Patched
Published
Jul 12, 2024
Affected Software
Matomo Analytics – Ethical Stats. Powerful Insights.
Researcher
More Details >

MBE eShip <= 2.1.2 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38729
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
MBE eShip
Researcher
More Details >

Media Hygiene <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5855
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Media Hygiene: Remove or Delete Unused Images and More!
Researcher
More Details >

Meks Video Importer <= 1.0.11 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38733
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Meks Video Importer
Researcher
More Details >

Metorik – Reports & Email Automation for WooCommerce <= 1.7.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38691
Patch Status
Patched
Published
Jul 10, 2024
Affected Software
Metorik – Reports & Email Automation for WooCommerce
Researcher
More Details >

Oceanic <= 1.0.53 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38765
Patch Status
Unpatched
Published
Jul 12, 2024
Affected Software
Oceanic
Researcher
More Details >

Packlink PRO shipping module <= 3.4.6 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38740
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Packlink PRO shipping module
Researcher
More Details >

Paid Memberships Pro - Member Directory Add On < 1.2.6 - Authenticated (Contributor+) Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1287
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Paid Memberships Pro - Member Directory Add On
Researcher
More Details >

Pardakht Delkhah <= 2.9.8 - Cross-Site Request Forgery to Form Setting Reset

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6230
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
پلاگین پرداخت دلخواه
Researcher
More Details >

Patricia Blog <= 1.2 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38732
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Patricia Blog
Researcher
More Details >

Patricia Lite <= 1.2.3 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37939
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
Patricia Lite
Researcher
More Details >

Point <= 1.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37931
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
Point
Researcher
More Details >

Popularis Verse <= 1.0.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38763
Patch Status
Patched
Published
Jul 12, 2024
Affected Software
Popularis Verse
Researcher
More Details >

ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6410
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
ProfileGrid – User Profiles, Groups and Communities
Researcher
More Details >

Seraphinite Accelerator Premium <= 2.21.13 - Cross-Site Request Forgery to Arbitrary File Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37940
Patch Status
Patched
Published
Jul 9, 2024
Affected Software
Seraphinite Accelerator Pro
Researcher
More Details >

Seraphinite Post .DOCX Source <= 2.16.9 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38727
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Seraphinite Post .DOCX Source
Researcher
More Details >

SociallyViral <= 1.0.10 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37938
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
SociallyViral
Researcher
More Details >

Taggbox <= 3.3 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38754
Patch Status
Unpatched
Published
Jul 11, 2024
Affected Software
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
Researcher
More Details >

Titan Anti-spam & Security <= 7.3.7 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38777
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Titan Anti-spam & Security
Researcher
More Details >

User Activity Log Pro <= 2.3.4 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37929
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
User Activity Log Pro
Researcher
More Details >

WP Ajax Contact Form <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Email Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5808
Patch Status
Unpatched
Published
Jul 9, 2024
Affected Software
WP Ajax Contact Form
Researcher
More Details >

WP Fast Total Search <= 1.68.232 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38714
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
WP Fast Total Search – The Power of Indexed Search
Researcher
More Details >

WP GoToWebinar <= 15.6 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38695
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
WP GoToWebinar
Researcher
More Details >

WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6465
Patch Status
Patched
Published
Jul 12, 2024
Affected Software
WP Links Page
Researcher
More Details >

XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5704
Patch Status
Patched
Published
Jul 8, 2024
Affected Software
Happy WooCommerce FAQs & AI FAQ Generator (Formarly XPlainer)
Researcher
More Details >

Academy LMS <= 2.0.4 - Missing Authorization

2.7
CVSS Rating
Low (2.7)
CVE-ID
CVE-2024-38701
Patch Status
Patched
Published
Jul 11, 2024
Affected Software
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Trust Your Site
to the Leader in WordPress Security

Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.

Protect Your Site

Did you enjoy this post? Share it!

LinkedIn 

Comments

No Comments

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.