Chloe Chamberland
November 27, 2024

Wordfence Intelligence Weekly WordPress Vulnerability Report (November 18, 2024 to November 24, 2024)

🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through December 9th, 2024:

  • All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
  • All plugins and themes with 50-999 active installs hosted in the WordPress.org repository and updated within the last 2 years are in-scope for all researchers!
  • Minimum bounty of $5 for all valid in-scope submissions.
  • All researchers earn automatic bonuses of between 5% to 180% for valid submissions
  • Pending report limits are increased for all
  • It’s possible to earn up to $31,200 for high impact vulnerabilities!

Last week, there were 222 vulnerabilities disclosed in 205 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 50 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 20,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 108
Unpatched 114

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 173
High Severity 34
Critical Severity 15

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 112
Cross-Site Request Forgery (CSRF) 30
Missing Authorization 29
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 11
Deserialization of Untrusted Data 8
Authorization Bypass Through User-Controlled Key 7
Exposure of Sensitive Information to an Unauthorized Actor 6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 5
Unrestricted Upload of File with Dangerous Type 5
Improper Control of Generation of Code ('Code Injection') 4
Authentication Bypass Using an Alternate Path or Channel 1
Improper Access Control 1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 1
Improper Privilege Management 1
Protection Mechanism Failure 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
41
24
22
17
15
15
7
6
5
5
5
UKO
4
4
4
3
3
2
2
2
2
Gab
2
2
2
2
2
1
1
FX
1
1
1
1
1
1
1
1
1
1
1
1
1
1
Leo
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
404 Solution 404-solution
Absolute Addons For Elementor absolute-addons
Activity Log – Monitor & Record User Changes aryo-activity-log
Advanced Event Manager advanced-event-manager
affiliate-toolkit – WP Affiliate Plugin with Amazon affiliate-toolkit-starter
Ahmeti Wp Güzel Sözler ahmeti-wp-guzel-sozler
AI Quiz | Quiz Maker ai-quiz
AI Responsive Gallery Album ai-responsive-gallery-album
amr shortcodes amr-shortcodes
Announcement & Notification Banner – Bulletin bulletin-announcements
Anonymous Restricted Content anonymous-restricted-content
April's Call Posts aprils-call-posts
AtaraPay WooCommerce Payment Gateway atarapay-woocommerce
AutoListicle: Automatically Update Numbered List Articles autolisticle-automatically-update-numbered-list-articles
Awesome Studio awesome-studio
Banner System banner-system
Bard Extra bard-extra
Beds24 Online Booking beds24-online-booking
Booster for WooCommerce woocommerce-jetpack
Branda – Branda – White Label & Branding, Custom Login Page Customizer branda-white-labeling
Button Block – Get fully customizable & multi-functional buttons button-block
Buying Buddy IDX CRM buying-buddy-idx-crm
Chameleoni Jobs chameleon-jobs
Checkout with Cash App on WooCommerce wc-cashapp
Chessgame Shizzle chessgame-shizzle
Classified Listing – Classified ads & Business Directory Plugin classified-listing
Clone wp-clone-by-wp-academy
Co-marquage service-public.fr co-marquage-service-public
Community by PeepSo – Download from PeepSo.com peepso-core
Contact Form 7 Email Add on cf7-email-add-on
Contact Page With Google Map contact-page-with-google-map
Continue Shopping From Cart continue-shopping-from-cart-page
Control horas control-horas
Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes security-force
Custom CSS, JS & PHP custom-css
Custom Shortcode Sidebars custom-shortcode-sidebars
de:branding debranding
DeBounce Email Validator debounce-io-email-validator
Dino Game – Embed Google Chrome Dinosaur Game in your website dino-game
Distance Based Shipping Calculator distance-based-shipping-calculator
Document & Data Automation document-data-automation
Dynamic "To Top" Plugin dynamic-to-top
Dynamic URL SEO dynamic-url-seo
Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels wpfunnels
Easy Liveblogs easy-liveblogs
Easy Twitter Feed – Twitter feeds plugin for WP easy-twitter-feeds
Elementor Portfolio Builder portfolio-builder-elementor
Elfsight Telegram Chat CC elfsight-telegram-chat-cc
Email Subscription Popup email-subscribe
Enter Addons – Ultimate Template Builder for Elementor enteraddons
Explara Events explara-events
Extensions for Elementor extensions-for-elementor
F4 Improvements f4-improvements
Favicon My Blog favicon-my-blog
Fediverse Embeds fediverse-embeds
Fence URL wp-login.php fence-url
Fintelligence Calculator fintelligence-calculator
FireCask’s Twitter Follow Button twitter-follow
FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider fluent-smtp
Footer Flyout Widget footer-flyout-widget
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder formidable
Friendly Functions for Welcart friendly-functions-for-welcart
Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery simply-gallery-block
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress gamipress
GD bbPress Attachments gd-bbpress-attachments
GD Rating System gd-rating-system
Generic Elements generic-elements-for-elementor
Geolocator geolocator
Getwid – Gutenberg Blocks getwid
Google for WooCommerce google-listings-and-ads
Google Plus Share and +1 Button google-plus-share-and-plusone-button
GoQMieruca goqmieruca
GoQSmile goqsmile
Grey Owl Lightbox grey-owl-lightbox
Grid View Gallery grid-view-gallery
Gutenberg Blocks with AI by Kadence WP – Page Builder Features kadence-blocks
HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents hipaatizer
Hotlink2Watermark hotlink2watermark
HTML5 Lyrics Karaoke Player html5-lyrics-karaoke-player
HUSKY – Products Filter Professional for WooCommerce woocommerce-products-filter
IceStats icestats
Idealien Category Enhancements idealien-category-enhancements
If-So Dynamic Content Personalization if-so
Image horizontal reel scroll slideshow image-horizontal-reel-scroll-slideshow
Image Optimizer, Resizer and CDN – Sirv sirv
ImbaChat imbachat-widget
Include Mastodon Feed include-mastodon-feed
Increase Maximum Upload File Size | Increase Execution Time wp-maximum-upload-file-size
Infinite Slider infinite-slider
iPhone Webclip Manager iphone-webclip-manager
ITERAS iteras
JobBoardWP – Job Board Listings and Submissions jobboardwp
Kevin's Plugin kevins-plugin
LA-Studio Element Kit for Elementor lastudio-element-kit
Lazy load videos and sticky control lazy-load-videos-and-sticky-control
LeadBoxer leadboxer
LeanPress leanpress
LGPD Framework By Data443 lgpd-framework
Library Bookshelves library-bookshelves
LinkLaunder SEO linklaunder-seo-plugin
Lock User Account lock-user-account
LSX Tour Operator tour-operator
MailChimp Forms by MailMunch mailchimp-forms-by-mailmunch
MailMunch – Grow your Email List mailmunch
Memberlite Shortcodes memberlite-shortcodes
Meteor Slides meteor-slides
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar mp3-music-player-by-sonaar
MP3 Sticky Player fwdmsp
MStore API – Create Native Android & iOS Apps On The Cloud mstore-api
Multi Feed Reader multi-feed-reader
My Contador lesr my-contador-wp
nBlocks – Responsive Gutenberg News Blocks nblocks
Office Locator office-locator
Opal Woo Custom Product Variation opal-woo-custom-product-variation
Open edX LMS and WordPress integrator (LITE) edunext-openedx-integrator
Ortto autopilot
Page Parts page-parts
Parallax Image parallax-image
Pathomation pathomation
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net peachpay-for-woocommerce
PDF Invoices & Packing Slips Generator for WooCommerce pdf-invoicing-for-woocommerce
Post By Email post-by-email
Post Ideas post-ideas
Premium Packages – Sell Digital Products Securely wpdm-premium-packages
Pricing table addon for elementor pricing-table-addon-for-elementor
Product Designer product-designer
Product Table for WooCommerce by CodeAstrology (wooproducttable.com) woo-product-table
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
Protect Your Content protect-your-content
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes revisionary
Pure CSS Circle Progress bar pure-css-circle-progress-bar
QRMenu Restaurant QR Menu Lite qrmenu-lite
Quick Learn quick-learn
Quotes llama quotes-llama
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings seo-by-rank-math
RealtyCandy IDX Broker Extended realtycandy-idx-broker-extended
RecipePress Reloaded recipepress-reloaded
Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation get-a-quote-button-for-woocommerce
Rescue Shortcodes rescue-shortcodes
Restaurant Menu – Food Ordering System – Table Reservation menu-ordering-reservations
Run Contests, Raffles, and Giveaways with ContestsWP contest-code-checker
salavat counter Plugin salavat-counter
Save as PDF Plugin by Pdfcrowd save-as-pdf-by-pdfcrowd
School Management System for Wordpress school-management
Shine PDF Embeder shine-pdf
Shopready – Elementor addons for WooCommerce Page Builder shopready-elementor-addon
Silverlight Video Player smooth-streaming-player
Simple Membership simple-membership
Simple Travel Map simple-travel-map
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery) sky-elementor-addons
Slick Sitemap slick-sitemap
Slotti Ajanvaraus slotti-ajanvaraus
Social Login oa-social-login
SP Blog Designer sp-blog-designer
Sticky Social Icons sticky-social-icons
Stratum – Elementor Widgets stratum
StreamWeasels Online Status Bar stream-status-for-twitch
Subaccounts for WooCommerce subaccounts-for-woocommerce
SuevaFree Essential Kit suevafree-essential-kit
Sugar Calendar – Event Calendar, Event Tickets, and Event Management Platform sugar-calendar-lite
SVG Block svg-block
Tailored Tools tailored-tools
Team Rosters team-rosters
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce the-plus-addons-for-elementor-page-builder
Theater for WordPress theatre
Theme Builder For Elementor theme-builder-for-elementor
TM Islamic Helper tm-islamic-helper
Tribute Testimonials – WordPress Testimonial Grid/Slider tribute-testimonial-gridslider
Tutor LMS – eLearning and online course solution tutor
Ultimate Classified Listings ultimate-classified-listings
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member
Ultimate YouTube Video & Shorts Player With Vimeo ultimate-youtube-video-player
UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) ultraaddons-elementor-lite
User registration & user profile – UserPlus userplus
Wawp OTP Verification, Order Notifications, and Country Code Selector for WooCommerce automation-web-platform
Wc Recently viewed products wc-recently-viewed-products
Weather Atlas Widget weather-atlas
What Would Seth Godin Do what-would-seth-godin-do
WIP Incoming Lite wip-incoming-lite
Wishlist for WooCommerce: Multi Wishlists Per Customer PRO wish-list-for-woocommerce-pro
WooCommerce Price Alert price-alert-woocommerce
WooCommerce Product Table Lite wc-product-table-lite
WordPress Bootscraper wp-bootscraper
WordPress Brute Force Protection – Stop Brute Force Attacks guardgiant
wp auto top wp-auto-top
WP e-Commerce Style Email wp-e-commerce-style-email
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts wedevs-project-manager
WP Travel Engine – Tour Booking Plugin – Tour Operator Software wp-travel-engine
WP User Manager – User Profile Builder & Membership wp-user-manager
WP-ISPConfig 3 wp-ispconfig3
WP-Orphanage Extended wp-orphanage-extended
WPAdverts – Classifieds Plugin wpadverts
WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup wpb-popup-for-contact-form-7
WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element
WPDash Notes wpdash-notes
WPGYM - Wordpress Gym Management System gym-management
Xpresslane Fast Checkout xpresslane-integration-for-woocommerce
Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc
Youneeq Recommendations youneeq-panel
yPHPlista yphplista
Zajax – Ajax Navigation zajax-ajax-navigation
Экспресс Платежи платежный модуль express-pay
우커머스 네이버페이 mshop-npay
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 pgall-for-woocommerce
코드엠샵 소셜톡 mshop-naver-talktalk

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
AccessPress Staple accesspress-staple
Ashe ashe
Bard bard
ForumEngine forumengine
jobify jobify

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Bootscraper <= 3.0.0 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52449
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
WordPress Bootscraper
Researcher
More Details >

Contact Page With Google Map <= 1.6.1 - Unauthenticated Arbitrary File Deletion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52447
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Contact Page With Google Map
Researcher
More Details >

Fediverse Embeds <= 1.5.3 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52476
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Fediverse Embeds
Researcher
More Details >

FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider <= 2.2.82 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-9511
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider
Researcher
Leo
More Details >

Geolocator <= 1.1 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52443
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Geolocator
Researcher
More Details >

Opal Woo Custom Product Variation <= 1.1.3 - Unauthenticated Arbitrary File Deletion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52444
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
Opal Woo Custom Product Variation
Researcher
More Details >

Pathomation <= 2.5.1 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52490
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Pathomation
Researcher
More Details >

Quick Learn <= 1.0.1 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52441
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Quick Learn
Researcher
More Details >

School Management <= 91.5.0 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-9659
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
School Management System for Wordpress
Researcher
More Details >

Social Login <= 5.9.0 - Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10961
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Social Login
Researcher
More Details >

Team Rosters <= 4.6 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52439
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Team Rosters
Researcher
More Details >

UserPlus <= 2.0 - Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52442
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
User registration & user profile – UserPlus
Researcher
More Details >

Wawp < 3.0.18 - Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52475
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Wawp OTP Verification, Order Notifications, and Country Code Selector for WooCommerce
Researcher
More Details >

WPGYM <= 67.1.0 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-9942
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
WPGYM - Wordpress Gym Management System
Researcher
More Details >

Xpresslane Fast Checkout <= 1.0.0 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-52440
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Xpresslane Fast Checkout
Researcher
More Details >

Absolute Addons For Elementor <= 1.0.14 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52496
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Absolute Addons For Elementor
Researcher
More Details >

AccessPress Staple <= 1.9.1 and Grip <= 1.0.9 - Authenticated (Subscriber+) Arbitrary Plugin Activation and Deactivation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52488
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
AccessPress Staple
Researcher
More Details >

Banner System <= 1.0.0 - Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52437
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Banner System
Researcher
More Details >

Buying Buddy IDX CRM <= 1.1.12 - Cross-Site Request Forgery to PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52446
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Buying Buddy IDX CRM
Researcher
More Details >

Classified Listing – Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-11194
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
Classified Listing – Classified ads & Business Directory Plugin
Researcher
More Details >

Clone <= 2.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialized_replace'

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-10913
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Clone
Researcher
More Details >

Contact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-10898
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Contact Form 7 Email Add on
Researcher
More Details >

de:branding <= 1.0.2 - Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52438
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
de:branding
Researcher
More Details >

LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-10873
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
LA-Studio Element Kit for Elementor
Researchers
More Details >

nBlocks <= 1.0.2 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52450
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
nBlocks – Responsive Gutenberg News Blocks
Researcher
More Details >

Office Locator <= 1.3.0 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52501
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Office Locator
Researcher
More Details >

Pricing table addon for elementor <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52499
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Pricing table addon for elementor
Researcher
More Details >

QRMenu Restaurant QR Menu Lite <= 1.0.3 - Authenticated (Contributor+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52445
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
QRMenu Restaurant QR Menu Lite
Researcher
More Details >

School Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-9660
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
School Management System for Wordpress
Researcher
More Details >

Shopready <= 3.5 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52497
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Shopready – Elementor addons for WooCommerce Page Builder
Researcher
More Details >

SP Blog Designer <= 1.0.0 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52498
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
SP Blog Designer
Researcher
More Details >

Ultimate Classified Listings <= 1.4 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-52448
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Ultimate Classified Listings
Researcher
More Details >

WP-Orphanage Extended <= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-11415
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
WP-Orphanage Extended
Researcher
More Details >

WPGYM <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-9941
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
WPGYM - Wordpress Gym Management System
Researcher
More Details >

Jobify - Job Board WordPress Theme <= 4.2.3 - Unauthenticated Arbitrary File Read

8.2
CVSS Rating
High (8.2)
CVE-ID
CVE-2024-52481
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
jobify
Researcher
More Details >

Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-10855
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Image Optimizer, Resizer and CDN – Sirv
Researcher
More Details >

Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-11601
Patch Status
Patched
Published
Nov 21, 2024
Affected Software
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery)
Researcher
More Details >

Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-11104
Patch Status
Patched
Published
Nov 21, 2024
Affected Software
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery)
Researcher
More Details >

Express Payments Module <= 1.1.8 - Unauthenticated SQL Injection via type_id

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-52474
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Экспресс Платежи платежный модуль
Researcher
More Details >

MP3 Sticky Player <= 8.0 - Unauthenticated Arbitrary File Read/Download

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-10803
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
MP3 Sticky Player
Researcher
More Details >

Post Ideas <= 2 - Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-52451
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Post Ideas
Researcher
More Details >

Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-10400
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Tutor LMS – eLearning and online course solution
Researcher
More Details >

GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-11036
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress
Researcher
More Details >

Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation <= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_form

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-11034
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation
Researcher
More Details >

WooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-10899
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
WooCommerce Product Table Lite
Researcher
More Details >

WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-11038
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup
Researcher
More Details >

Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-10788
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Activity Log – Monitor & Record User Changes
Researcher
More Details >

Grid View Gallery <= 1.0 - Authenticated (Editor+) PHP Object Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-11409
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Grid View Gallery
Researcher
More Details >

Rank Math SEO <= 1.0.231 - .htaccess File Manipulation to Remote Code Execution

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-11620
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
Researcher
More Details >

AI Quiz <= 1.1 - Missing Authorization

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-53708
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
AI Quiz | Quiz Maker
Researcher
More Details >

Distance Based Shipping Calculator <= 2.0.21 - Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-52495
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Distance Based Shipping Calculator
Researcher
More Details >

MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-11179
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
MStore API – Create Native Android & iOS Apps On The Cloud
Researcher
More Details >

ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-10900
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
ProfileGrid – User Profiles, Groups and Communities
Researcher
More Details >

Advanced Event Manager <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53721
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Advanced Event Manager
Researcher
More Details >

AutoListicle: Automatically Update Numbered List Articles <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11426
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
AutoListicle: Automatically Update Numbered List Articles
Researcher
More Details >

Beds24 Online Booking <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10177
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Beds24 Online Booking
Researcher
More Details >

Control horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11381
Patch Status
Unpatched
Published
Nov 21, 2024
Affected Software
Control horas
Researcher
More Details >

Dino Game – Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11388
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Dino Game – Embed Google Chrome Dinosaur Game in your website
Researcher
More Details >

Easy Liveblogs <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11387
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Easy Liveblogs
Researcher
More Details >

Elementor Portfolio Builder <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52486
Patch Status
Unpatched
Published
Nov 19, 2024
Affected Software
Elementor Portfolio Builder
Researcher
Gab
More Details >

Elfsight Telegram Chat CC <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10390
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Elfsight Telegram Chat CC
Researcher
More Details >

Email Subscription Popup <= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11195
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
Email Subscription Popup
Researcher
More Details >

F4 Improvements <= 1.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9442
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
F4 Improvements
Researcher
More Details >

Fintelligence Calculator <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53731
Patch Status
Unpatched
Published
Nov 23, 2024
Affected Software
Fintelligence Calculator
Researcher
More Details >

GD Rating System <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11198
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
GD Rating System
Researcher
More Details >

Generic Elements <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53709
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Generic Elements
Researcher
Gab
More Details >

Getwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10872
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Getwid – Gutenberg Blocks
Researcher
More Details >

Grey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11440
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Grey Owl Lightbox
Researcher
More Details >

Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10785
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Gutenberg Blocks with AI by Kadence WP – Page Builder Features
Researcher
More Details >

HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11332
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents
Researcher
More Details >

ImbaChat <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52502
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
ImbaChat
Researcher
More Details >

Include Mastodon Feed <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11455
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Include Mastodon Feed
Researcher
More Details >

Jobify - Job Board WordPress Theme <= 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52478
Patch Status
Unpatched
Published
Nov 19, 2024
Affected Software
jobify
Researcher
More Details >

Lazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11428
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Lazy load videos and sticky control
Researcher
More Details >

LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9851
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
LSX Tour Operator
Researcher
More Details >

Memberlite Shortcodes <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via memberlite_accordion Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11227
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Memberlite Shortcodes
Researcher
More Details >

MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10268
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Researcher
More Details >

Parallax Image <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11224
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
Parallax Image
Researcher
More Details >

Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10164
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Premium Packages – Sell Digital Products Securely
Researcher
More Details >

Product Designer <= 1.0.35 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9111
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Product Designer
Researcher
More Details >

Pure CSS Circle Progress bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11385
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Pure CSS Circle Progress bar
Researcher
More Details >

Quotes llama <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10874
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Quotes llama
Researcher
More Details >

RecipePress Reloaded <= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11414
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
RecipePress Reloaded
Researcher
More Details >

Rescue Shortcodes <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11199
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Rescue Shortcodes
Researcher
More Details >

Save as PDF Plugin by Pdfcrowd <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10891
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Save as PDF Plugin by Pdfcrowd
Researcher
More Details >

Shine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11412
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Shine PDF Embeder
Researcher
More Details >

Slick Sitemap <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11424
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Slick Sitemap
Researcher
More Details >

Slotti Ajanvaraus <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11408
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Slotti Ajanvaraus
Researcher
More Details >

StreamWeasels Online Status Bar <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11438
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
StreamWeasels Online Status Bar
Researcher
More Details >

SuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11432
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
SuevaFree Essential Kit
Researcher
More Details >

Tailored Tools <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52503
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Tailored Tools
Researcher
More Details >

Tribute Testimonials – WordPress Testimonial Grid/Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10886
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Tribute Testimonials – WordPress Testimonial Grid/Slider
Researcher
More Details >

Twitter Follow Button <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10116
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
FireCask’s Twitter Follow Button
Researcher
More Details >

Ultimate Classified Listings <= 1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52487
Patch Status
Unpatched
Published
Nov 19, 2024
Affected Software
Ultimate Classified Listings
Researcher
More Details >

WPBakery Visual Composer WHMCS Elements <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10172
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
WPBakery Visual Composer WHMCS Elements
Researcher
More Details >

우커머스 네이버페이 <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11231
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
우커머스 네이버페이
Researcher
More Details >

워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting pafw_instant_payment Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11228
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
워드프레스 결제 심플페이 – 우커머스 결제 플러그인
Researcher
More Details >

코드엠샵 소셜톡 <= 1.1.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via add_plus_friends and add_plus_talk Shortcodes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11229
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
코드엠샵 소셜톡
Researcher
More Details >

404 Solution <= 2.35.19 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11277
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
404 Solution
Researcher
More Details >

affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10675
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
affiliate-toolkit – WP Affiliate Plugin with Amazon
Researcher
More Details >

AI Responsive Gallery Album <= 1.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52467
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
AI Responsive Gallery Album
Researcher
More Details >

amr shortcodes <= 1.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52464
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
amr shortcodes
Researcher
More Details >

Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9777
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
Ashe
Researcher
More Details >

AtaraPay WooCommerce Payment Gateway <= 2.0.13 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52460
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
AtaraPay WooCommerce Payment Gateway
Researcher
More Details >

Awesome Studio <= 2.4.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52456
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Awesome Studio
Researcher
More Details >

Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9830
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
Bard
Researcher
More Details >

Booster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9239
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Booster for WooCommerce
Researcher
More Details >

Branda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9371
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Branda – Branda – White Label & Branding, Custom Login Page Customizer
Researcher
More Details >

Bulletin Announcements <= 3.11.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10682
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Announcement & Notification Banner – Bulletin
Researcher
More Details >

Chameleoni Jobs <= 2.5.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52459
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Chameleoni Jobs
Researcher
More Details >

Checkout with Cash App on WooCommerce <= 6.0.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9635
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Checkout with Cash App on WooCommerce
Researcher
More Details >

Chessgame Shizzle <= 1.3.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11446
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Chessgame Shizzle
Researcher
More Details >

Co-marquage service-public.fr <= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10522
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Co-marquage service-public.fr
Researcher
More Details >

Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App <= 6.4.6.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11447
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Community by PeepSo – Download from PeepSo.com
Researcher
More Details >

Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11365
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes
Researcher
More Details >

Custom CSS, JS & PHP <= 2.3.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11330
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Custom CSS, JS & PHP
Researcher
More Details >

DeBounce Email Validator <= 5.6.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11463
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
DeBounce Email Validator
Researcher
More Details >

Dynamic URL SEO <= 1.0 - Unauthenticated Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52470
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Dynamic URL SEO
Researcher
More Details >

Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10792
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels
Researcher
More Details >

Explara Events <= 0.1.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52466
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Explara Events
Researcher
More Details >

Extensions for Elementor <= 2.0.40 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52471
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Extensions for Elementor
Researcher
More Details >

Footer Flyout Widget <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53732
Patch Status
Unpatched
Published
Nov 23, 2024
Affected Software
Footer Flyout Widget
Researcher
More Details >

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11188
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Researcher
More Details >

ForumEngine <= 1.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10623
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
ForumEngine
Researcher
More Details >

Friendly Functions for Welcart <= 1.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10726
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Friendly Functions for Welcart
Researcher
More Details >

GD bbPress Attachments <= 4.7.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11278
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
GD bbPress Attachments
Researcher
More Details >

GoQMieruca <= 1.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52454
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
GoQMieruca
Researcher
More Details >

GoQSmile <= 1.0.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52455
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
GoQSmile
Researcher
More Details >

GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10869
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
WordPress Brute Force Protection – Stop Brute Force Attacks
Researcher
More Details >

HTML5 Lyrics Karaoke Player <= 2.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52473
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
HTML5 Lyrics Karaoke Player
Researcher
More Details >

HUSKY – Products Filter for WooCommerce <= 1.3.6.3 - Reflected Cross-Site Scripting via really_curr_tax Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11400
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
HUSKY – Products Filter Professional for WooCommerce
Researcher
More Details >

Infinite Slider <= 2.0.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52461
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Infinite Slider
Researcher
More Details >

iPhone Webclip Manager <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53735
Patch Status
Unpatched
Published
Nov 23, 2024
Affected Software
iPhone Webclip Manager
Researcher
More Details >

JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10880
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
JobBoardWP – Job Board Listings and Submissions
Researcher
More Details >

LeadBoxer <= 1.2 - Unauthenticated Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52468
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
LeadBoxer
Researcher
More Details >

LeanPress <= 1.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52483
Patch Status
Unpatched
Published
Nov 19, 2024
Affected Software
LeanPress
Researcher
More Details >

LGPD Framework <= 2.0.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52465
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
LGPD Framework By Data443
Researcher
More Details >

Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52453
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Library Bookshelves
Researcher
More Details >

LinkLaunder SEO <= 0.92.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53727
Patch Status
Unpatched
Published
Nov 23, 2024
Affected Software
LinkLaunder SEO
Researcher
More Details >

MailChimp Forms by MailMunch <= 3.2.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-8726
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
MailChimp Forms by MailMunch
Researcher
More Details >

MailMunch – Grow your Email List <= 3.1.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-8735
Patch Status
Patched
Published
Nov 21, 2024
Affected Software
MailMunch – Grow your Email List
Researcher
More Details >

Open edX LMS <= 2.6.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52452
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Open edX LMS and WordPress integrator (LITE)
Researcher
More Details >

Ortto <= 1.0.19 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52482
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Ortto
Researcher
More Details >

Page Parts <= 1.4.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11360
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Page Parts
Researcher
More Details >

Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.112.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11362
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net
Researcher
More Details >

PDF Invoices & Packing Slips Generator for WooCommerce <= 2.2.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11361
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
PDF Invoices & Packing Slips Generator for WooCommerce
Researcher
More Details >

Post By Email <= 1.0.4b - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52463
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Post By Email
Researcher
More Details >

Premium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11225
Patch Status
Unpatched
Published
Nov 21, 2024
Affected Software
Premium Packages – Sell Digital Products Securely
Researcher
More Details >

Protect Your Content <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53728
Patch Status
Unpatched
Published
Nov 23, 2024
Affected Software
Protect Your Content
Researcher
More Details >

Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9653
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Restaurant Menu – Food Ordering System – Table Reservation
Researcher
More Details >

Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11456
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Run Contests, Raffles, and Giveaways with ContestsWP
Researcher
More Details >

salavat counter Plugin <= 0.9.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11435
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
salavat counter Plugin
Researcher
More Details >

Subaccounts for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11370
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Subaccounts for WooCommerce
Researcher
More Details >

Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10878
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Sugar Calendar – Event Calendar, Event Tickets, and Event Management Platform
Researcher
More Details >

Theater for WordPress <= 0.18.6.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11371
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Theater for WordPress
Researcher
More Details >

TM Islamic Helper <= 1.0.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52458
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
TM Islamic Helper
Researcher
More Details >

Wc Recently viewed products <= 1.0.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52484
Patch Status
Unpatched
Published
Nov 19, 2024
Affected Software
Wc Recently viewed products
Researcher
More Details >

Weather Atlas Widget <= 3.0.1 - Unauthenticated Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52472
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Weather Atlas Widget
Researcher
More Details >

WIP Incoming Lite <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11416
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
WIP Incoming Lite
Researcher
More Details >

Wishlist for WooCommerce: Multi Wishlists Per Customer PRO 3.0.8 - 3.1.2 - Reflected Cross-Site Scripting via wtab Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10519
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Wishlist for WooCommerce: Multi Wishlists Per Customer PRO
Researcher
More Details >

WooCommerce Price Alert <= 1.0.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52469
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
WooCommerce Price Alert
Researcher
More Details >

WP e-Commerce Style Email <= 0.6.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52462
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
WP e-Commerce Style Email
Researcher
More Details >

WPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10890
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
WPAdverts – Classifieds Plugin
Researcher
More Details >

Youneeq Recommendations <= 3.0.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-52457
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
Youneeq Recommendations
Researcher
More Details >

Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.4.2 - Authenticated (Editor+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-10034
Patch Status
Patched
Published
Nov 21, 2024
Affected Software
Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery
Researcher
More Details >

SVG Block <= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-11098
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
SVG Block
Researcher
More Details >

April's Call Posts <= 2.1.1 - Cross-Site Request Forgery to Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-53730
Patch Status
Unpatched
Published
Nov 23, 2024
Affected Software
April's Call Posts
Researcher
More Details >

Continue Shopping From Cart <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-53714
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Continue Shopping From Cart
Researcher
More Details >

Custom Shortcode Sidebars <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-53736
Patch Status
Unpatched
Published
Nov 23, 2024
Affected Software
Custom Shortcode Sidebars
Researcher
More Details >

Fence URL <= 2.0.0 - Cross-Site Request Forgery to Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-53733
Patch Status
Unpatched
Published
Nov 23, 2024
Affected Software
Fence URL wp-login.php
Researcher
More Details >

Idealien Category Enhancements <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-53734
Patch Status
Unpatched
Published
Nov 23, 2024
Affected Software
Idealien Category Enhancements
Researcher
More Details >

WP-ISPConfig 3 <= 1.5.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-53720
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
WP-ISPConfig 3
Researcher
More Details >

Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-10665
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Yaad Sarig Payment Gateway For WC
Researcher
More Details >

yPHPlista <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-53717
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
yPHPlista
Researcher
More Details >

Anonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-11089
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Anonymous Restricted Content
Researcher
More Details >

Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-10486
Patch Status
Patched
Published
Nov 18, 2024
Affected Software
Google for WooCommerce
Researcher
More Details >

Jobify - Job Board WordPress Theme <= 4.2.3 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-52480
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
jobify
Researcher
More Details >

Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-10813
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Product Table for WooCommerce by CodeAstrology (wooproducttable.com)
Researcher
More Details >

Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-11088
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Simple Membership
Researcher
More Details >

Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-10393
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Tutor LMS – eLearning and online course solution
Researcher
More Details >

WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-10520
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts
Researcher
More Details >

Favicon My Blog <= 1.0.2 - Cross-Site Request Forgery

4.7
CVSS Rating
Medium (4.7)
CVE-ID
CVE-2024-53722
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Favicon My Blog
Researcher
More Details >

Dynamic "To Top" 3.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-52494
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Dynamic "To Top" Plugin
Researcher
UKO
More Details >

Image horizontal reel scroll slideshow <= 13.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-52492
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Image horizontal reel scroll slideshow
Researcher
UKO
More Details >

Meteor Slides <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-52493
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Meteor Slides
Researcher
UKO
More Details >

Sticky Social Icons <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-52491
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Sticky Social Icons
Researcher
UKO
More Details >

What Would Seth Godin Do <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-51900
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
What Would Seth Godin Do
Researcher
FX
More Details >

Ahmeti Wp Güzel Sözler <= 4.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53707
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Ahmeti Wp Güzel Sözler
Researcher
More Details >

Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10532
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Bard Extra
Researcher
More Details >

Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10671
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Button Block – Get fully customizable & multi-functional buttons
Researcher
More Details >

Document & Data Automation <= 1.6.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-52477
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
Document & Data Automation
Researcher
More Details >

Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10666
Patch Status
Unpatched
Published
Nov 21, 2024
Affected Software
Easy Twitter Feed – Twitter feeds plugin for WP
Researcher
More Details >

Enter Addons – Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10868
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Enter Addons – Ultimate Template Builder for Elementor
Researcher
More Details >

Google Plus Share and +1 Button <= 1.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53723
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Google Plus Share and +1 Button
Researcher
More Details >

Hotlink2Watermark <= 0.3.2 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53711
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Hotlink2Watermark
Researcher
More Details >

IceStats <= 1.3 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53724
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
IceStats
Researcher
More Details >

If-So Dynamic Content Personalization <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10796
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
If-So Dynamic Content Personalization
Researcher
More Details >

ITERAS <= 1.7.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53710
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
ITERAS
Researcher
More Details >

Jobify - Job Board WordPress Theme <= 4.2.3 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-52479
Patch Status
Unpatched
Published
Nov 18, 2024
Affected Software
jobify
Researcher
More Details >

Kevin's <= 2.0.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53712
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Kevin's Plugin
Researcher
More Details >

Multi Feed Reader <= 2.2.4 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53718
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Multi Feed Reader
Researcher
More Details >

My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11334
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
My Contador lesr
Researcher
More Details >

PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11154
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
Researcher
More Details >

RealtyCandy IDX Broker Extended <= 1.5.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53726
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
RealtyCandy IDX Broker Extended
Researcher
More Details >

Silverlight Video Player <= 1.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53713
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Silverlight Video Player
Researcher
More Details >

Simple Travel Map <= 0.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53715
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Simple Travel Map
Researcher
More Details >

Sky Addons for Elementor <= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-9542
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery)
Researcher
More Details >

Stratum – Elementor Widgets <= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10316
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Stratum – Elementor Widgets
Researcher
More Details >

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10365
Patch Status
Patched
Published
Nov 19, 2024
Affected Software
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Researcher
More Details >

Theme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10782
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Theme Builder For Elementor
Researcher
More Details >

Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10528
Patch Status
Patched
Published
Nov 20, 2024
Affected Software
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
Researcher
More Details >

Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11354
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Ultimate YouTube Video & Shorts Player With Vimeo
Researcher
More Details >

Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11355
Patch Status
Unpatched
Published
Nov 21, 2024
Affected Software
Ultimate YouTube Video & Shorts Player With Vimeo
Researcher
More Details >

UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.8 - Insecure Direct Object Reference to Sensitive Information Exposure via UA_Template Shortcode

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10696
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode)
Researcher
More Details >

wp auto top <= 2.9.3 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53716
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
wp auto top
Researcher
More Details >

Wp Maximum Upload File Size <= 1.1.3 - Authenticated (Author+) Full Path Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11265
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
Increase Maximum Upload File Size | Increase Execution Time
Researcher
More Details >

WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10606
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Researcher
More Details >

WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10537
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
WP User Manager – User Profile Builder & Membership
Researcher
More Details >

WP User Manager – User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10216
Patch Status
Patched
Published
Nov 22, 2024
Affected Software
WP User Manager – User Profile Builder & Membership
Researcher
More Details >

WPDash Notes <= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-9223
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
WPDash Notes
Researcher
More Details >

Zajax – Ajax Navigation <= 0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53719
Patch Status
Unpatched
Published
Nov 22, 2024
Affected Software
Zajax – Ajax Navigation
Researcher
More Details >

Lock User Account <= 1.0.5 - User Lock Bypass

4.2
CVSS Rating
Medium (4.2)
CVE-ID
CVE-2024-11197
Patch Status
Unpatched
Published
Nov 20, 2024
Affected Software
Lock User Account
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Trust Your Site
to the Leader in WordPress Security

Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.

Protect Your Site

Did you enjoy this post? Share it!

LinkedIn 

Comments

No Comments

All comments are moderated before being published. Inappropriate or off-topic comments may not be approved.

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.