Chloe Chamberland
December 19, 2024

Wordfence Intelligence Weekly WordPress Vulnerability Report (December 9, 2024 to December 15, 2024)

💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program. Through January 6th, 2025:

  • All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
  • All plugins and themes with 50-999 active installs hosted in the WordPress.org repository and updated within the last 2 years are in-scope for all researchers!
  • All plugins and themes hosted in the WordPress.org repository with any install count are in scope for our preset list of high threat vulnerabilities.
  • $150 bonus awarded when a researcher submits at least 15 valid high threat vulnerabilities, and then a $50 bonus awarded for every 5 submitted thereafter.
  • Minimum bounty of $5 for all valid in-scope submissions.
  • All researchers earn automatic bonuses of between 5% to 180% for valid submissions
  • Pending report limits are increased for all
  • It’s possible to earn up to $31,200 for high impact vulnerabilities!

Last week, there were 369 vulnerabilities disclosed in 343 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 72 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 21,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 181
Unpatched 188

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 2
Medium Severity 292
High Severity 49
Critical Severity 26

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 155
Cross-Site Request Forgery (CSRF) 72
Missing Authorization 55
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 32
Exposure of Sensitive Information to an Unauthorized Actor 8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 8
Improper Control of Generation of Code ('Code Injection') 8
Authorization Bypass Through User-Controlled Key 6
Unrestricted Upload of File with Dangerous Type 5
Deserialization of Untrusted Data 4
Improper Privilege Management 4
Improper Access Control 3
Improper Authentication 2
Server-Side Request Forgery (SSRF) 2
Authentication Bypass Using an Alternate Path or Channel 1
Exposure of Private Personal Information to an Unauthorized Actor 1
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 1
Path Traversal: '/../filedir' 1
Uncontrolled Resource Consumption 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
66
28
25
18
18
15
13
11
10
9
8
7
7
7
7
Gab
6
6
6
6
5
4
4
3
3
3
3
3
3
3
3
3
2
2
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
cc
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
360 Javascript Viewer 360deg-javascript-viewer
3D Avatar User Profile 3d-avatar-user-profile
Accept Stripe Payments Using Contact Form 7 accept-stripe-payments-using-contact-form-7
Active Products Tables for WooCommerce. Use constructor to create tables  profit-products-tables-for-woocommerce
Add image to Post add-image-to-post
Add infos to The Events Calendar add-infos-to-the-events-calendar
addWeather myweather
Admin Customization wpp-customization
Advance Menu Manager advance-menu-manager
Advanced Blog Post Block advanced-blog-post-block
Advanced Data Table For Elementor advanced-data-table-for-elementor
Advanced Fancybox advanced-fancybox
Advanced What should we write next about advanced-what-should-we-write-about-next
AI Content Writer, RSS Feed to Post, Autoblogging SEO Help seo-help
AI Post Generator | AutoWriter ai-post-generator
AIcomments – комментарии и отзывы ChatGPT aicomments
AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot ai-seo-translator
Amazon Product Price amazon-product-price
Analytics Cat – Google Analytics Made Easy analytics-cat
Aphorismus aphorismus
AppMaps appmaps
Appsplate appsplate
AR for WordPress ar-for-wordpress
Arabic Webfonts arabic-webfonts
Arena.IM – Live Blogging for real-time events arena-liveblog-and-chat-tool
AutoWP – AI Content Writer & Rewriter autowp-ai-content-writer-rewriter
Awesome Support – WordPress HelpDesk & Support Plugin awesome-support
Axeptio – Cookie Banner – GDPR Consent & Compliance with a friendly touch axeptio-sdk-integration
Banner System banner-system
Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. barcode-scanner-lite-pos-to-manage-products-inventory-and-orders
Beaver Builder – WordPress Page Builder beaver-builder-lite-version
Bet sport Free bet-sport-free
Better WP Login Page better-wp-login-page
bodi0`s Easy cache bodi0s-easy-cache
Bold Page Builder bold-page-builder
Booking System Trafft booking-system-trafft
Bootstrap Buttons bootstrap-buttons
BP Email Assign Templates bp-email-assign-templates
Buk for WordPress buk-appointments
Bukza bukza
Caldera SMTP Mailer caldera-smtp-mailer
Car Dealer (Dealership) and Vehicle sales cardealer
CarDealerPress cardealerpress
Catch Popup catch-popup
Category of Posts list-one-category-of-posts
CE21 Suite ce21-suite
Check Pincode For Woocommerce check-pincode-for-woocommerce
Child Theme Creator by Orbisius orbisius-child-theme-creator
CK and SyntaxHighlighter ck-and-syntaxhighlighter
CleverNode Related Content clevernode-related-content
CM Answers – Powerful WordPress Forum Plugin cm-answers
Code Generator Pro code-generator-pro
Cognito Forms cognito-forms
Comments On Feed comments-on-feed
Companion Portfolio – Responsive Portfolio Plugin companion-portfolio
Connatix Video Embed connatix-video-embed
Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent gdpr-cookie-consent
CoSchool LMS – A complete Learning Management System to Create and Sell Your Courses Online coschool
Country Blocker country-blocker
Coupon Affiliates – Affiliate Plugin for WooCommerce woo-coupon-usage
Crafthemes Demo Import crafthemes-demo-import
Cricket Live Score cricket-score
CRUDLab Google Plus Button crudlab-google-plus
Cryptocurrency Price Widget cryptocurrency-price-widget
CSV to html csv-to-html
Currency Converter Widget ⚡ PRO currency-converter-widget-pro
Custom Skins Contact Form 7 custom-skins-contact-form-7
de:branding debranding
dejure.org Vernetzungsfunktion dejureorg-vernetzungsfunktion
Device Detector device-detector
Display Future Posts display-future-posts
Dr Affiliate dr-affiliate
DTC Documents dtc-documents
DX Dark Site devrix-dark-site
Easy Site Importer easy-site-importer
EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin eazydocs
ECT Product Carousel ect-product-carousel
ECT Social Share ect-social-share
EduAdmin Booking eduadmin-booking
EELV Newsletter eelv-newsletter
ElementInvader Addons for Elementor elementinvader-addons-for-elementor
Email Reminders email-reminders
Essential Real Estate essential-real-estate
eTemplates etemplates
Eveeno eveeno
Events Addon for Elementor events-addon-for-elementor
Evernote Sync evernote-sync
Falcon – WordPress Optimizations & Tweaks falcon
Fancy Roller Scroller fancy-roller-scroller
FAQ And Answers – Create Frequently Asked Questions Area on WP Sites faq-and-answers
Feedpress Generator – External RSS Frontend Customizer feedpress-generator
Filestack Official filestack-upload
Firebase OTP Authentication authentication-via-otp-using-firebase
Flaming Forms flaming-forms
Flash News / Post (Responsive) flashnews-fading-effect-pearlbells
Floating Video Player floating-player
FloristPress – Customize your Woo store for your Florist bakkbone-florist-companion
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder fluentform
FooGallery Premium foogallery-premium
FormFacade – WordPress plugin for Google Forms formfacade
ForumWP – Forum & Discussion Board forumwp
Frontend Admin by DynamiApps acf-frontend-form-element
FULL – Cliente full-customer
Ganohrs Toggle Shortcode ganohrs-toggle-shortcode
Gaxx Keywords gaxx-keywords
GEO my WP geo-my-wp
GeoDataSource Country Region DropDown geodatasource-country-region-dropdown
GeoFlickr geoflickr
Geoportail Shortcode geoportail-shortcode
Get Post Content Shortcode get-post-content-shortcode
GitSync git-sync
glomex oEmbed glomex-oembed
Go Animate goanimate
Gou Manage My Account Menu – User Roles gou-wc-account-tabs
Greenshift – animation and page builder blocks greenshift-animation-and-page-builder-blocks
Grid Plus – Unlimited grid layout grid-plus
Gutenberg Blocks and Page Layouts – Attire Blocks attire-blocks
Gutensee gutensee
Hack-Info hack-info
Hash Form – Drag & Drop Form Builder hash-form
Hello Event Widgets For Elementor hello-event-widgets-for-elementor
Hello In All Languages hello-in-all-languages
Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress hive-support
Horizontal scroll image slideshow horizontal-scroll-image-slideshow
HostFact bestelformulier integratie hostfact-bestelformulier-integratie
HQ Rental Software hq-rental-software
Hurrakify hurrakify
I Plant A Tree i-plant-a-tree
ICDSoft Reseller Store icdsoft-reseller-store
iChart – Easy Charts and Graphs ichart
IDer Login for WordPress ider-login
ImageRecycle pdf & image compression imagerecycle-pdf-image-compression
ImmoToolBox Connect immotoolbox-connect
Import Eventbrite Events import-eventbrite-events
IMS Countdown ims-countdown
Increase Sociability increase-sociability
Insertify – Ad,HTML,CSS,JS,PHP,PDF,Header & Footer insertify
Instant Appointment instant-appointment
Integrate Firebase integrate-firebase
Invoice Payment for WooCommerce invoice-payment-for-woocommerce
J&T Express Malaysia jt-express
jCarousel for WordPress jcarousel-for-wordpress
Jet Footer Code jet-footer-code
Job Board Manager job-board-manager
KH Easy User Settings kh-easy-user-settings
Koalendar – Events & Appointments Booking Calendar koalendar-free-booking-widget
Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site kredeum-nfts
Ksher ksher-payment
Kundgenerator kundgenerator
kvCORE IDX kvcore-idx
LabelGrid Tools label-grid-tools
Last Viewed Posts by WPBeginner last-viewed-posts
LaunchPage.app Importer launchpage-app-importer
LDD Directory Lite ldd-directory-lite
Leader leader
LeaderBoard Plugin leaderboard-lite
LearnPress – WordPress LMS Plugin learnpress
Library Bookshelves library-bookshelves
Library Management System – Manage e-Digital Books Library library-management-system
Lifetime free Drag & Drop Contact Form Builder for WordPress VForm v-form
Like in Vk.com like-on-vkontakte
LionScripts: Site Maintenance & Noindex Nofollow Plugin maintenance-and-noindex-nofollow
ListApp Mobile Manager listapp-mobile-manager
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites mainwp-child
Mandrill WP – Email Form Under Post email-form-under-post
Mark New Posts mark-new-posts
MDC Comment Toolbar mdc-comment-toolbar
Media Downloader media-downloader
Members – Membership & User Role Editor Plugin members
Metrika metrika
Mimoos devoluciones-packback
Minify HTML minify-html-markup
Minterpress minterpress
Mollie for Contact Form 7 cf7-mollie
MStore API – Create Native Android & iOS Apps On The Cloud mstore-api
Multiple Admin Emails multiple-admin-emails
My IDX Home Search my-idx-home-search
MyParcel woocommerce-myparcel
Nabz Image Gallery nabz-image-gallery
Navayan CSV Export navayan-csv-export
New User Approve new-user-approve
News Ticker for Elementor news-ticker-for-elementor
Newsletter Subscriptions newsletter-subscriptions
Newsletter, Email Marketing, Email Subscriber – Mail Picker mail-picker
NewsmanApp newsmanapp
Nias course | دوره ساز نیاس nias-course
NiceJob nicejob
Ninja Forms – The Contact Form Builder That Grows With You ninja-forms
Notibar – Notification Bar for WordPress notibar
NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar notificationx
OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook
Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita
ONLYOFFICE DocSpace onlyoffice-docspace
Onlywire Multi Autosubmitter onlywire-multi-autosubmitter
Opt-In Downloads halfdata-optin-downloads
Order Delivery & Pickup Location Date Time ( Free Version ) order-delivery-pickup-location-date-time-free-version
Out of the Block: OpenStreetMap ootb-openstreetmap
Password for WP password-for-wp
Payment Gateway Per Product for WooCommerce woocommerce-product-payments
Perfect Font Awesome Integration perfect-font-awesome-integration
phZoom Plugin for WordPress phzoom
PixProof – Easy Photo Proofing for Photographers pixproof
Planaday API planaday-api
Plezi plezi
Poll, Poll Forms – WordPress Poll plugin by Poll Builder poll-builder
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder popup-maker
Post Carousel & Slider post-types-carousel-slider
Post to Pdf post-to-pdf
Posti Shipping posti-shipping
Posts and Products Views for WooCommerce posts-and-products-views
Posts Date Ranges posts-date-ranges
PowerBI Embed Reports embed-power-bi-reports
PowerFormBuilder – Contact Form Database Manager for WordPress power-forms-builder
Primary Addon for Elementor primary-addon-for-elementor
Primer MyData for Woocommerce primer-mydata
Print Science Designer print-science-designer
Product Carousel Slider & Grid Ultimate for WooCommerce woo-product-carousel-slider-and-grid-ultimate
Projectopia – WordPress Project Management projectopia-core
Property Hive Mortgage Calculator property-hive-mortgage-calculator
Property Hive Stamp Duty Calculator property-hive-stamp-duty-calculator
Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart push-monkey-desktop-push-notifications
Quietly Insights quietly-insights
Quran multilanguage Text & Audio quran-text-multilanguage
Quran Phrases About Most People Shortcodes quran-phrases-about-most-people-shortcodes
Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress radio-player
Radius Blocks – WordPress Gutenberg Blocks radius-blocks
RapidLoad – Optimize Web Vitals Automatically unusedcss
Rate My Post – Star Rating Plugin by FeedbackWP rate-my-post
Responsive Filterable Portfolio responsive-filterable-portfolio
Responsive Google Maps | by imbaa responsive-google-maps
Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor
Restrict – membership, site, content and user access restrictions for WordPress restricted-content
Revi.io – Customer & Products Reviews revi-io-customer-and-product-reviews
Role Includer role-includer
Saksh Escrow System saksh-escrow-system
Schema App Structured Data schema-app-structured-data-for-schemaorg
SeedProd Pro seedprod-coming-soon-pro-5
Seraphinite Bulk Discounts for WooCommerce seraphinite-discount-for-woocommerce
Service service
Share Buttons – Social Media rich-web-share-button
Shortcodes for Elementor shortcode-elementor
Sign In With Google sign-in-with-google
Simple Booking – Widget simple-booking-widget
Simple Link Directory simple-link-directory
Simple Locator simple-locator
Simple Payment simple-payment
Simple Presenter simple-presenter
Simple Restrict simple-restrict
SIP Calculator sip-calculator
SiteOrigin Widgets Bundle so-widgets-bundle
Smaily for WP smaily-for-wp
Smart Agenda – Prise de rendez-vous en ligne smart-agenda-prise-de-rendez-vous-en-ligne
Smart PopUp Blaster smart-popup-blaster
SMSify smsify
Snippet Shortcodes shortcode-variables
Social Media Sharing social-media-sharing
Social Media Shortcodes social-media-shortcodes
SOPA Blackout sopa-blackout
Spreadr Woocommerce Plugin – Amazon Importer for Dropshipping and Affiliate spreadr-for-woocomerce
SQL Chart Builder sql-chart-builder
Staggs – Product Configurator Toolkit staggs
States Map US ymc-states-map
Stripe Donation bin-stripe-donation
Super Backup & Clone - Migrate for WordPress indeed-wp-superbackup
Surbma | SalesAutopilot Shortcode surbma-salesautopilot-shortcode
SVG Shortcode svg-shortcode
Tabs Maker tabs-maker
TagGator taggator
TCBD Popover tcbd-popover
Termin-Kalender termin-kalender
The Permalinker the-permalinker
Themify Store Locator themify-store-locator
This is a Subversion repository; use the 'svnadmin' tool to examine critical-site-intel-stats
Tickera – WordPress Event Ticketing tickera-event-ticketing-system
Tithe.ly Giving Button wp-tithely
Top and footer bars for announcements, notifications, advertisements, promotions – YooBar yoo-bar
TSB Occasion Editor tsb-occasion-editor
turboSMTP turbosmtp
Ui Slider Filter By Price ui-slider-filter-by-price
Ultimate Endpoints With Rest Api custom-wp-rest-api
UNIVERSAM universam-demo
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor
Utech World Time utech-world-time-for-wp
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce vayu-blocks
vBSSO-lite vbsso-lite
Video & Photo Gallery for Ultimate Member gallery-for-ultimate-member
Vimeography: Vimeo Video Gallery WordPress Plugin vimeography
Visual Recent Posts visual-recent-posts
Visualmodo Elements visualmodo-elements
Waymark waymark
Web Stories web-stories
Web3 Crypto Payments by DePay for WooCommerce depay-payments-for-woocommerce
Website Toolbox Community website-toolbox-forums
WooCommerce - PDF Vouchers woocommerce-pdf-vouchers
WooCommerce Basic Ordernumbers woocommerce-basic-ordernumbers
Woocommerce Blocks – Woolook woolook
WooCommerce Cart Count Shortcode woo-cart-count-shortcode
WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more gs-books-showcase
WordPress Filter wordpress-filter
WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support
WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more gs-portfolio
WordPress Post Grid Layouts with Pagination – Sogrid sogrid
Wovax IDX wovax-idx
WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More wp-ad-guru
WP Controller wp-management-controller
WP Cookies Enabler wp-cookies-enabler
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses wp-courses
WP Crowdfunding wp-crowdfunding
WP Currency Exchange Rates wp-currency-exchange-rates
WP Email Log – PostBox postbox-email-logs
WP Fiddle wp-fiddle
WP Flipkart Importer wp-flipkart-importer
WP GeoNames wp-geonames
WP Job Portal – A Complete Recruitment System for Company or Job Board website wp-job-portal
WP Log Action wp-log-action
Wp Login with Ajax wp-login-with-ajax
WP Mailster wp-mailster
WP Mega Menu wp-megamenu
Wp NssUser Register wp-nssuser-register
Wp photo text slider 50 wp-photo-text-slider-50
WP Pipes wp-pipes
WP Quick Shop wp-quick-shop
WP Service Payment Form With Authorize.net wp-service-payment-form-with-authorizenet
WP Simple Pay Lite Manager stripe-manager
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin timetics
WP-Ban-User wp-ban-user
WP-HideThat wp-hide-that
WP-NERD Toolkit wp-nerd-toolkit
WP-Revive Adserver wp-revive-adserver
WPBookit wpbookit
WPC Order Notes for WooCommerce woo-order-notes
WPCargo Track & Trace wpcargo
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More wpforms-lite
WPMobile.App — Android and iOS Mobile Application wpappninja
WP微信机器人 wp-weixin-robot
Wr Age Verification wr-age-verification
XML Multilanguage Sitemap Generator xml-multilanguage-sitemap-generator
XPD Reduce Image Filesize xpd-reduce-image-filesize
YDS Support Ticket System yds-support-ticket-system
Youtube Video Grid | Youmax youmax-channel-embeds-for-youtube-businesses
Zita Site Builder – Elementor, WordPress & Gutenberg Website Builder ai-site-builder
افزونه پیامک ووکامرس Persian WooCommerce SMS persian-woocommerce-sms
畅言评论系统 changyan

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Avada | Website Builder For WordPress & WooCommerce Avada
Bicycleshop bicycleshop
Brandy brandy
hmd hmd
Plain Post plain-post
TravelTour traveltour
Woffice CRM woffice
Woodmart woodmart

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Axeptio <= 2.5.3 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54270
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Axeptio – Cookie Banner – GDPR Consent & Compliance with a friendly touch
Researcher
More Details >

CE21 Suite <= 2.2.0 - Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54293
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
CE21 Suite
Researcher
More Details >

Code Generator Pro <= 1.2 - Unauthenticated SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-55978
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Code Generator Pro
Researcher
More Details >

CoSchool LMS <= 1.2 - Missing Authorization to Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54296
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
CoSchool LMS – A complete Learning Management System to Create and Sell Your Courses Online
Researcher
More Details >

Critical Site Intel <= 1.0 - Unauthenticated SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-55976
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
This is a Subversion repository; use the 'svnadmin' tool to examine
Researcher
More Details >

eTemplates <= 0.2.1 - Unauthenticated SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-55972
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
eTemplates
Researcher
More Details >

Firebase OTP Authentication <= 1.0.1 - Missing Authorization to Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54294
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Firebase OTP Authentication
Researcher
More Details >

ForumWP <= 2.1.0 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54367
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
ForumWP – Forum & Discussion Board
Researcher
More Details >

LaunchPage.app Importer <= 1.1 - Unauthenticated SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-55977
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
LaunchPage.app Importer
Researcher
More Details >

ListApp Mobile Manager <= 1.7.7 - Missing Authorization to Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54295
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
ListApp Mobile Manager
Researcher
More Details >

Mail Picker <= 1.0.14 - Unauthenticated PHP Object Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54273
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Newsletter, Email Marketing, Email Subscriber – Mail Picker
Researcher
More Details >

Nabz Image Gallery <= v1.00 - Unauthenticated SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-55981
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Nabz Image Gallery
Researcher
More Details >

Navayan CSV Export <= 1.0.9 - Unauthenticated SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-55988
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Navayan CSV Export
Researcher
More Details >

Projectopia <= 5.1.7 - Missing Authorization to Privilege Escalation via pto_reset_password()

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54336
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Projectopia – WordPress Project Management
Researcher
More Details >

Share Buttons – Social Media <= 1.0.2 - Unauthenticated SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-55982
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Share Buttons – Social Media
Researcher
More Details >

Sign In With Google <= 1.8.0 - Authentication Bypass in authenticate_user

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-11015
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Sign In With Google
Researcher
More Details >

Sogrid <= 1.5.6 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54374
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WordPress Post Grid Layouts with Pagination – Sogrid
Researcher
More Details >

Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-9290
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Super Backup & Clone - Migrate for WordPress
Researcher
More Details >

Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10124
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce
Researcher
More Details >

vBSSO-lite <= 1.4.3 - Missing Authorization to Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54297
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
vBSSO-lite
Researcher
More Details >

Woffice <= 5.4.14 - Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-43234
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
Woffice CRM
Researcher
More Details >

WooCommerce PDF Vouchers < 4.9.9 - Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54383
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WooCommerce - PDF Vouchers
Researcher
More Details >

Woolook <= 1.7.0 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54375
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Woocommerce Blocks – Woolook
Researcher
More Details >

WP Cookies Enabler <= 1.0.1 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54380
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
WP Cookies Enabler
Researcher
More Details >

Wp NssUser Register <= 1.0.0 - Unauthenticated Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54363
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Wp NssUser Register
Researcher
More Details >

Zita Site Builder <= 1.0.2 - Missing Authorization to Arbitrary Plugin Installation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-54369
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Zita Site Builder – Elementor, WordPress & Gutenberg Website Builder
Researcher
More Details >

Advanced What should we write next about <= 1.0.3 - Authenticated (Subscriber+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-55987
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Advanced What should we write next about
Researcher
More Details >

de:branding <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-11443
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
de:branding
Researcher
More Details >

Dr Affiliate <= 1.2.3 - Authenticated (Subscriber+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-55975
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Dr Affiliate
Researcher
More Details >

EazyDocs <= 2.5.6 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-54376
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin
Researcher
More Details >

EduAdmin Booking <= 5.2.0 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-54373
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
EduAdmin Booking
Researcher
More Details >

Flash News / Post (Responsive) <= 4.1 - Cross-Site Request Forgery to Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-56012
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Flash News / Post (Responsive)
Researcher
More Details >

FULL Customer <= 3.1.25 - Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-54313
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
FULL – Cliente
Researcher
More Details >

GitSync <= 1.1.0 - Cross-Site Request Forgery to Remote Code Execution

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-54368
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
GitSync
Researcher
More Details >

HQ Rental Software <= 1.5.29 - Cross-Site Request Forgery to Arbitrary Options Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-11689
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
HQ Rental Software
Researcher
More Details >

Insertify <= 1.1.4 - Cross-Site Request Forgery to Remote Code Execution

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-54372
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Insertify – Ad,HTML,CSS,JS,PHP,PDF,Header & Footer
Researcher
More Details >

KH Easy User Settings <= 1.0.0 - Authenticated (Subscriber+) Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-54365
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
KH Easy User Settings
Researcher
More Details >

Mimoos <= 1.2 - Authenticated (Subscriber+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-55974
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Mimoos
Researcher
More Details >

Minterpress <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-54379
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Minterpress
Researcher
More Details >

Opt-In Downloads <= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-10590
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Opt-In Downloads
Researcher
More Details >

PowerFormBuilder <= 1.0.6 - Authenticated (Subscriber+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-55983
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
PowerFormBuilder – Contact Form Database Manager for WordPress
Researcher
More Details >

Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-12040
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Product Carousel Slider & Grid Ultimate for WooCommerce
Researcher
More Details >

Quietly Insights <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-54378
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Quietly Insights
Researcher
More Details >

Saksh Escrow System <= 2.4 - Authenticated (Subscriber+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-55984
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Saksh Escrow System
Researcher
More Details >

Service <= 1.0.4 - Authenticated (Subscriber+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-55986
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Service
Researcher
More Details >

Sogrid <= 1.5.2 - Cross-Site Request Forgery to Arbitrary Options Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-54352
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WordPress Post Grid Layouts with Pagination – Sogrid
Researcher
More Details >

Video & Photo Gallery for Ultimate Member <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-54370
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Video & Photo Gallery for Ultimate Member
Researcher
More Details >

Wovax IDX <= 1.2.2 - Missing Authorization to Privilege Escalation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-56013
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Wovax IDX
Researcher
More Details >

WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

8.5
CVSS Rating
High (8.5)
CVE-ID
CVE-2024-11205
Patch Status
Patched
Published
Dec 9, 2024
Affected Software
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
Researcher
More Details >

Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-11721
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Frontend Admin by DynamiApps
Researcher
More Details >

MainWP Child <= 5.2 - Missing Authorization to Unauthenticated Privilege Escalation

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-10783
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
Researcher
More Details >

OAuth Single Sign On – SSO (OAuth Client) <= 6.26.3 - Authentication Bypass

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-10111
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
OAuth Single Sign On – SSO (OAuth Client)
Researcher
More Details >

Print Science Designer <= 1.3.152 - Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-12312
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Print Science Designer
Researcher
More Details >

Best WordPress Gallery Plugin – FooGallery <= 2.4.16 - Authenticated (Contributor+) Directory Traversal

7.7
CVSS Rating
High (7.7)
CVE-ID
CVE-2023-6947
Patch Status
Patched
Published
Dec 9, 2024
Affected Software
FooGallery Premium
Researcher
More Details >

Appsplate <= 2.1.3 - Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-54292
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Appsplate
Researcher
More Details >

Instant Appointment <= 1.2 - Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-54361
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Instant Appointment
Researcher
More Details >

WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Update

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-12172
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
Researcher
More Details >

WP Job Portal <= 2.2.1 - Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-11711
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Researcher
More Details >

WPBookit <= 1.6.0 - Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-54280
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
WPBookit
Researcher
More Details >

Wr Age Verification <= 2.0.0 - Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-55980
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Wr Age Verification
Researcher
More Details >

Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.5 - Unauthenticated Arbitrary Shortcode Execution via woot_get_smth

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-10959
Patch Status
Patched
Published
Dec 9, 2024
Affected Software
Active Products Tables for WooCommerce. Use constructor to create tables 
Researcher
More Details >

Grid Plus – Unlimited grid layout <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via grid_plus_load_by_category

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-10910
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Grid Plus – Unlimited grid layout
Researcher
More Details >

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-10646
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
Researcher
More Details >

Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-9698
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Crafthemes Demo Import
Researcher
More Details >

Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-11720
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Frontend Admin by DynamiApps
Researcher
More Details >

Hurrakify <= 2.4 - Unauthenticated Server-Side Request Forgery

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-54330
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Hurrakify
Researcher
More Details >

Mollie for Contact Form 7 <= 5.0.0 - Authenticated (Administrator+) SQL Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-55990
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Mollie for Contact Form 7
Researcher
More Details >

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-11052
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Ninja Forms – The Contact Form Builder That Grows With You
Researcher
More Details >

Radio Player <= 2.0.82 - Unauthenticated Server-Side Request Forgery

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-54385
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress
Researcher
More Details >

SeedProd Pro <= 6.18.10 - Authenticated (Editor+) Remote Code Execution

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-54285
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
SeedProd Pro
Researcher
More Details >

Spreadr Woocommerce <= 1.0.4 - Missing Authorization to Arbitrary Content Deletion

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-56008
Patch Status
Patched
Published
Dec 14, 2024
Affected Software
Spreadr Woocommerce Plugin – Amazon Importer for Dropshipping and Affiliate
Researcher
More Details >

WP Mega Menu <= 1.4.2 - Authenticated (Administrator+) PHP Object Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-54282
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
WP Mega Menu
Researcher
More Details >

WP Simple Pay Lite Manager <= 1.4 - Authenticated (Administrator+) SQL Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-55989
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
WP Simple Pay Lite Manager
Researcher
More Details >

Gaxx Keywords <= 0.2 - Cross-Site Request Forgery to Cross-Site Scripting

7.1
CVSS Rating
High (7.1)
CVE-ID
CVE-2024-54438
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Gaxx Keywords
Researcher
More Details >

RapidLoad – Optimize Web Vitals Automatically <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification and SQL Injection

7.1
CVSS Rating
High (7.1)
CVE-ID
CVE-2024-11840
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
RapidLoad – Optimize Web Vitals Automatically
Researcher
More Details >

Coupon Affiliates – Affiliate Plugin for WooCommerce <= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-12421
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Coupon Affiliates – Affiliate Plugin for WooCommerce
Researcher
More Details >

Hive Support – WordPress Help Desk <= 1.1.2 - Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-54304
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress
Researcher
More Details >

Library Management System <= 3.0.0 - Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-12406
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Library Management System – Manage e-Digital Books Library
Researcher
More Details >

Responsive Filterable Portfolio <=1.0.8 - Authenticated (Admin+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2019-25221
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Responsive Filterable Portfolio
Researcher
More Details >

Simple Link Directory <= 8.4.0 - Unauthenticated Arbitrary Shortcode Execution

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-12417
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Simple Link Directory
Researcher
More Details >

Spreadr Woocommerce <= 1.0.4 - Missing Authorization

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-56009
Patch Status
Patched
Published
Dec 14, 2024
Affected Software
Spreadr Woocommerce Plugin – Amazon Importer for Dropshipping and Affiliate
Researcher
More Details >

SQL Chart Builder <= 2.3.7.1 - Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-11430
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
SQL Chart Builder
Researcher
More Details >

TSB Occasion Editor <= 1.2.1 - Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-55973
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
TSB Occasion Editor
Researcher
More Details >

WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-12333
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Woodmart
Researcher
More Details >

WPMobile.App — Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-12420
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
WPMobile.App — Android and iOS Mobile Application
Researcher
More Details >

Wr Age Verification <= 2.0.0 - Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-55979
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Wr Age Verification
Researcher
More Details >

YDS Support Ticket System <= 1.0 - Authenticated (Subscriber+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-55985
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
YDS Support Ticket System
Researcher
More Details >

Add infos to the events calendar <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11875
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Add infos to The Events Calendar
Researcher
More Details >

Advanced Blog Post Block <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54287
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Advanced Blog Post Block
Researcher
Gab
More Details >

Advanced Data Table For Elementor <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54443
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Advanced Data Table For Elementor
Researcher
More Details >

Arena.IM – Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11384
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Arena.IM – Live Blogging for real-time events
Researcher
More Details >

Arena.IM – Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via arena_embed_amp Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12463
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Arena.IM – Live Blogging for real-time events
Researcher
More Details >

Beaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11832
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Beaver Builder – WordPress Page Builder
Researcher
More Details >

Bicycleshop <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54345
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Bicycleshop
Researcher
More Details >

Booking System Trafft <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11754
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Booking System Trafft
Researcher
More Details >

Brand <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54348
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Brandy
Researcher
More Details >

Buk for WordPress <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11869
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Buk for WordPress
Researcher
More Details >

Bukza <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11759
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Bukza
Researcher
More Details >

Catch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11427
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Catch Popup
Researcher
More Details >

Cognito Forms <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10182
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Cognito Forms
Researcher
More Details >

Companion Portfolio – Responsive Portfolio Plugin <= 2.4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11867
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Companion Portfolio – Responsive Portfolio Plugin
Researcher
More Details >

Connatix Video Embed <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11883
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Connatix Video Embed
Researcher
More Details >

Cricket Live Score <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11877
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Cricket Live Score
Researcher
More Details >

Currency Converter Widget ⚡ PRO <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11760
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Currency Converter Widget ⚡ PRO
Researcher
More Details >

Email Reminders <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11945
Patch Status
Patched
Published
Dec 9, 2024
Affected Software
Email Reminders
Researcher
More Details >

Eveeno <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11752
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Eveeno
Researcher
More Details >

Events Addon for Elementor <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54315
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Events Addon for Elementor
Researcher
More Details >

FAQ And Answers – Create Frequently Asked Questions Area on WP Sites <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11882
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
FAQ And Answers – Create Frequently Asked Questions Area on WP Sites
Researcher
More Details >

Ganohrs Toggle Shortcode <= 0.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12459
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Ganohrs Toggle Shortcode
Researcher
More Details >

GeoDataSource Country Region DropDown <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12474
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
GeoDataSource Country Region DropDown
Researcher
More Details >

glomex oEmbed <= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11873
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
glomex oEmbed
Researcher
More Details >

Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11914
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Gutenberg Blocks and Page Layouts – Attire Blocks
Researcher
More Details >

Gutensee <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54360
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Gutensee
Researcher
Gab
More Details >

Hello Event Widgets For Elementor <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54338
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Hello Event Widgets For Elementor
Researcher
Gab
More Details >

Horizontal scroll image slideshow <= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11442
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Horizontal scroll image slideshow
Researcher
More Details >

HostFact bestelformulier integratie <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11413
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
HostFact bestelformulier integratie
Researcher
More Details >

iChart – Easy Charts and Graphs <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11928
Patch Status
Patched
Published
Dec 9, 2024
Affected Software
iChart – Easy Charts and Graphs
Researcher
More Details >

IDer Login for WordPress <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11888
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
IDer Login for WordPress
Researcher
More Details >

IMS Countdown <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11755
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
IMS Countdown
Researcher
More Details >

Integrate Firebase <= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11785
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Integrate Firebase
Researcher
More Details >

Koalendar – Events & Appointments Booking Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11855
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Koalendar – Events & Appointments Booking Calendar
Researcher
More Details >

Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site <= 1.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11876
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site
Researcher
More Details >

My IDX Home Search <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11889
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
My IDX Home Search
Researcher
More Details >

My IDX Home Search <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12502
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
My IDX Home Search
Researcher
More Details >

NewsmanApp <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11767
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
NewsmanApp
Researcher
More Details >

Nias course <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54277
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Nias course | دوره ساز نیاس
Researcher
Gab
More Details >

NiceJob <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54318
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
NiceJob
Researcher
More Details >

ONLYOFFICE DocSpace <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11750
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
ONLYOFFICE DocSpace
Researcher
More Details >

Out of the Block: OpenStreetMap <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ootb_query Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11827
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Out of the Block: OpenStreetMap
Researcher
More Details >

Perfect Font Awesome Integration <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11891
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Perfect Font Awesome Integration
Researcher
More Details >

Plain Post <= 1.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54349
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Plain Post
Researcher
More Details >

Plezi <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11763
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Plezi
Researcher
More Details >

Poll Builder <= 1.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54276
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Poll, Poll Forms – WordPress Poll plugin by Poll Builder
Researcher
More Details >

Post Carousel & Slider <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11770
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Post Carousel & Slider
Researcher
More Details >

Post to Pdf <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12446
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Post to Pdf
Researcher
More Details >

Posts and Products Views for WooCommerce <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12448
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Posts and Products Views for WooCommerce
Researcher
More Details >

PowerBI Embed Reports <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11901
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
PowerBI Embed Reports
Researcher
More Details >

Primary Addon for Elementor <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54314
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Primary Addon for Elementor
Researcher
More Details >

Property Hive Mortgage Calculator <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via price Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11940
Patch Status
Patched
Published
Dec 9, 2024
Affected Software
Property Hive Mortgage Calculator
Researcher
More Details >

Property Hive Stamp Duty Calculator <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12465
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Property Hive Stamp Duty Calculator
Researcher
More Details >

Quran Phrases About Most People Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54334
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Quran Phrases About Most People Shortcodes
Researcher
Gab
More Details >

Radius Blocks – WordPress Gutenberg Blocks <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54272
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Radius Blocks – WordPress Gutenberg Blocks
Researcher
Gab
More Details >

Responsive Google Maps | by imbaa <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-56011
Patch Status
Patched
Published
Dec 14, 2024
Affected Software
Responsive Google Maps | by imbaa
Researcher
More Details >

Restaurant & Cafe Addon for Elementor <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54316
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Restaurant & Cafe Addon for Elementor
Researcher
More Details >

Simple Locator <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12501
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Simple Locator
Researcher
More Details >

Smaily for WP <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54286
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Smaily for WP
Researcher
More Details >

Smart Agenda – Prise de rendez-vous en ligne <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11781
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Smart Agenda – Prise de rendez-vous en ligne
Researcher
More Details >

Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12458
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Smart PopUp Blaster
Researcher
More Details >

Social Media Shortcodes <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11871
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Social Media Shortcodes
Researcher
More Details >

States Map US <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12523
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
States Map US
Researcher
More Details >

Stripe Donation <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11879
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Stripe Donation
Researcher
More Details >

Surbma | SalesAutopilot Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11433
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Surbma | SalesAutopilot Shortcode
Researcher
More Details >

Tabs Maker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11865
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Tabs Maker
Researcher
More Details >

TCBD Popover <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11751
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
TCBD Popover
Researcher
More Details >

The Permalinker <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11894
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
The Permalinker
Researcher
More Details >

Tithe.ly Giving Button <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11841
Patch Status
Unpatched
Published
Dec 9, 2024
Affected Software
Tithe.ly Giving Button
Researcher
More Details >

Top and footer bars for announcements, notifications, advertisements, promotions – YooBar <= 2.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11410
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Top and footer bars for announcements, notifications, advertisements, promotions – YooBar
Researcher
More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10784
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher
More Details >

Utech World Time <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54441
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Utech World Time
Researcher
More Details >

Visualmodo Elements <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11095
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Visualmodo Elements
Researcher
More Details >

Web Stories <= 1.37.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-54317
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Web Stories
Researcher
More Details >

WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12517
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
WooCommerce Cart Count Shortcode
Researcher
More Details >

WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11766
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more
Researcher
More Details >

WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11765
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WordPress Portfolio Plugin – A Plugin for Making Filterable Portfolio Grid, Portfolio Slider and more
Researcher
More Details >

WP Crowdfunding <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11910
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
WP Crowdfunding
Researcher
More Details >

WP GeoNames <= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11757
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WP GeoNames
Researcher
More Details >

Wp photo text slider 50 <= 8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11884
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Wp photo text slider 50
Researcher
More Details >

WP-Revive Adserver <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-12461
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
WP-Revive Adserver
Researcher
More Details >

Notibar – Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text

6.3
CVSS Rating
Medium (6.3)
CVE-ID
CVE-2024-11012
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Notibar – Notification Bar for WordPress
Researcher
More Details >

3D Avatar User Profile <= 1.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54358
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
3D Avatar User Profile
Researcher
More Details >

addWeather <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54389
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
addWeather
Researcher
More Details >

Admin Customization <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54431
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Admin Customization
Researcher
More Details >

Advanced Fancybox <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54401
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Advanced Fancybox
Researcher
More Details >

AI Content Writer, RSS Feed to Post, Autoblogging SEO Help <= 6.1.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12156
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
AI Content Writer, RSS Feed to Post, Autoblogging SEO Help
Researcher
More Details >

Amazon Product Price <= 1.1 - Cross-Site Request Forgery to Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54439
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Amazon Product Price
Researcher
More Details >

Analytics Cat – Google Analytics Made Easy <= 1.1.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12072
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Analytics Cat – Google Analytics Made Easy
Researcher
More Details >

Aphorismus <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54429
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Aphorismus
Researcher
More Details >

AppMaps <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54400
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
AppMaps
Researcher
More Details >

Barcode Scanner with Inventory & Order Manager <= 1.6.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54265
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.
Researcher
More Details >

Bootstrap Buttons <= 1.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-49677
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Bootstrap Buttons
Researcher
More Details >

BP Email Assign Templates <= 1.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12441
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
BP Email Assign Templates
Researcher
More Details >

CarDealerPress <= 6.6.2410.02 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54325
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
CarDealerPress
Researcher
More Details >

Category of Posts <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54427
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Category of Posts
Researcher
More Details >

Check Pincode For Woocommerce <= 1.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54333
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Check Pincode For Woocommerce
Researcher
More Details >

CK and SyntaxHighlighter <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54407
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
CK and SyntaxHighlighter
Researcher
More Details >

CleverNode Related Content <= 1.1.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54329
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
CleverNode Related Content
Researcher
More Details >

Comments On Feed <= 1.2.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54406
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Comments On Feed
Researcher
More Details >

Country Blocker <= 3.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11459
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Country Blocker
Researcher
More Details >

CRUDLab Google Plus Button <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54399
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
CRUDLab Google Plus Button
Researcher
More Details >

CSV to html <= 3.04 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54275
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
CSV to html
Researcher
More Details >

dejure.org Vernetzungsfunktion <= 1.97.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11417
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
dejure.org Vernetzungsfunktion
Researcher
More Details >

Device Detector <= 4.2.0 - Reflected Cross-Site Scripting via id

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-56010
Patch Status
Patched
Published
Dec 14, 2024
Affected Software
Device Detector
Researcher
More Details >

Display Future Posts <= 0.2.3 - Cross-Site Request Forgery to Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54413
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Display Future Posts
Researcher
More Details >

DTC Documents <= 1.1.05 - Cross-Site Request Forgery

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54418
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
DTC Documents
Researcher
More Details >

DX Dark Site <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54337
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
DX Dark Site
Researcher
More Details >

ECT Product Carousel <= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54412
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
ECT Product Carousel
Researcher
More Details >

ECT Social Share <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54405
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
ECT Social Share
Researcher
More Details >

EELV Newsletter <= 4.8.2 - Cross-Site Request Forgery

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54430
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
EELV Newsletter
Researcher
More Details >

Evernote Sync <= 3.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54422
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Evernote Sync
Researcher
More Details >

Fancy Roller Scroller <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54351
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Fancy Roller Scroller
Researcher
More Details >

Feedpress Generator <= 1.2.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54364
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Feedpress Generator – External RSS Frontend Customizer
Researcher
More Details >

Filestack Official <= 2.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11462
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Filestack Official
Researcher
More Details >

Flaming Forms <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54398
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Flaming Forms
Researcher
More Details >

Floating Video Player <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54421
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Floating Video Player
Researcher(s): Unknown
More Details >

FloristPress <= 7.2.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54347
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
FloristPress – Customize your Woo store for your Florist
Researcher(s): Unknown
More Details >

FormFacade <= 1.3.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54301
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
FormFacade – WordPress plugin for Google Forms
Researcher
More Details >

GeoFlickr <= 1.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54339
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
GeoFlickr
Researcher
More Details >

Geoportail Shortcode <= 2.4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54414
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Geoportail Shortcode
Researcher
More Details >

Go Animate <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54397
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Go Animate
Researcher
More Details >

Hack-Info <= 3.17 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54353
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Hack-Info
Researcher
More Details >

Hello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12572
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Hello In All Languages
Researcher
More Details >

hmd <= 2.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54350
Patch Status
Patched
Published
Dec 14, 2024
Affected Software
hmd
Researcher
More Details >

I Plant A Tree <= 1.7.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54331
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
I Plant A Tree
Researcher
More Details >

ICDSoft Reseller Store <= 2.4.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54320
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
ICDSoft Reseller Store
Researcher
More Details >

ImageRecycle pdf & image compression <= 3.1.16 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54266
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
ImageRecycle pdf & image compression
Researcher
More Details >

ImmoToolBox Connect <= 1.3.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54335
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
ImmoToolBox Connect
Researcher
More Details >

Import Eventbrite Events <= 1.7.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12422
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Import Eventbrite Events
Researcher
More Details >

Increase Sociability <= 1.3.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54395
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Increase Sociability
Researcher
More Details >

Invoice Payment for WooCommerce <= 1.7.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54328
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Invoice Payment for WooCommerce
Researcher
More Details >

J&T Express Malaysia <= 2.0.13 - Reflected Cross-Site Scripting via [placeholder]

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54305
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
J&T Express Malaysia
Researcher
More Details >

jCarousel <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54437
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
jCarousel for WordPress
Researcher(s): Unknown
More Details >

Jet Footer Code <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54436
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Jet Footer Code
Researcher
More Details >

Kundgenerator <= 1.0.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54319
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Kundgenerator
Researcher
More Details >

kvCORE IDX <= 2.3.35 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11723
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
kvCORE IDX
Researcher
More Details >

LabelGrid Tools <= 1.3.58 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54341
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
LabelGrid Tools
Researcher
More Details >

LDD Directory Lite <= 3.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54288
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
LDD Directory Lite
Researcher
More Details >

LeaderBoard Plugin <= 1.2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54426
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
LeaderBoard Plugin
Researcher
More Details >

Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11359
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Library Bookshelves
Researcher
More Details >

Like in Vk.com <= 0.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54424
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Like in Vk.com
Researcher
More Details >

LionScripts: Site Maintenance & Noindex Nofollow Plugin <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54425
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
LionScripts: Site Maintenance & Noindex Nofollow Plugin
Researcher
More Details >

Mandrill WP <= 1.0.5 - Cross-Site Request Forgery

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54394
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Mandrill WP – Email Form Under Post
Researcher
More Details >

MDC Comment Toolbar <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54404
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
MDC Comment Toolbar
Researcher
More Details >

Media Downloader <= 0.4.7.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54322
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Media Downloader
Researcher
More Details >

Multiple Admin Emails <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54388
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Multiple Admin Emails
Researcher
More Details >

MyParcel <= 4.24.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9608
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
MyParcel
Researcher
More Details >

Newsletter Subscriptions <= 2.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11683
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Newsletter Subscriptions
Researcher
More Details >

Onlywire Multi Autosubmitter <= 1.2.4 - Cross-Site Request Forgery to Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54435
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Onlywire Multi Autosubmitter
Researcher
More Details >

Password for WP <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11419
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Password for WP
Researcher
More Details >

Persian Woocommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54312
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
افزونه پیامک ووکامرس Persian WooCommerce SMS
Researcher
More Details >

phZoom <= 1.2.92 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54434
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
phZoom Plugin for WordPress
Researcher
More Details >

Planaday API <= 11.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11804
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Planaday API
Researcher
More Details >

Posts Date Ranges <= 2.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54387
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Posts Date Ranges
Researcher
More Details >

Primer MyData for Woocommerce <= 4.2.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11809
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Primer MyData for Woocommerce
Researcher
More Details >

Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart <= 3.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54386
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart
Researcher
More Details >

Quran multilanguage Text & Audio <= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang Parameters

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11973
Patch Status
Patched
Published
Dec 9, 2024
Affected Software
Quran multilanguage Text & Audio
Researcher
More Details >

Revi.io <= 5.7.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54299
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Revi.io – Customer & Products Reviews
Researcher
More Details >

Role Includer <= 1.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54290
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Role Includer
Researcher
More Details >

Schema App Structured Data <= 2.2.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11279
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Schema App Structured Data
Researcher
More Details >

Seraphinite Bulk Discounts for WooCommerce <= 2.4.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12160
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Seraphinite Bulk Discounts for WooCommerce
Researcher
More Details >

Simple Booking Widget <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54433
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Simple Booking – Widget
Researcher
More Details >

Simple Payment <= 2.3.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54303
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Simple Payment
Researcher
More Details >

Simple Presenter <= 1.5.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54340
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Simple Presenter
Researcher
More Details >

SIP Calculator <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12555
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
SIP Calculator
Researcher
More Details >

SMSify <= 6.0.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54324
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
SMSify
Researcher
More Details >

Social Media Sharing <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54423
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Social Media Sharing
Researcher
More Details >

SOPA Blackout <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54410
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
SOPA Blackout
Researcher
More Details >

Staggs Product Configurator for WooCommerce <= 2.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54342
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Staggs – Product Configurator Toolkit
Researcher
More Details >

TagGator <= 1.54 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54390
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
TagGator
Researcher
More Details >

Travel Tour < 5.2.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11846
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
TravelTour
Researcher
More Details >

turboSMTP <= 4.6 - Reflected Cross-Site Scripting via 'page'

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12323
Patch Status
Patched
Published
Dec 9, 2024
Affected Software
turboSMTP
Researcher
More Details >

Ui Slider Filter By Price <= 1.1 - Cross-Site Request Forgery

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54419
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Ui Slider Filter By Price
Researcher
More Details >

Ultimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12260
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Ultimate Endpoints With Rest Api
Researcher
More Details >

UNIVERSAM < 8.59 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54327
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
UNIVERSAM
Researcher
More Details >

VForm <= 3.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54302
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Lifetime free Drag & Drop Contact Form Builder for WordPress VForm
Researcher
More Details >

Video & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12162
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Video & Photo Gallery for Ultimate Member
Researcher
More Details >

Visual Recent Posts <= 1.2.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54403
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Visual Recent Posts
Researcher
More Details >

Waymark <= 1.4.1 - Reflected Cross-Site Scripting via 'content'

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12325
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
Waymark
Researcher
More Details >

Website Toolbox Community <= 2.0.1 - Reflected Cross-Site Scripting via websitetoolbox_username

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12338
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Website Toolbox Community
Researcher
More Details >

WordPress Filter <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54391
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
WordPress Filter
Researcher
More Details >

WordPress HelpDesk & Support Ticket System Plugin – Octrace Support <= 1.2.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54274
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
WordPress HelpDesk & Support Ticket System Plugin – Octrace Support
Researcher
More Details >

WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More <= 2.5.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12411
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More
Researcher
More Details >

WP Controller <= 3.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54411
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
WP Controller
Researcher
More Details >

WP Currency Exchange Rates <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54332
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WP Currency Exchange Rates
Researcher
More Details >

WP Fiddle <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54393
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
WP Fiddle
Researcher
More Details >

WP Flipkart Importer <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54432
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
WP Flipkart Importer
Researcher
More Details >

WP Log Action <= 0.51 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
Unknown
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
WP Log Action
Researcher(s): Unknown
More Details >

Wp Login with Ajax <= 0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54416
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Wp Login with Ajax
Researcher
More Details >

WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12283
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
WP Pipes
Researcher
More Details >

WP Quick Shop <= 1.3.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54344
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WP Quick Shop
Researcher
More Details >

WP Service Payment Form With Authorize.net <= 2.6.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12258
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
WP Service Payment Form With Authorize.net
Researcher
More Details >

WP-Ban-User <= 1.0 - Cross-Site Request Forgery to Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54440
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
WP-Ban-User
Researcher
More Details >

WP-HideThat <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54415
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
WP-HideThat
Researcher
More Details >

WPC Order Notes for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-12004
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
WPC Order Notes for WooCommerce
Researcher
More Details >

WP微信机器人 <= 5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54392
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
WP微信机器人
Researcher
More Details >

XPD Reduce Image Filesize <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-54409
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
XPD Reduce Image Filesize
Researcher
More Details >

Car Dealer <= 4.46 - Missing Authorization

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-54298
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Car Dealer (Dealership) and Vehicle sales
Researcher
More Details >

GEO my WordPress <= 4.5.0.4 - Missing Authorization via get_field_options_ajax

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-54326
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
GEO my WP
Researcher
More Details >

Metrika <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-54420
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Metrika
Researcher
More Details >

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-12042
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
MStore API – Create Native Android & iOS Apps On The Cloud
Researcher
More Details >

Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-10583
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder
Researcher
More Details >

SVG Shortcode <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-12574
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
SVG Shortcode
Researcher
More Details >

Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-12255
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Accept Stripe Payments Using Contact Form 7
Researcher
More Details >

Banner System <= 1.0.0 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-54359
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Banner System
Researcher
More Details >

Dreamfox Media Payment gateway per Product for Woocommerce <= 3.5.6 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-55996
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Payment Gateway Per Product for WooCommerce
Researcher
More Details >

Gou Manage My Account Menu <= 1.0.1.8 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-54310
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Gou Manage My Account Menu – User Roles
Researcher
More Details >

Job Board Manager <= 2.1.60 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-55993
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Job Board Manager
Researcher
More Details >

Ksher <= 1.1.1 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-56001
Patch Status
Patched
Published
Dec 14, 2024
Affected Software
Ksher
Researcher
More Details >

Last Viewed Posts by WPBeginner <= 1.0.1 - Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-12294
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
Last Viewed Posts by WPBeginner
Researcher
More Details >

LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-11868
Patch Status
Patched
Published
Dec 9, 2024
Affected Software
LearnPress – WordPress LMS Plugin
Researcher
More Details >

Members <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-11008
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
Members – Membership & User Role Editor Plugin
Researcher
More Details >

Minify HTML <= 2.1.10 - - Regular Expressions Denial of Service

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-12579
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Minify HTML
Researcher
More Details >

Order Delivery & Pickup Location Date Time ( Free Version ) <= 1.1.0 - Missing Authorization to Unauthenticated Settings Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-55997
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Order Delivery & Pickup Location Date Time ( Free Version )
Researcher
More Details >

PixProof <= 2.0.1 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-54417
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
PixProof – Easy Photo Proofing for Photographers
Researcher
More Details >

Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-12309
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Rate My Post – Star Rating Plugin by FeedbackWP
Researcher
More Details >

Restrict – membership, site, content and user access restrictions for WordPress <= 2.2.8 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-11351
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
Restrict – membership, site, content and user access restrictions for WordPress
Researcher
More Details >

Simple Restrict <= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-11106
Patch Status
Patched
Published
Dec 9, 2024
Affected Software
Simple Restrict
Researcher
More Details >

Tickera – WordPress Event Ticketing <= 3.5.4.8 - Unauthenticated Customer Data Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-12578
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Tickera – WordPress Event Ticketing
Researcher
More Details >

Vimeography <= 2.4.4 - Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-54366
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Vimeography: Vimeo Video Gallery WordPress Plugin
Researcher(s): Unknown
More Details >

Web3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-12265
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Web3 Crypto Payments by DePay for WooCommerce
Researcher
More Details >

WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-11712
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Researcher
More Details >

WP-NERD Toolkit <= 1.1 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-54279
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
WP-NERD Toolkit
Researcher
More Details >

XML Multilanguage Sitemap Generator <= 2.0.6 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-55999
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
XML Multilanguage Sitemap Generator
Researcher
More Details >

SeedProd Pro <= 6.18.10 - Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-54284
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
SeedProd Pro
Researcher
More Details >

SeedProd Pro <= 6.18.10 - Authenticated (Editor+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-54283
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
SeedProd Pro
Researcher
More Details >

WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-11710
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Researcher
More Details >

WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via getFieldsForVisibleCombobox()

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-11714
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Researcher
More Details >

WP Job Portal <= 2.2.2 - Authenticated (Admin+) SQL Injection via wpjobportal_deactivate()

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-11713
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Researchers
More Details >

WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation

4.8
CVSS Rating
Medium (4.8)
CVE-ID
CVE-2024-11715
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
WP Job Portal – A Complete Recruitment System for Company or Job Board website
Researcher
More Details >

360 Javascript Viewer <= 1.7.29 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-12271
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
360 Javascript Viewer
Researcher
More Details >

Better WP Login Page <= 1.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-54442
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Better WP Login Page
Researcher
More Details >

bodi0’s Easy Cache <= 0.8 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-12628
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
bodi0`s Easy cache
Researcher
More Details >

Cryptocurrency Price Widget <= 1.2.3 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-54308
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Cryptocurrency Price Widget
Researcher
More Details >

NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-11727
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
NotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar
Researcher
More Details >

Add image to Post <= 0.6 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54428
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Add image to Post
Researcher
More Details >

Advance Menu Manager <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54381
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Advance Menu Manager
Researcher
More Details >

AI Post Generator | AutoWriter <= 3.5 - Missing Authorization to Authenticated (Contributor+) Post/Page Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11709
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
AI Post Generator | AutoWriter
Researcher
More Details >

AIcomments <= 1.4.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54307
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
AIcomments – комментарии и отзывы ChatGPT
Researcher
More Details >

AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot <= 1.6.2 - Cross-Site Request Forgery via update_integration_option

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54306
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot
Researcher
More Details >

Arabic Webfonts <= 1.4.6 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54402
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Arabic Webfonts
Researcher
More Details >

Arena.IM – Live Blogging for real-time events <= 0.3.0 - Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-12526
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Arena.IM – Live Blogging for real-time events
Researcher
More Details >

AutoWP <= 2.0.8 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54300
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
AutoWP – AI Content Writer & Rewriter
Researcher
More Details >

Avada <= 7.11.10 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54357
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Avada | Website Builder For WordPress & WooCommerce
Researcher
More Details >

Awesome Support <= 6.3.0 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54289
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Awesome Support – WordPress HelpDesk & Support Plugin
Researcher
More Details >

Bet sport Free <= 1.0.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54396
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Bet sport Free
Researcher
More Details >

Caldera SMTP Mailer <= 1.0.1 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-56003
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Caldera SMTP Mailer
Researcher
More Details >

Child Theme Creator by Orbisius <= 1.5.5 - Missing Authorization to Authenticated (Subscriber+) Cloud Snippet Update/Delete

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-12263
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Child Theme Creator by Orbisius
Researcher
More Details >

CM Answers <= 3.2.6 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54267
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
CM Answers – Powerful WordPress Forum Plugin
Researcher
More Details >

Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist Script

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11724
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent
Researcher
More Details >

Custom Skins Contact Form 7 <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Creation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-12341
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
Custom Skins Contact Form 7
Researcher
More Details >

Easy Site Importer <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-56004
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Easy Site Importer
Researcher
More Details >

ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-12059
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
ElementInvader Addons for Elementor
Researcher
More Details >

Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-12329
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Essential Real Estate
Researcher
More Details >

Falcon – WordPress Optimizations & Tweaks <= 2.8.3 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54384
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Falcon – WordPress Optimizations & Tweaks
Researcher
More Details >

Get Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-12447
Patch Status
Unpatched
Published
Dec 13, 2024
Affected Software
Get Post Content Shortcode
Researcher
More Details >

Greenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11181
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Greenshift – animation and page builder blocks
Researcher
More Details >

Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-12201
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Hash Form – Drag & Drop Form Builder
Researcher
More Details >

Hive Support – WordPress Help Desk <= 1.1.2 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54321
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress
Researcher
More Details >

Leader <= 2.6.1 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-56007
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
Leader
Researcher
More Details >

Mark New Posts <= 7.5.1 - Missing Authorization via save_options

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54311
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Mark New Posts
Researcher
More Details >

New User Approve <= 2.6.2 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54323
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
New User Approve
Researcher
More Details >

News Ticker for Elementor <= 2.1.3 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54278
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
News Ticker for Elementor
Researcher
More Details >

Notibar <= 2.1.4 - Missing Authorization via ajax_install_plugin

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54269
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Notibar – Notification Bar for WordPress
Researcher
More Details >

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54356
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Online Booking & Scheduling Calendar for WordPress by vcita
Researcher
More Details >

PostBox <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Log Export

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54309
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WP Email Log – PostBox
Researcher
More Details >

Posti Shipping <= 3.10.3 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-56005
Patch Status
Patched
Published
Dec 14, 2024
Affected Software
Posti Shipping
Researcher
More Details >

Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10690
Patch Status
Patched
Published
Dec 13, 2024
Affected Software
Shortcodes for Elementor
Researcher
More Details >

SiteOrigin Widgets Bundle <= 1.64.0 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54268
Patch Status
Patched
Published
Dec 10, 2024
Affected Software
SiteOrigin Widgets Bundle
Researcher
More Details >

Snippet Shortcodes <= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-12018
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Snippet Shortcodes
Researcher
More Details >

Termin-Kalender <= 0.99.47 - Missing Authorization to Authenticated (Subscriber+)

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54354
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Termin-Kalender
Researcher
More Details >

Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-12414
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
Themify Store Locator
Researcher
More Details >

WooCommerce Basic Ordernumbers <= 1.4.4 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-55992
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
WooCommerce Basic Ordernumbers
Researcher
More Details >

WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11911
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
WP Crowdfunding
Researcher
More Details >

WP Mailster <= 1.8.17.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54355
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
WP Mailster
Researcher
More Details >

WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11275
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin
Researcher
More Details >

WPCargo Track & Trace <= 7.0.6 - Missing authorization to Authenticated (Subscriber+) Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54271
Patch Status
Unpatched
Published
Dec 11, 2024
Affected Software
WPCargo Track & Trace
Researcher
More Details >

Youtube Video Grid <= 1.9 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-54408
Patch Status
Unpatched
Published
Dec 12, 2024
Affected Software
Youtube Video Grid | Youmax
Researcher
More Details >

畅言评论系统 <= 2.0.5 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-55994
Patch Status
Unpatched
Published
Dec 14, 2024
Affected Software
畅言评论系统
Researcher
More Details >

AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload

3.7
CVSS Rating
Low (3.7)
CVE-ID
CVE-2024-12300
Patch Status
Patched
Published
Dec 12, 2024
Affected Software
AR for WordPress
Researcher
cc
More Details >

Bold Page Builder <= 5.1.5 - Authenticated (Editor+) Path Traversal

2.7
CVSS Rating
Low (2.7)
CVE-ID
CVE-2024-54382
Patch Status
Patched
Published
Dec 11, 2024
Affected Software
Bold Page Builder
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Trust Your Site
to the Leader in WordPress Security

Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.

Protect Your Site

Did you enjoy this post? Share it!

LinkedIn 

Comments

No Comments

All comments are moderated before being published. Inappropriate or off-topic comments may not be approved.

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.