Wordfence Intelligence Weekly WordPress Vulnerability Report (July 8, 2024 to July 14, 2024)

📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest. 

Last week, there were 225 vulnerabilities disclosed in 186 WordPress Plugins and 14 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 62 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 17,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 93
Unpatched 132

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 173
High Severity 32
Critical Severity 19

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 94
Missing Authorization 39
Cross-Site Request Forgery (CSRF) 29
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 12
Information Exposure 11
Unrestricted Upload of File with Dangerous Type 8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 6
Information Exposure Through Log Files 5
Server-Side Request Forgery (SSRF) 5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 4
Improper Privilege Management 3
Authentication Bypass Using an Alternate Path or Channel 2
Improper Control of Generation of Code ('Code Injection') 2
Authorization Bypass Through User-Controlled Key 1
Deserialization of Untrusted Data 1
File and Directory Information Exposure 1
Use of Hard-coded Credentials 1
Use of Less Trusted Source 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

18

15

14

13

13

12

10

9

7

7

6

6

6

5

4

4

4

4

4

3

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Academy LMS – eLearning and online course solution for WordPress academy
Admin Dashboard RSS Feed admin-dashboard-rss-feed
AdPush adsense-plugin
Advanced AJAX Page Loader advanced-ajax-page-loader
Advanced File Manager Shortcodes file-manager-advanced-shortcode
Advanced post slider advanced-post-slider
Amazing Hover Effects amazing-hover-effects
Animated Typed JS Shortcode animated-typed-js-shortcode
Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps appmaker-woocommerce-mobile-app-manager
Arkhe Blocks arkhe-blocks
Attachment File Icons (AF Icons) attachment-file-icons
Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail
Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. barcode-scanner-lite-pos-to-manage-products-inventory-and-orders
BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript searchpro
Blog, Posts and Category Filter for Elementor blog-posts-and-category-for-elementor
Booking Ultra Pro Appointments Booking Calendar Plugin booking-ultra-pro
Bradmax Player bradmax-player
Branda – White Label WordPress, Custom Login Page Customizer branda-white-labeling
Calendar.online / Kalender.digital – Plugin kalender-digital
Caxton – Create Pro page layouts in Gutenberg caxton
Change From Email wp-from-email
Cliengo – Chatbot cliengo
CodePen Embedded Pens Shortcode codepen-embedded-pen-shortcode
codoc codoc
Coming Soon Page – Responsive Coming Soon & Maintenance Mode responsive-coming-soon-page
Comment Images Reloaded comment-images-reloaded
ConeBlog – Elementor Blog Widgets coneblog-widgets
Contact Form 7 Summary and Print cf7-summary-and-print
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder bit-form
Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder arforms-form-builder
Default Thumbnail Plus default-thumbnail-plus
DirectoryPress – Business Directory And Classified Ad Listing directorypress
Download Button for Elementor download-button-for-elementor
Duplicator – Migration & Backup Plugin duplicator
Dynamic Word Spinner: CSS3 Animated Rotation css3-rotating-words
Easy Pixels easy-pixels-by-jevnet
EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin eazydocs
EleForms – All In One Form Integration including DB for Elementor all-contact-form-integration-for-elementor
ElementInvader Addons for Elementor elementinvader-addons-for-elementor
EmbedPress – Embed PDF, PDF 3D FlipBook, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor embedpress
Event post event-post
Event Tickets and Registration event-tickets
EventON eventon-lite
Events Calendar for Google events-calendar-for-google
ExS Widgets exs-widgets
Extensions for Elementor extensions-for-elementor
FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor post-block
Featured Image Generator featured-image-generator
Feeds for YouTube (YouTube video, channel, and gallery plugin) feeds-for-youtube
Form Vibes – Database Manager for Forms form-vibes
FormFlow: WhatsApp & Social Form Builder for Leads simple-form
FULL – Cliente full-customer
Fusion Page Builder fusion
GD Rating System gd-rating-system
Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7
Genesis Blocks genesis-blocks
Get Use APIs – JSON Content Importer json-content-importer
Goftino goftino
Google Adsense & Banner Ads by AdsforWP ads-for-wp
Gravity Forms: Multiple Form Instances gravity-forms-multiple-form-instances
Gum Elementor Addon gum-elementor-addon
Gutenberg Forms – WordPress Form Builder Plugin forms-gutenberg
HitPay Payment Gateway for WooCommerce hitpay-payment-gateway
Houzez CRM houzez-crm
Houzez Theme – Functionality houzez-theme-functionality
HT Mega – Absolute Addons For Elementor ht-mega-for-elementor
Image Optimizer, Resizer and CDN – Sirv sirv
Import Spreadsheets from Microsoft Excel import-spreadsheets-from-microsoft-excel
InstaWP Connect – 1-click WP Staging & Migration instawp-connect
Internal Link Juicer: SEO Auto Linker for WordPress internal-links
iPanorama 360 – WordPress Virtual Tour Builder ipanorama-360-virtual-tour-builder-lite
IQ Testimonials iq-testimonials
Job Board Manager job-board-manager
JSON API User json-api-user
Just Custom Fields just-custom-fields
Laposta laposta
LearnDash LMS – Reports wisdm-reports-for-learndash
Light Poll light-poll
Link Library link-library
Login by Auth0 auth0
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) magical-addons-for-elementor
Magical Posts Display – Elementor Advanced Posts widgets magical-posts-display
MakeStories (for Google Web Stories) makestories-helper
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor master-addons
Master Popups master-popups-lite
Matomo Analytics – Ethical Stats. Powerful Insights. matomo
MBE eShip mail-boxes-etc
Media Hygiene: Remove or Delete Unused Images and More! media-hygiene
Meks Smart Author Widget meks-smart-author-widget
Meks Video Importer meks-video-importer
Metorik – Reports & Email Automation for WooCommerce metorik-helper
Modern Events Calendar modern-events-calendar
Modern Events Calendar Lite modern-events-calendar-lite
Moloni moloni
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar mp3-music-player-by-sonaar
MStore API – Create Native Android & iOS Apps On The Cloud mstore-api
oik oik
Olive One Click Demo Import olive-one-click-demo-import
Openpos – WooCommerce Point Of Sale(POS) woocommerce-openpos
OSM – OpenStreetMap osm
Packlink PRO shipping module packlink-pro-shipping
Panda Video pandavideo
Payflex Payment Gateway payflex-payment-gateway
PayPlus Payment Gateway payplus-payment-gateway
Plugin Notes Plus plugin-notes-plus
Plum: Spin Wheel & Email Pop-up qodeblock
Post Layouts for Gutenberg post-layouts
Power BI Embedded for WordPress embed-power-bi
PowerPress Podcasting plugin by Blubrry powerpress
Predictive Search for WooCommerce woocommerce-predictive-search
Premium Addons for Elementor premium-addons-for-elementor
Pricing Table elfsight-pricing-table
Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite
Product Designer product-designer
Product Table by WBW woo-product-tables
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
Qi Blocks qi-blocks
Realtyna Organic IDX plugin + WPL Real Estate real-estate-listing-realtyna-wpl
ReCaptcha Integration for WordPress wp-recaptcha-integration
Recipe Cards For Your Food Blog from Zip Recipes zip-recipes
ReDi Restaurant Reservation redi-restaurant-reservation
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction pie-register
REVIEWS.io WooCommerce Plugin reviewscouk-for-woocommerce
ScrollTo Bottom scrollto-bottom
ScrollTo Top scrollto-top
SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue happy-scss-compiler
Search & Replace search-and-replace
Send Users Email send-users-email
Seraphinite Accelerator Pro seraphinite-accelerator-ext
Seraphinite Post .DOCX Source seraphinite-post-docx-source
Simple Alert Boxes simple-alert-boxes
Simple Popup Plugin simple-popup-plugin
Simple Post Notes simple-post-notes
Simple Responsive Slider simple-responsive-slider
SKT Addons for Elementor skt-addons-for-elementor
SKT Skill Bar skt-skill-bar
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) sky-elementor-addons
Slider Blocks – All in One Block Slider slider-blocks
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) slingblocks
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer smartcrawl-seo
Social Sharing Plugin – Kiwi kiwi-social-share
Spiffy Calendar spiffy-calendar
Squelch Tabs and Accordions Shortcodes squelch-tabs-and-accordions-shortcodes
Tabs For WPBakery Page Builder (formerly Visual Composer) tabs-for-visual-composer
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics taggbox-widget
Team Manager – WordPress Showcase Team Members wp-team-manager
Team Members team-members
Timeline Module for Beaver Builder timeline-for-beaver-builder
Titan Anti-spam & Security anti-spam
TOCHAT.BE tochat-be
Tutor LMS – eLearning and online course solution tutor
Typebot | Create advanced chat experiences without coding typebot
Ultimate Classified Listings ultimate-classified-listings
UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) ultraaddons-elementor-lite
Uncanny Automator Pro uncanny-automator-pro
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor
User Activity Log Pro user-activity-log-pro
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds userfeedback-lite
VK All in One Expansion Unit vk-all-in-one-expansion-unit
Wallet for WooCommerce woo-wallet
Wallet System for WooCommerce – Wallet, Digital Wallet, Cashback, Recharge User Wallets, Partial Payments, Wallet restriction, Refunds wallet-system-for-woocommerce
WappPress – Create Mobile App for any WordPress site with our Mobile App Builder in just 1 minute wapppress-builds-android-app-for-website
Webico Slider Flatsome Addons webico-slider-flatsome-addons
Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More woocommerce-wholesale-prices
WooCommerce Report ithemelandco-woo-report
WordPress Multisite Content Copier/Updater wp-multisite-content-copier
WP Accessibility Helper (WAH) wp-accessibility-helper
WP Announcement | Dynamic Announcement, Banner, & Countdown Timer for Effective Promotions sp-announcement
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting erp
WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into WordPress wp-event-aggregator
WP Fast Total Search – The Power of Indexed Search fulltext-search
WP GoToWebinar wp-gotowebinar
WP Links Page wp-links-page
WP Photo Album Plus wp-photo-album-plus
WP Popups – WordPress Popup builder wp-popups-lite
WP Total Branding – Complete branding solution for WordPress wp-total-branding
WP Travel Engine – Tour Booking Plugin – Tour Operator Software wp-travel-engine
WP User Switch wp-user-switch
WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 wp2speed
WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor
WPCS – WordPress Currency Switcher Professional currency-switcher
XPlainer – Product FAQ for WooCommerce & AI FAQ Generator faq-for-woocommerce
YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation
Zephyr Project Manager zephyr-project-manager
Zoho Campaigns zoho-campaigns
Zoho CRM Lead Magnet zoho-crm-forms

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
BuddyBoss Theme buddyboss-theme
Counterpoint counterpoint
i-amaze i-amaze
i-transform i-transform
Noo JobMonster noo-jobmonster
Oceanic oceanic
OnePress onepress
Patricia Blog patricia-blog
Patricia Lite patricia-lite
Point point
Popularis Verse popularis-verse
Responsive Mobile responsive-mobile
SmartMag smartmag-responsive-retina-wordpress-magazine
SociallyViral sociallyviral

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Woocommerce OpenPos <= 6.4.4 – Unauthenticated SQL Injection

10.0

CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-37933
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Openpos – WooCommerce Point Of Sale(POS)
Researcher

More Details >

DirectoryPress <= 3.6.10 – Authenticated (Contributor+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-38755
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
DirectoryPress – Business Directory And Classified Ad Listing
Researcher

More Details >

OSM – OpenStreetMap <= 6.0.2 – Authenticated (Contributor+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-3604
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
OSM – OpenStreetMap
Researcher

More Details >

PayPlus Payment Gateway <= 7.0.7 – Authenticated (Subscriber+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-37564
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
PayPlus Payment Gateway
Researcher

More Details >

Booking Ultra Pro <= 1.1.13 – Unauthenticated Local File Inclusion

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-38717
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Booking Ultra Pro Appointments Booking Calendar Plugin
Researcher

More Details >

Event post <= 5.9.5 – Unauthenticated Local File Inclusion

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-38735
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Event post
Researcher

More Details >

Gutenberg Forms <= 2.2.9 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6313
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Gutenberg Forms – WordPress Form Builder Plugin
Researcher

More Details >

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 – Authentication Bypass to Admin

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6397
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
InstaWP Connect – 1-click WP Staging & Migration
Researcher

More Details >

IQ Testimonials <= 2.2.7 – Unauthenticated Arbitrary File Upload

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6314
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
IQ Testimonials
Researcher

More Details >

Jobmonster <= 4.7.0 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-37927
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Noo JobMonster
Researcher

More Details >

JSON API User <= 3.9.3 – Unauthenticated Privilege Escalation

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6624
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
JSON API User
Researcher

More Details >

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 – Authentication Bypass

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6328
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
MStore API – Create Native Android & iOS Apps On The Cloud
Researcher

More Details >

Product Table by WBW <= 2.0.1 – Unauthenticated Remote Code Execution

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-6365
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Product Table by WBW
Researcher

More Details >

Search & Replace <= 3.2.2 – Unauthenticated PHP Object Injection

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-38759
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Search & Replace
Researcher

More Details >

Import Spreadsheets from Microsoft Excel <= 10.1.4 – Authenticated (Editor+) Arbitrary File Upload

9.1

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-38734
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Import Spreadsheets from Microsoft Excel
Researcher

More Details >

Jobmonster <= 4.7.0 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-37928
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Noo JobMonster
Researcher

More Details >

Realtyna Organic IDX plugin <= 4.14.13 – Authenticated (Admin+) Arbitrary File Upload

9.1

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-38736
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Realtyna Organic IDX plugin + WPL Real Estate
Researcher

More Details >

Spiffy Calendar <= 4.9.11 – Authenticated (Administrator+) SQL Injection

9.1

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-38692
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
Spiffy Calendar
Researcher

More Details >

Woocommerce OpenPos <= 6.4.4 – Unauthenticated Arbitrary File Deletion

9.1

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-37932
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Openpos – WooCommerce Point Of Sale(POS)
Researcher

More Details >

Advanced AJAX Page Loader <= 2.7.7 – Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6310
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Advanced AJAX Page Loader
Researcher

More Details >

Advanced File Manager Shortcode <= 2.5.3 – Authenticated (Contributor+) Arbitrary File Upload

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2023-7061
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Advanced File Manager Shortcodes
Researcher

More Details >

Advanced File Manager Shortcodes <= 2.4 – Authenticated (Contributor+) Directory Traversal

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2023-7062
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Advanced File Manager Shortcodes
Researcher

More Details >

Attachment File Icons (AF Icons) <= 1.3 – Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6309
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Attachment File Icons (AF Icons)
Researcher

More Details >

Default Thumbnail Plus <= 1.0.2.3 – Authenticated (Contributor+) Arbitrary File Upload

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6161
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Default Thumbnail Plus
Researcher

More Details >

Events Calendar for Google <= 2.1.0 – Authenticated (Contributor+) Local File Inclusion

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-38716
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Events Calendar for Google
Researcher

More Details >

ExS Widgets <= 0.3.1 – Authenticated (Contributor+) Local File Inclusion

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-38715
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
ExS Widgets
Researcher

More Details >

Form Vibes <= 1.4.10 – Authenticated (Subscriber+) SQL Injection via fv_export_data

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5325
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Form Vibes – Database Manager for Forms
Researcher

More Details >

GD Rating System <= 3.6 – Authenticated (Contributor+) Local File Inclusion

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-38709
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
GD Rating System
Researcher

More Details >

Generate PDF using Contact Form 7 <= 4.0.6 – Cross-Site Request Forgery to Arbitrary File Deletion

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6317
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Generate PDF using Contact Form 7
Researcher

More Details >

Generate PDF using Contact Form 7 <= 4.0.6 – Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6316
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Generate PDF using Contact Form 7
Researcher

More Details >

Houzez CRM <= 1.4.2 – Authenticated (Seller+) SQL Injection

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5792
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Houzez CRM
Researcher

More Details >

Houzez Theme – Functionality <= 3.2.2 – Authenticated (Seller+) SQL Injection

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5793
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Houzez Theme – Functionality
Researcher

More Details >

Modern Events Calendar <= 7.11.0 – Authenticated (Subscriber+) Arbitrary File Upload

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5441
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Modern Events Calendar
Modern Events Calendar Lite
Researcher

More Details >

Panda Video <= 1.4.0 – Authenticated (Contributor+) Local File Inclusion

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5456
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Panda Video
Researcher

More Details >

Pie Register – Basic <= 3.8.3.4 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation/Deactivation

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6069
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction
Researcher

More Details >

ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 – Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6411
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
ProfileGrid – User Profiles, Groups and Communities
Researchers

More Details >

ScrollTo Bottom <= 1.1.1 – Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6321
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
ScrollTo Bottom
Researcher

More Details >

ScrollTo Top <= 1.2.2 – Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6320
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
ScrollTo Top
Researcher

More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 – Authenticated (Contributor+) Time-Based SQL Injection

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6166
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher

More Details >

Wallet for WooCommerce <= 1.5.4 – Authenticated (Subscriber+) SQL Injection via 'search[value]'

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6353
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Wallet for WooCommerce
Researcher

More Details >

WordPress Team Manager <= 2.1.12 – Authenticated (Contributor+) Local File Inclusion

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-38704
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Team Manager – WordPress Showcase Team Members
Researcher

More Details >

WP ERP <= 1.13.0 – Authenticated (Accounting Manager+) SQL Injection via vendor_id

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-6666
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher

More Details >

WP User Switch <= 1.1.0 – Authenticated (Subscriber+) Privilege Escalation

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-37560
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
WP User Switch
Researcher

More Details >

Barcode Scanner with Inventory & Order Manager <= 1.6.1 – Authenticated (Subscriber+) SQL Injection

8.5

CVSS Rating
High (8.5)
CVE-ID
CVE-2024-38708
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.
Researcher

More Details >

BerqWP <= 1.7.5 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-37942
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript
Researcher

More Details >

Bit Form <= 2.13.3 – Authenticated (Administrator+) Arbitrary File Upload

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-6123
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder
Researcher

More Details >

Easy Pixels by JEVNET <= 2.13 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-5479
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Easy Pixels
Researcher

More Details >

EventON <= 2.2.15 – Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-6180
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
EventON
Researcher

More Details >

FULL <= 3.1.12 – Unauthenticated Stored Cross-Site Scripting via License Plan Parameter

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-6447
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
FULL – Cliente
Researcher

More Details >

TOCHAT.BE <= 1.3.0 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-37563
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
TOCHAT.BE
Researcher

More Details >

UserFeedback Lite <= 1.0.15 – Unauthenticated Stored Cross-Site Scripting via Name Parameter

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-5902
Patch Status
Patched
Published
Jul 12, 2024

Affected Software
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
Researcher

More Details >

Cliengo – Chatbot <= 3.0.1 – Missing Authorization to Unauthenticated Chatbot Settings Update

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-5992
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Cliengo – Chatbot
Researcher

More Details >

WPCS <= 1.2.0.3 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-38700
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
WPCS – WordPress Currency Switcher Professional
Researcher

More Details >

Advanced post slider <= 3.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38750
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Advanced post slider
Researcher

More Details >

Amazing Hover Effects <= 2.4.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38741
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Amazing Hover Effects
Researcher

More Details >

Animated Typed JS Shortcode <= 2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38679
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Animated Typed JS Shortcode
Researcher(s): Unknown

More Details >

Arkhe Blocks <= 2.22.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38675
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Arkhe Blocks
Researcher

More Details >

Blog, Posts and Category Filter for Elementor <= 1.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4667
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Blog, Posts and Category Filter for Elementor
Researcher

More Details >

Booking Ultra Pro <= 1.1.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38676
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Booking Ultra Pro Appointments Booking Calendar Plugin
Researcher

More Details >

Bradmax Player <= 1.1.27 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37957
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Bradmax Player
Researcher

More Details >

Calendar.online / Kalender.digital <= 1.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38678
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Calendar.online / Kalender.digital – Plugin
Researcher

More Details >

Caxton – Create Pro page layouts in Gutenberg <= 1.30.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37948
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Caxton – Create Pro page layouts in Gutenberg
Researcher

More Details >

CodePen Embedded Pens Shortcode <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37960
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
CodePen Embedded Pens Shortcode
Researcher

More Details >

ConeBlog – WordPress Blog Widgets <= 1.4.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37918
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
ConeBlog – Elementor Blog Widgets
Researcher

More Details >

Download Button for Elementor <= 1.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38718
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Download Button for Elementor
Researcher

More Details >

EazyDocs <= 2.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38720
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin
Researcher

More Details >

ElementInvader Addons for Elementor <= 1.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38705
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
ElementInvader Addons for Elementor
Researcher

More Details >

Extensions for Elementor <= 2.0.31 – Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4868
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Extensions for Elementor
Researcher

More Details >

FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 5.3.1 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38686
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor
Researcher

More Details >

Feeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6256
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
Feeds for YouTube (YouTube video, channel, and gallery plugin)
Researcher

More Details >

Fusion <= 1.6.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37962
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Fusion Page Builder
Researcher

More Details >

Genesis Blocks <= 3.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3563
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Genesis Blocks
Researcher

More Details >

Goftino <= 1.6 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38697
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Goftino
Researcher

More Details >

GutSlider – All in One Block Slider <= 2.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37955
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Slider Blocks – All in One Block Slider
Researcher

More Details >

Job Board Manager <= 2.1.57 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38722
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Job Board Manager
Researchers

More Details >

JSON Content Importer <= 1.5.6 – Authenticated (Contributor+) Server-Side Request Forgery

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38723
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Get Use APIs – JSON Content Importer
Researcher

More Details >

Magical Addons For Elementor <= 1.1.41 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38681
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )
Researcher

More Details >

Magical Addons For Elementor <= 1.1.41 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38730
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )
Researcher

More Details >

Magical Posts Display – Elementor & Gutenberg Posts Blocks <= 1.2.38 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37951
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Magical Posts Display – Elementor Advanced Posts widgets
Researcher

More Details >

Master Addons for Elementor <= 2.0.6.2 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38710
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Researcher

More Details >

Meks Smart Author Widget <= 1.1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37958
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Meks Smart Author Widget
Researcher

More Details >

MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5664
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
Researcher

More Details >

oik <= 4.10.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6391
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
oik
Researcher

More Details >

OnePress <= 2.3.8 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38739
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
OnePress
Researcher

More Details >

OSM – OpenStreetMap <= 6.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3603
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
OSM – OpenStreetMap
Researcher

More Details >

Panda Video <= 1.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5457
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Panda Video
Researcher

More Details >

Post Layouts for Gutenberg <= 1.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38682
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Post Layouts for Gutenberg
Researcher

More Details >

Power BI Embedded for WordPress <= 1.1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37959
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Power BI Embedded for WordPress
Researcher

More Details >

PowerPress Podcasting plugin by Blubrry <= 11.9.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6588
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
PowerPress Podcasting plugin by Blubrry
Researcher

More Details >

Premium Addons for Elementor <= 4.10.36 – Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Animated Text Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6495
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Premium Addons for Elementor
Researcher

More Details >

Qi Blocks <= 1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38712
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Qi Blocks
Researcher

More Details >

Responsive Mobile <= 1.15.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37949
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Responsive Mobile
Researcher

More Details >

REVIEWS.io <= 1.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38677
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
REVIEWS.io WooCommerce Plugin
Researcher

More Details >

Seraphinite Post .DOCX Source <= 2.16.9 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38728
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Seraphinite Post .DOCX Source
Researcher

More Details >

Simple Alert Boxes <= 1.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5937
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Simple Alert Boxes
Researcher

More Details >

SKT Addons for Elementor <= 2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38674
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
SKT Addons for Elementor
Researcher

More Details >

SKT Skill Bar <= 2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38698
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
SKT Skill Bar
Researcher

More Details >

Sky Addons for Elementor <= 2.5.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38687
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs)
Researcher

More Details >

SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38684
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)
Researcher

More Details >

Squelch Tabs and Accordions Shortcodes <= 0.4.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via tab Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5946
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Squelch Tabs and Accordions Shortcodes
Researcher

More Details >

Tabs For WPBakery Page Builder <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37936
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Tabs For WPBakery Page Builder (formerly Visual Composer)
Researcher

More Details >

Team Members <= 5.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38670
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
Team Members
Researcher

More Details >

Typebot <= 3.6.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38757
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Typebot | Create advanced chat experiences without coding
Researcher

More Details >

UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4866
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode)
Researcher

More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6170
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher

More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-6169
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher

More Details >

VK All in One Expansion Unit <= 9.98.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37956
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
VK All in One Expansion Unit
Researcher

More Details >

WappPress <= 6.0.4 – Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38758
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
WappPress – Create Mobile App for any WordPress site with our Mobile App Builder in just 1 minute
Researcher

More Details >

Webico Slider Flatsome Addons <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5881
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Webico Slider Flatsome Addons
Researcher

More Details >

WP Event Aggregator <= 1.7.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38703
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into WordPress
Researcher

More Details >

WP GoToWebinar <= 15.7 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38671
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
WP GoToWebinar
Researcher

More Details >

WP Photo Album Plus <= 8.8.02.002 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38713
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
WP Photo Album Plus
Researcher

More Details >

WP Travel Engine <= 5.9.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-37944
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Researcher

More Details >

WPBITS Addons For Elementor Page Builder <= 1.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4862
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
WPBITS Addons For Elementor Page Builder
Researcher

More Details >

XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.6.4 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5669
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
XPlainer – Product FAQ for WooCommerce & AI FAQ Generator
Researcher

More Details >

Zoho Campaigns <= 2.0.8 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-38752
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Zoho Campaigns
Researcher

More Details >

AdPush <= 1.50 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38672
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
AdPush
Researcher

More Details >

Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps <= 1.36.12 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38680
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps
Researcher

More Details >

ARForms Form Builder <= 1.6.7 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37920
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder
Researcher

More Details >

codoc <= 0.9.51.12 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37961
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
codoc
Researcher

More Details >

Contact Form 7 Summary and Print <= 1.2.5 – Cross-Site Request Forgery

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38724
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Contact Form 7 Summary and Print
Researcher

More Details >

Counterpoint <= 1.8.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37559
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Counterpoint
Researcher

More Details >

Link Library <= 7.7.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38711
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Link Library
Researcher

More Details >

Login by Auth0 <= 4.6.0 – Reflected Cross-Site Scripting via wle

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2023-6813
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
Login by Auth0
Researcher

More Details >

MBE eShip <= 2.1.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37953
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
MBE eShip
Researcher

More Details >

Moloni <= 4.7.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38694
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Moloni
Researcher

More Details >

Multisite Content Copier/Updater <= 1.5.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38673
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
WordPress Multisite Content Copier/Updater
Researcher

More Details >

Plum: Spin Wheel & Email Pop-up <= 2.0 – Missing Authorization to Unauthenticated Stored Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38744
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Plum: Spin Wheel & Email Pop-up
Researcher

More Details >

Simple Responsive Slider <= 0.2.2.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37954
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Simple Responsive Slider
Researcher

More Details >

Ultimate Classified Listings <= 1.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5883
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Ultimate Classified Listings
Researcher

More Details >

Ultimate Classified Listings <= 1.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-6529
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Ultimate Classified Listings
Researcher

More Details >

Ultimate Classified Listings <= 1.3 – Unauthenticated Local File Inclusion

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5882
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Ultimate Classified Listings
Researcher

More Details >

Uncanny Automator Pro <= 5.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37117
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Uncanny Automator Pro
Researcher

More Details >

WooCommerce Predictive Search <= 6.0.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38669
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Predictive Search for WooCommerce
Researcher

More Details >

WooCommerce Report <= 1.4.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38683
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
WooCommerce Report
Researcher

More Details >

YITH WooCommerce Ajax Product Filter <= 5.1.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-37943
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
YITH WooCommerce Ajax Product Filter
Researcher

More Details >

Zoho CRM Lead Magnet <= 1.7.8.8 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-38696
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Zoho CRM Lead Magnet
Researcher

More Details >

Tutor LMS <= 2.7.2 – Authenticated (Tutor Instructor+) Stored Cross-Site Scripting

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-37947
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
Tutor LMS – eLearning and online course solution
Researcher

More Details >

WP Total Branding <= 1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-6625
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
WP Total Branding – Complete branding solution for WordPress
Researcher

More Details >

Cliengo – Chatbot <= 3.0.1 – Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-5993
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Cliengo – Chatbot
Researcher

More Details >

Happy SCSS Compiler – Compile SCSS to CSS automatically <= 1.3.10 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-5600
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue
Researcher

More Details >

Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 – Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-6392
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Image Optimizer, Resizer and CDN – Sirv
Researcher

More Details >

LearnDash LMS – Reports Free <= 1.8.2 – Missing Authorization to Plugin Settings Update

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-5648
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
LearnDash LMS – Reports
Researcher

More Details >

Pricing Table <= 2.0.1 – Missing Authorization

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-4102
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Pricing Table
Researcher

More Details >

Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 – Unauthenticated Full Path Disclosure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6554
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
Branda – White Label WordPress, Custom Login Page Customizer
Researcher

More Details >

Coming Soon <= 1.6.3 – Unauthenticated Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38756
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
Researcher

More Details >

Duplicator <= 1.5.9 – Full Path Disclosure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6210
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
Duplicator – Migration & Backup Plugin
Researcher

More Details >

EleForms <= 2.9.9.9 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38748
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
EleForms – All In One Form Integration including DB for Elementor
Researcher

More Details >

EmbedPress <= 4.0.4 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38707
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
EmbedPress – Embed PDF, PDF 3D FlipBook, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor
Researcher

More Details >

Gravity Forms: Multiple Form Instances <= 1.1.1 – Unauthenticated Full Path Disclosure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6550
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
Gravity Forms: Multiple Form Instances
Researcher

More Details >

HitPay Payment Gateway for WooCommerce <= 4.1.3 – Information Exposure via Log Files

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38747
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
HitPay Payment Gateway for WooCommerce
Researcher

More Details >

iPanorama 360 WordPress Virtual Tour Builder <= 1.8.3 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38690
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
iPanorama 360 – WordPress Virtual Tour Builder
Researcher

More Details >

Laposta <= 1.12 – Unauthenticated Full Path Disclosure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6574
Patch Status
Unpatched
Published
Jul 12, 2024

Affected Software
Laposta
Researcher

More Details >

MBE eShip <= 2.1.2 – Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38742
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
MBE eShip
Researcher

More Details >

Olive One Click Demo Import <= 1.1.2 – Unauthenticated Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38749
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Olive One Click Demo Import
Researcher

More Details >

Payflex Payment Gateway <= 2.5.0 – Missing Authorization to Order Status Update

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-0619
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Payflex Payment Gateway
Researcher

More Details >

Plum: Spin Wheel & Email Pop-up <= 2.0 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38743
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Plum: Spin Wheel & Email Pop-up
Researcher

More Details >

Pricing Table <= 2.0.1 – Cross-Site Request Forgery via ajax()

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-4100
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Pricing Table
Researcher

More Details >

Product Delivery Date for WooCommerce – Lite <= 2.7.2 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38702
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Product Delivery Date for WooCommerce – Lite
Researcher

More Details >

Product Designer <= 1.0.33 – Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3608
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Product Designer
Researcher

More Details >

Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.6 – Unauthenticated Sensitive Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38688
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Recipe Cards For Your Food Blog from Zip Recipes
Researcher

More Details >

ReDi Restaurant Reservation <= 24.0422 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38737
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
ReDi Restaurant Reservation
Researcher

More Details >

Send Users Email <= 1.5.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38760
Patch Status
Patched
Published
Jul 12, 2024

Affected Software
Send Users Email
Researcher

More Details >

SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 – Unauthenticated Full Path Disclosure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6556
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer
Researcher

More Details >

SmartMag <= 9.3.0 – Unauthenticated Sensitive Information Exposure via Log Files

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37930
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
SmartMag
Researcher

More Details >

Social Sharing Plugin – Kiwi <= 2.1.7 – Information Disclosure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3228
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Social Sharing Plugin – Kiwi
Researcher

More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 – IP Address Spoofing to Antispam Bypass

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6171
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher

More Details >

Wallet System for WooCommerce <= 2.5.13 – Information Exposure via Log Files

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38699
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Wallet System for WooCommerce – Wallet, Digital Wallet, Cashback, Recharge User Wallets, Partial Payments, Wallet restriction, Refunds
Researcher

More Details >

Wholesale Suite <= 2.1.12 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38745
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More
Researcher

More Details >

Woocommerce OpenPos <= 6.4.4 – Missing Authorization to Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37935
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Openpos – WooCommerce Point Of Sale(POS)
Researcher

More Details >

WP Accessibility Helper (WAH) <= 0.6.2.9 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-37926
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
WP Accessibility Helper (WAH)
Researcher

More Details >

WP Popups – WordPress Popup builder <= 2.2.0.1 – Unauthenticated Full Path Disclosure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6555
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
WP Popups – WordPress Popup builder
Researcher

More Details >

WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 – Improper Authorization due to use of Hardcoded Credentials

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-5810
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
WP2Speed Faster – Optimize PageSpeed Insights Score 90-100
Researcher

More Details >

Zephyr Project Manager <= 3.3.99 – Unauthenticated Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-38761
Patch Status
Patched
Published
Jul 12, 2024

Affected Software
Zephyr Project Manager
Researcher

More Details >

Admin Dashboard RSS Feed <= 3.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-38725
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Admin Dashboard RSS Feed
Researchers

More Details >

Change From Email <= 1.2.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-38738
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Change From Email
Researcher

More Details >

FormFlow <= 2.12.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3113
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
FormFlow: WhatsApp & Social Form Builder for Leads
Researchers

More Details >

Gum Elementor Addon <= 1.3.5 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37565
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
Gum Elementor Addon
Researcher

More Details >

Master Popups <= 1.0.3 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37950
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
Master Popups
Researcher

More Details >

Plugin Notes Plus <= 1.2.6 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37561
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Plugin Notes Plus
Researcher

More Details >

ReCaptcha Integration for WordPress <= 1.2.5 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37946
Patch Status
Unpatched
Published
Jul 10, 2024

Affected Software
ReCaptcha Integration for WordPress
Researcher

More Details >

Simple Popup <= 4.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-38689
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
Simple Popup Plugin
Researcher

More Details >

Simple Post Notes <= 1.7.7 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37562
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Simple Post Notes
Researcher

More Details >

Timeline Module for Beaver Builder <= 1.1.3 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-37919
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Timeline Module for Beaver Builder
Researcher

More Details >

WP Announcement <= 2.0.8 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-38685
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
WP Announcement | Dynamic Announcement, Banner, & Countdown Timer for Effective Promotions
Researcher

More Details >

Auto Featured Image (Auto Post Thumbnail) <= 4.0.0 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38719
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Auto Featured Image (Auto Post Thumbnail)
Researcher

More Details >

BuddyBoss Theme <= 2.4.61 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37925
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
BuddyBoss Theme
Researcher

More Details >

Comment Images Reloaded <= 2.2.1 – Authenticated (Subscriber+) Arbitrary Media Deletion

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5856
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Comment Images Reloaded
Researcher

More Details >

Dynamic Word Spinner: CSS3 Animated Rotation <= 5.6 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38753
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Dynamic Word Spinner: CSS3 Animated Rotation
Researcher

More Details >

EazyDocs <= 2.5.0 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38721
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
EazyDocs – Most Powerful Knowledge base, wiki, Documentation Builder Plugin
Researcher

More Details >

Event post <= 5.9.5 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1375
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Event post
Researcher

More Details >

Event Tickets <= 5.11.0.4 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38762
Patch Status
Patched
Published
Jul 12, 2024

Affected Software
Event Tickets and Registration
Researcher

More Details >

Featured Image Generator <= 1.3.1 – Missing Authorization to Authenticated (Subscriber+) Images Upload

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5677
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
Featured Image Generator
Researcher

More Details >

Google Adsense & Banner Ads by AdsforWP <= 1.9.28 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38751
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Google Adsense & Banner Ads by AdsforWP
Researcher

More Details >

HT Mega <= 2.5.7 – Authenticated (Contributor+) JSON File Directory Traversal

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38706
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
HT Mega – Absolute Addons For Elementor
Researcher

More Details >

i-amaze <= 1.3.7 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38731
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
i-amaze
Researcher

More Details >

i-transform <= 3.0.9 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38764
Patch Status
Unpatched
Published
Jul 12, 2024

Affected Software
i-transform
Researcher

More Details >

Internal Link Juicer: SEO Auto Linker for WordPress <= 2.24.3 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37941
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
Internal Link Juicer: SEO Auto Linker for WordPress
Researcher

More Details >

Just Custom Fields <= 3.3.2 – Cross-Site Request Forgery via AJAX actions

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6168
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Just Custom Fields
Researcher

More Details >

Just Custom Fields <= 3.3.2 – Missing Authorization via AJAX actions

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6167
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
Just Custom Fields
Researcher

More Details >

Light Poll <= 1.0.0 – Cross-Site Request Forgery to Poll Deletion

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6496
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Light Poll
Researcher

More Details >

MakeStories (for Google Web Stories) <= 3.0.3 – Authenticated (Subscriber+) Arbitrary File Download and Server-Side Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38746
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
MakeStories (for Google Web Stories)
Researcher

More Details >

Matomo Analytics <= 5.1.0 – Cross-Site Request Forgery to Notice Dismissal

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38766
Patch Status
Patched
Published
Jul 12, 2024

Affected Software
Matomo Analytics – Ethical Stats. Powerful Insights.
Researcher

More Details >

MBE eShip <= 2.1.2 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38729
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
MBE eShip
Researcher

More Details >

Media Hygiene <= 3.0.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5855
Patch Status
Patched
Published
Jul 8, 2024

Affected Software
Media Hygiene: Remove or Delete Unused Images and More!
Researcher

More Details >

Meks Video Importer <= 1.0.11 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38733
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Meks Video Importer
Researcher

More Details >

Metorik – Reports & Email Automation for WooCommerce <= 1.7.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38691
Patch Status
Patched
Published
Jul 10, 2024

Affected Software
Metorik – Reports & Email Automation for WooCommerce
Researcher

More Details >

Oceanic <= 1.0.48 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38765
Patch Status
Unpatched
Published
Jul 12, 2024

Affected Software
Oceanic
Researcher

More Details >

Packlink PRO shipping module <= 3.4.8 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38740
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Packlink PRO shipping module
Researcher

More Details >

Patricia Blog <= 1.2 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38732
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Patricia Blog
Researcher

More Details >

Patricia Lite <= 1.2.3 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37939
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Patricia Lite
Researcher

More Details >

Point <= 1.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37931
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
Point
Researcher

More Details >

Popularis Verse <= 1.0.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38763
Patch Status
Unpatched
Published
Jul 12, 2024

Affected Software
Popularis Verse
Researcher

More Details >

ProfileGrid <= 5.8.9 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6410
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
ProfileGrid – User Profiles, Groups and Communities
Researcher

More Details >

Seraphinite Accelerator Premium <= 2.21.13 – Cross-Site Request Forgery to Arbitrary File Deletion

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37940
Patch Status
Patched
Published
Jul 9, 2024

Affected Software
Seraphinite Accelerator Pro
Researcher

More Details >

Seraphinite Post .DOCX Source <= 2.16.9 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38727
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Seraphinite Post .DOCX Source
Researcher

More Details >

SociallyViral <= 1.0.10 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37938
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
SociallyViral
Researcher

More Details >

Taggbox <= 3.3 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38754
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
Researcher

More Details >

Titan Anti-spam & Security <= 7.3.6 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38777
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
Titan Anti-spam & Security
Researcher

More Details >

User Activity Log Pro <= 2.3.4 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-37929
Patch Status
Unpatched
Published
Jul 9, 2024

Affected Software
User Activity Log Pro
Researcher

More Details >

WP Fast Total Search <= 1.68.232 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38714
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
WP Fast Total Search – The Power of Indexed Search
Researcher

More Details >

WP GoToWebinar <= 15.6 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-38695
Patch Status
Unpatched
Published
Jul 11, 2024

Affected Software
WP GoToWebinar
Researcher

More Details >

WP Links Page <= 4.9.5 – Missing Authorization to Authenticated (Subscriber+) Limited Image Update

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-6465
Patch Status
Patched
Published
Jul 12, 2024

Affected Software
WP Links Page
Researcher

More Details >

XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.6.4 – Missing Authorization to Authenticated (Subscriber+) Settings Update

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5704
Patch Status
Unpatched
Published
Jul 8, 2024

Affected Software
XPlainer – Product FAQ for WooCommerce & AI FAQ Generator
Researcher

More Details >

Academy LMS <= 2.0.4 – Missing Authorization

2.7

CVSS Rating
Low (2.7)
CVE-ID
CVE-2024-38701
Patch Status
Patched
Published
Jul 11, 2024

Affected Software
Academy LMS – eLearning and online course solution for WordPress
Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (July 8, 2024 to July 14, 2024) appeared first on Wordfence.

Leave a Reply

Your email address will not be published. Required fields are marked *

*

Tap To Call