Wordfence Intelligence Weekly WordPress Vulnerability Report (June 3, 2024 to June 9, 2024)

???? Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest. For a limited time, all high risk issues are in-scope for all researchers! 

Last week, there were 215 vulnerabilities disclosed in 180 WordPress Plugins and 10 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 58 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 16,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 150
Unpatched 65

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 183
High Severity 21
Critical Severity 11

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 107
Missing Authorization 49
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 8
Cross-Site Request Forgery (CSRF) 7
Information Exposure 6
Improper Access Control 5
Authorization Bypass Through User-Controlled Key 3
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 3
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') 2
Insufficient Verification of Data Authenticity 2
Authentication Bypass Using an Alternate Path or Channel 1
Improper Control of Generation of Code ('Code Injection') 1
Improper Handling of Insufficient Permissions or Privileges 1
Improper Input Validation 1
Improper Neutralization of Alternate XSS Syntax 1
Improper Neutralization of Formula Elements in a CSV File 1
Improper Restriction of Excessive Authentication Attempts 1
Incorrect Permission Assignment for Critical Resource 1
Incorrect Privilege Assignment 1
Insecure Storage of Sensitive Information 1
Path Traversal: '…/…//' 1
Server-Side Request Forgery (SSRF) 1
Unrestricted Upload of File with Dangerous Type 1
Use of Insufficiently Random Values 1
Use of Less Trusted Source 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

25

16

13

12

10

10

8

7

7

6

6

6

5

5

5

4

4

3

3

3

3

3

3

3

3

3

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
12 Step Meeting List 12-step-meeting-list
Active Products Tables for WooCommerce. Use constructor to create tables  profit-products-tables-for-woocommerce
Admin Notices Manager admin-notices-manager
Advanced Woo Labels – Product Labels for WooCommerce advanced-woo-labels
Album and Image Gallery plus Lightbox album-and-image-gallery-plus-lightbox
Album Gallery – WordPress Gallery new-album-gallery
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) wp-analytify
Animated AL List animated-al-list
Authorize.net Payment Gateway For WooCommerce authorizenet-payment-gateway-for-woocommerce
Auto Coupons for WooCommerce woo-auto-coupons
Block for Font Awesome block-for-font-awesome
BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library blockart-blocks
Boostify Header Footer Builder for Elementor boostify-header-footer-builder
Bosa Elementor Addons and Templates for WooCommerce bosa-elementor-for-woocommerce
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content brave-popup-builder
Brizy – Page Builder brizy
BuddyPress Cover bp-cover
BuddyPress Members Only buddypress-members-only
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages wc4bp
Cards for Beaver Builder bb-bootstrap-cards
CF7 Google Sheets Connector cf7-google-sheets-connector
Checkout Field Editor for WooCommerce (Pro) woocommerce-checkout-field-editor-pro
Claudio Sanches – Checkout Cielo for WooCommerce woocommerce-checkout-cielo
Clever Addons for Elementor cafe-lite
Clever Fox clever-fox
Colibri Page Builder colibri-page-builder
Comments – wpDiscuz wpdiscuz
Contact Form Builder, Contact Widget contact-forms-builder
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db
Copymatic – AI Content Writer & Generator copymatic
Countdown, Coming Soon, Maintenance – Countdown & Clock countdown-builder
Cowidgets – Elementor Addons cowidgets-elementor-addons
Custom Dash custom-dash
Dashboard To-Do List dashboard-to-do-list
Database Cleaner: Clean, Optimize & Repair database-cleaner
Debug Log Manager debug-log-manager
Download Attachments download-attachments
Download Manager download-manager
Easy Forms for Mailchimp yikes-inc-easy-mailchimp-extender
Easy Social Like Box – Popup – Sidebar Widget cardoza-facebook-like-box
EasyAzon – Amazon Associates Affiliate Plugin easyazon
ElasticPress elasticpress
ElementsReady Addons for Elementor element-ready-lite
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce email-subscribers
EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor embedpress
Emergency Password Reset emergency-password-reset
Envo Extra envo-extra
Essential Addons for Elementor Pro essential-addons-elementor
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders essential-addons-for-elementor-lite
Essential Real Estate essential-real-estate
Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner
Extra Product Options for WooCommerce extra-product-options-for-woocommerce
FileOrganizer – Manage WordPress and Website Files fileorganizer
Five Star Restaurant Menu and Food Ordering food-and-drink-menu
Fluid Notification Bar fluid-notification-bar
Frontend Registration – Contact Form 7 frontend-registration-contact-form-7
Gallery – Image and Video Gallery with Thumbnails gallery-album
GamiPress – Link gamipress-link
GDPR CCPA Compliance & Cookie Consent Banner ninja-gdpr-compliance
GDPR/CCPA Cookie Consent Banner uk-cookie-consent
GiveWP – Donation Plugin and Fundraising Platform give
GP Premium gp-premium
Gutenberg Blocks and Page Layouts – Attire Blocks attire-blocks
Gutenberg Blocks, Page Builder – ComboBlocks post-grid
Heateor Social Login WordPress heateor-social-login
HT Feed ht-instagram
Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery new-image-gallery
Image Hover Effects for Elementor with Lightbox and Flipbox image-hover-effects-with-carousel
Insert Post Ads insert-post-ads
Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site integrate-google-drive
Kenta Blocks – Responsive Blocks and block templates library kenta-blocks
KiviCare – Clinic & Patient Management System (EHR) kivicare-clinic-management-system
Kognetiks Chatbot for WordPress chatbot-chatgpt
LA-Studio Element Kit for Elementor lastudio-element-kit
LearnPress – WordPress LMS Plugin learnpress
Leyka leyka
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes lifterlms
Link Library link-library
Login/Signup Popup ( Inline Form + Woocommerce ) easy-login-woocommerce
Logo Manager For Enamad logo-manager-for-enamad
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) magical-addons-for-elementor
Market Exporter market-exporter
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor master-addons
Materialis Companion materialis-companion
Media Slider – Photo Slider, Video Slider, Link Slider, Carousal Slideshow media-slider
MegaMenu stm-megamenu
MelaPress Login Security melapress-login-security
Mime Types Extended mime-types-extended
Minimal Coming Soon – Coming Soon Page minimal-coming-soon-maintenance-mode
Mollie Forms mollie-forms
MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution dc-woocommerce-multi-vendor
Nafeza Prayer Time nafeza-prayer-time
Newsletter – Send awesome emails from WordPress newsletter
Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) mailin
Newsletters newsletters-lite
One Page Express Companion one-page-express-companion
Open Graph opengraph
Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE otter-pro
Ovic Importer ovic-import-demo
Pagerank tools pagerank-tools
Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery
Podlove Web Player podlove-web-player
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) buddyforms
PowerPack Pro for Elementor powerpack-elements
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) bdthemes-prime-slider-lite
Product Addons & Fields for WooCommerce woocommerce-product-addon
ProfileGrid – User Profiles, Groups and Communities profilegrid-user-profiles-groups-and-communities
PropertyHive propertyhive
Pure Chat – Live Chat & More! pure-chat
Qi Addons For Elementor qi-addons-for-elementor
Qi Blocks qi-blocks
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker quiz-master-next
Recurring PayPal Donations recurring-donation
Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. responsive-add-ons
Restrict for Elementor restrict-for-elementor
RestroPress – Online Food Ordering System restropress
Rotating Tweets (Twitter widget and shortcode) rotatingtweets
Royal Elementor Addons and Templates royal-elementor-addons
Salon Booking System salon-booking-system
Save as PDF Plugin by Pdfcrowd save-as-pdf-by-pdfcrowd
SC filechecker wp-file-checker
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster sellkit
Sensei LMS – Online Courses, Quizzes, & Learning sensei-lms
Shopping Cart & eCommerce Store wp-easycart
Simple AL Slider simple-al-slider
Simple COD Fees for WooCommerce simple-cod-fee-for-woocommerce
Simple Image Popup Shortcode simple-image-popup-shortcode
SKT Addons for Elementor skt-addons-for-elementor
Slider Responsive Slideshow – Image slider, Gallery slideshow slider-responsive-slideshow
Slider Revolution revslider
Social Link Pages: link-in-bio landing pages for your social media profiles social-link-pages
Social Login Lite For WooCommerce social-login-lite-for-woocommerce
Startklar Elementor Addons startklar-elmentor-forms-extwidgets
Stellissimo Text Box stellissimo-text-box
Strategery Migrations strategery-migrations
Strong Testimonials strong-testimonials
SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! suretriggers
TablePress – Tables in WordPress made easy tablepress
tagDiv Composer td-composer
TemplatesNext OnePager templatesnext-onepager
Testimonials Widget testimonials-widget
The Moneytizer the-moneytizer
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid the-post-grid
Themesflat Addons For Elementor themesflat-addons-for-elementor
Tickera – WordPress Event Ticketing tickera-event-ticketing-system
Tutor LMS – eLearning and online course solution tutor
Under Construction / Maintenance Mode from Acurax coming-soon-maintenance-mode-from-acurax
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor
Upload Fields for WPForms – Drag and Drop Multiple File Upload, Image Upload, and Google Drive Upload for WPForms upload-fields-for-wpforms
Upunzipper upunzipper
Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages visualcomposer
Visualizer: Tables and Charts Manager for WordPress visualizer
Wbcom Designs – Custom Font Uploader custom-font-uploader
Weaver Xtreme Theme Support weaverx-theme-support
Widget Options – Extended extended-widget-options
Widget Options – The #1 WordPress Widget & Block Control Plugin widget-options
Widget4Call widget4call
WooCommerce Dropshipping Premium woocommerce-dropshipping
WooCommerce Tools woo-tools
Woody code snippets – Insert Header Footer Code, AdSense Ads insert-php
woothemes-sensei woothemes-sensei
WordPress prettyPhoto prettyphoto
WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing wp-dark-mode
WP Docs wp-docs
WP Force SSL & HTTPS SSL Redirect wp-force-ssl
WP jQuery Lightbox wp-jquery-lightbox
WP Mobile Menu – The Mobile-Friendly Responsive Menu mobile-menu
WP Reset – Most Advanced WordPress Reset Tool wp-reset
WP Time Slots Booking Form wp-time-slots-booking-form
WP Translate – WordPress Translation Plugin wp-translate
WP Visitors Tracker wp_visitorstracker
WP-DB-Table-Editor wp-db-table-editor
WP-Recall – Registration, Profile, Commerce & More wp-recall
WPMobile.App — Android and iOS Mobile Application wpappninja
WPUpper Share Buttons wpupper-share-buttons
WS Form LITE – Drag & Drop Contact Form Builder for WordPress ws-form
WS Form Pro ws-form-pro
YITH Custom Login yith-custom-login
YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons
YITH WooCommerce Tab Manager yith-woocommerce-tab-manager

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Blocksy blocksy
Bloglo bloglo
Eduma eduma
Event event
Formula formula
Idyllic idyllic
Pixgraphy pixgraphy
Radcliffe 2 radcliffe-2
Responsive responsive
Rife Free rife-free

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

BuddyPress Cover <= 2.1.4.2 – Unauthenticated Arbitrary File Upload

10.0

CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-35746
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
BuddyPress Cover
Researcher

More Details >

Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress <= 1.7.2 – Authenticated (Author+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-35678
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
Researcher

More Details >

Gallery – Image and Video Gallery with Thumbnails <= 2.0.3 – Authenticated (Contributor+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-35750
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
Gallery – Image and Video Gallery with Thumbnails
Researcher

More Details >

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 – Authenticated (Contributor+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-3592
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
Researcher

More Details >

Visualizer <= 3.11.1 – Authenticated (Subscriber+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-35736
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Visualizer: Tables and Charts Manager for WordPress
Researcher

More Details >

Checkout Field Editor for WooCommerce (Pro) <= 3.6.2 – Unauthenticated Arbitrary File Deletion

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-35658
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Checkout Field Editor for WooCommerce (Pro)
Researcher

More Details >

Email Subscribers by Icegram Express <= 5.7.20 – Unauthenticated SQL Injection via hash

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-4295
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Researcher

More Details >

LifterLMS – WordPress LMS Plugin for eLearning <= 7.6.2 – Authenticated (Contributor+) SQL Injection via Shortcode

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-4743
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
Researcher

More Details >

MegaMenu <= 2.3.12 – Unauthenticated Local File Inclusion

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-35677
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
MegaMenu
Researcher

More Details >

Social Login Lite For WooCommerce <= 1.6.0 – Authentication Bypass

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-4552
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Social Login Lite For WooCommerce
Researcher

More Details >

Startklar Elementor Addons <= 1.7.15 – Unauthenticated Path Traversal to Arbitrary Directory Deletion

9.1

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-5153
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Startklar Elementor Addons
Researcher

More Details >

Cowidgets – Elementor Addons <= 1.1.1 – Authenticated (Contributor+) Local File Inclusion

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5179
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Cowidgets – Elementor Addons
Researcher

More Details >

Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 – 2.7.2 – Missing Authorization to Arbitrary Options Update

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5324
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Login/Signup Popup ( Inline Form + Woocommerce )
Researcher

More Details >

PowerPack Pro for Elementor <= 2.10.17 – Authenticated (Contributor+) Privilege Escalation

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-3668
Patch Status
Patched
Published
Jun 7, 2024

Affected Software
PowerPack Pro for Elementor
Researcher

More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 – Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-5329
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher

More Details >

The Moneytizer <= 9.5.20 – Cross-Site Request Forgery via multiple AJAX actions

8.1

CVSS Rating
High (8.1)
CVE-ID
CVE-2023-6968
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
The Moneytizer
Researcher

More Details >

The Moneytizer <= 9.5.20 – Missing Authorization via multiple AJAX actions

8.1

CVSS Rating
High (8.1)
CVE-ID
CVE-2023-6966
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
The Moneytizer
Researcher

More Details >

FileOrganizer <= 1.0.7 – Sensitive Information Exposure via Directory Listing

7.5

CVSS Rating
High (7.5)
CVE-ID
CVE-2024-5599
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
FileOrganizer – Manage WordPress and Website Files
Researcher

More Details >

Market Exporter <= 2.0.19 – Missing Authorization to Arbitrary File Deletion

7.5

CVSS Rating
High (7.5)
CVE-ID
CVE-2024-5637
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Market Exporter
Researcher

More Details >

Qi Addons For Elementor <= 1.7.2 – Authenticated (Contributor+) Local File Inclusion

7.5

CVSS Rating
High (7.5)
CVE-ID
CVE-2024-4887
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Qi Addons For Elementor
Researcher

More Details >

Strategery Migrations <= 1.0 – Unauthenticated Arbitrary File Deletion

7.5

CVSS Rating
High (7.5)
CVE-ID
CVE-2024-35745
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
Strategery Migrations
Researcher

More Details >

WP-DB-Table-Editor <= 1.8.4 – Missing Authorization to Authenticated(Contributor+) Database Access

7.5

CVSS Rating
High (7.5)
CVE-ID
CVE-2024-2019
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
WP-DB-Table-Editor
Researcher

More Details >

Brizy – Page Builder <= 2.4.43 – Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL

7.4

CVSS Rating
High (7.4)
CVE-ID
CVE-2024-3667
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Brizy – Page Builder
Researcher

More Details >

SKT Addons for Elementor <= 2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate and Creative Slider Widgets

7.4

CVSS Rating
High (7.4)
CVE-ID
CVE-2024-5091
Patch Status
Patched
Published
Jun 7, 2024

Affected Software
SKT Addons for Elementor
Researcher

More Details >

Brizy – Page Builder <= 2.4.43 – Unauthenticated Stored Cross-Site Scripting via Form

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-2087
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Brizy – Page Builder
Researcher

More Details >

Frontend Registration – Contact Form 7 <= 5.1 – Authenticated (Editor+) Privilege Escalation

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-4870
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Frontend Registration – Contact Form 7
Researcher

More Details >

Heateor Social Login WordPress <= 1.1.32 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-35706
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Heateor Social Login WordPress
Researcher

More Details >

Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 – Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widget

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-5542
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Researcher

More Details >

Mime Types Extended <= 0.11 – Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-4759
Patch Status
Unpatched
Published
Jun 4, 2024

Affected Software
Mime Types Extended
Researcher

More Details >

Social Link Pages: link-in-bio landing pages for your social media profiles <= 1.6.9 – Missing Authorization to Arbitrary Page Creation and Cross-Site Scripting

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-3555
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Social Link Pages: link-in-bio landing pages for your social media profiles
Researcher

More Details >

Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-4902
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Tutor LMS – eLearning and online course solution
Researcher

More Details >

WP Time Slots Booking Form <= 1.2.10 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-35734
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
WP Time Slots Booking Form
Researcher

More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 – Authenticated (Contributor+) Path Traversal via esc_dir Function

6.8

CVSS Rating
Medium (6.8)
CVE-ID
CVE-2024-5481
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Researcher

More Details >

MelaPress Login Security <= 1.3.0 – Authenticated (Admin+) Remote File Inclusion

6.6

CVSS Rating
Medium (6.6)
CVE-ID
CVE-2024-35650
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
MelaPress Login Security
Researcher

More Details >

Album and Image Gallery plus Lightbox <= 2.0 – Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-4194
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Album and Image Gallery plus Lightbox
Researcher

More Details >

BuddyForms <= 2.8.9 – Email Verification Bypass due to Insufficient Randomness

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-5149
Patch Status
Unpatched
Published
Jun 4, 2024

Affected Software
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Researcher

More Details >

CF7 Google Sheets Connector <= 5.0.9 – Missing Authorization to Limited Site Configuration Update

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-5654
Patch Status
Patched
Published
Jun 7, 2024

Affected Software
CF7 Google Sheets Connector
Researcher

More Details >

Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 – Missing Authorization to MA Template Creation or Modification

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-5382
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Researcher

More Details >

Ovic Importer <= 1.6.3 – Authenticated (Subscriber+) Arbitrary File Download

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-35754
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
Ovic Importer
Researcher

More Details >

Advanced Woo Labels – Product Labels for WooCommerce <= 1.93 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35675
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Advanced Woo Labels – Product Labels for WooCommerce
Researcher

More Details >

Block for Font Awesome <= 1.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35705
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Block for Font Awesome
Researcher

More Details >

BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.1.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35704
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library
Researcher

More Details >

Blocksy <= 2.0.50 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5439
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Blocksy
Researcher

More Details >

Bloglo <= 1.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35715
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Bloglo
Researcher

More Details >

Boostify Header Footer Builder for Elementor <= 1.3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5006
Patch Status
Unpatched
Published
Jun 4, 2024

Affected Software
Boostify Header Footer Builder for Elementor
Researcher

More Details >

Brizy – Page Builder <= 2.4.43 – Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1161
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Brizy – Page Builder
Researcher

More Details >

Brizy – Page Builder <= 2.4.43 – Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1164
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Brizy – Page Builder
Researcher

More Details >

Cards for Beaver Builder <= 1.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Cards Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5663
Patch Status
Patched
Published
Jun 7, 2024

Affected Software
Cards for Beaver Builder
Researcher

More Details >

Clever Addons for Elementor <= 2.1.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2350
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Clever Addons for Elementor
Researcher

More Details >

Clever Fox <= 25.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1768
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Clever Fox
Researchers

More Details >

Colibri Page Builder <= 1.0.276 – Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4451
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Colibri Page Builder
Researcher

More Details >

Colibri Page Builder <= 1.0.276 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5038
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Colibri Page Builder
Researcher

More Details >

Comments – wpDiscuz <= 7.6.18 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35681
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Comments – wpDiscuz
Researcher

More Details >

Cowidgets – Elementor Addons <= 1.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via heading_tag Parameter

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4697
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Cowidgets – Elementor Addons
Researcher

More Details >

Download Attachments <= 1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3230
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Download Attachments
Researcher

More Details >

Download Manager <= 3.2.93 – Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4001
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Download Manager
Researcher

More Details >

Easy Social Like Box – Popup – Sidebar Widget <= 4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5224
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Easy Social Like Box – Popup – Sidebar Widget
Researcher

More Details >

ElementsReady Addons for Elementor <= 6.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5152
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
ElementsReady Addons for Elementor
Researcher

More Details >

EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5571
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor
Researcher

More Details >

Envo Extra <= 1.8.23 – Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5645
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Envo Extra
Researcher

More Details >

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.15 – Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5612
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Essential Addons for Elementor Pro
Researcher

More Details >

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5188
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Researcher

More Details >

Essential Real Estate <= 4.4.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4273
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Essential Real Estate
Researcher

More Details >

GamiPress – Link <= 1.1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5536
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
GamiPress – Link
Researcher

More Details >

Heateor Social Login WordPress <= 1.1.32 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35707
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Heateor Social Login WordPress
Researcher

More Details >

HT Feed <= 1.2.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35699
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
HT Feed
Researcher

More Details >

Idyllic <= 1.1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35714
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Idyllic
Researcher

More Details >

Image Hover Effects for Elementor with Lightbox and Flipbox <= 3.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5001
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Image Hover Effects for Elementor with Lightbox and Flipbox
Researcher

More Details >

Kognetiks Chatbot for WordPress <= 1.9.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35738
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Kognetiks Chatbot for WordPress
Researcher

More Details >

Magical Addons For Elementor <= 1.1.39 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5161
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )
Researcher

More Details >

Materialis Companion <= 1.3.41 – Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4707
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Materialis Companion
Researcher

More Details >

MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution <= 4.1.11 – Authenticated (Contributor+) Stored Cross-Site Scripting via hover_animation Parameter

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5259
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution
Researcher

More Details >

Newsletter <= 8.3.4 – Unauthenticated Stored Cross-Site Scripting via np1

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5317
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Newsletter – Send awesome emails from WordPress
Researcher

More Details >

One Page Express Companion <= 1.6.37 – Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4703
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
One Page Express Companion
Researcher

More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 – Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5426
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Researcher

More Details >

Pixgraphy <= 1.3.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35740
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Pixgraphy
Researcher

More Details >

Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 – Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4042
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Gutenberg Blocks, Page Builder – ComboBlocks
Researcher

More Details >

Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1988
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Gutenberg Blocks, Page Builder – ComboBlocks
Researcher

More Details >

Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5640
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)
Researcher

More Details >

PropertyHive <= 2.0.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35701
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
PropertyHive
Researcher

More Details >

Qi Addons For Elementor <= 1.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4364
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Qi Addons For Elementor
Researcher

More Details >

Qi Blocks <= 1.2.9 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5221
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Qi Blocks
Researcher

More Details >

Recurring PayPal Donations <= 1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35676
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Recurring PayPal Donations
Researcher

More Details >

Responsive <= 5.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35654
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Responsive
Researcher

More Details >

Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5222
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme.
Researcher

More Details >

RestroPress – Online Food Ordering System <= 3.1.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35719
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
RestroPress – Online Food Ordering System
Researcher

More Details >

Rife Free <= 2.4.19 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35708
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Rife Free
Researcher

More Details >

Rotating Tweets (Twitter widget and shortcode) <= 1.9.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5141
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Rotating Tweets (Twitter widget and shortcode)
Researcher

More Details >

Royal Elementor Addons and Templates <= 1.3.976 – Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4489
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Royal Elementor Addons and Templates
Researcher

More Details >

Royal Elementor Addons and Templates <= 1.3.976 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4488
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Royal Elementor Addons and Templates
Researcher

More Details >

Save as PDF Plugin by Pdfcrowd <= 3.2.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35649
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Save as PDF Plugin by Pdfcrowd
Researcher

More Details >

SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 1.9.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4608
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster
Researcher

More Details >

Sensei Pro (WC Paid Courses) <= 4.23.1.1.23.1 – Authenticated (Student+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-34765
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
woothemes-sensei
Researcher

More Details >

Simple Image Popup Shortcode <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5342
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Simple Image Popup Shortcode
Researcher

More Details >

Slider Revolution <= 6.7.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4637
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Slider Revolution
Researcher

More Details >

Slider Revolution <= 6.7.11 – Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title Attributes

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4581
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Slider Revolution
Researcher

More Details >

SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 – Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5485
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!
Researcher

More Details >

TablePress – Tables in WordPress made easy <= 2.3 – Authenticated (Author+) Server-Side Request Forgery via DNS Rebind

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4354
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
TablePress – Tables in WordPress made easy
Researcher

More Details >

tagDiv Composer <= 4.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3888
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
tagDiv Composer
Researcher

More Details >

TemplatesNext OnePager <= 1.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35753
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
TemplatesNext OnePager
Researcher

More Details >

Testimonials Widget <= 4.0.4 – Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4705
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Testimonials Widget
Researcher

More Details >

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.7.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35739
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
Researcher

More Details >

Theme <= 1.2.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35711
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Event
Researcher

More Details >

Themesflat Addons For Elementor <= 2.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4212
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Themesflat Addons For Elementor
Researcher

More Details >

Themesflat Addons For Elementor <= 2.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via URLs

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4458
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Themesflat Addons For Elementor
Researcher

More Details >

Themesflat Addons For Elementor <= 2.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2922
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Themesflat Addons For Elementor
Researcher

More Details >

Themesflat Addons For Elementor <= 2.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4459
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Themesflat Addons For Elementor
Researcher

More Details >

Weaver Xtreme Theme Support <= 6.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4939
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Weaver Xtreme Theme Support
Researcher

More Details >

WordPress prettyPhoto <= 1.2.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5162
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
WordPress prettyPhoto
Researcher

More Details >

WP Docs <= 2.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35695
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
WP Docs
Researcher

More Details >

WP jQuery Lightbox <= 1.5.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5425
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
WP jQuery Lightbox
Researcher

More Details >

Minimal Coming Soon – Coming Soon Page <= 2.38 – Missing Authorization to Limited Settings Change

6.3

CVSS Rating
Medium (6.3)
CVE-ID
CVE-2024-5087
Patch Status
Patched
Published
Jun 7, 2024

Affected Software
Minimal Coming Soon – Coming Soon Page
Researcher

More Details >

12 Step Meeting List <= 3.14.33 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35693
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
12 Step Meeting List
Researcher

More Details >

Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35730
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Active Products Tables for WooCommerce. Use constructor to create tables 
Researcher

More Details >

Animated AL List <= 1.0.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5728
Patch Status
Unpatched
Published
Jun 7, 2024

Affected Software
Animated AL List
Researcher

More Details >

Auto Coupons for WooCommerce <= 3.0.14 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35733
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Auto Coupons for WooCommerce
Researcher

More Details >

EasyAzon – Amazon Associates Affiliate Plugin <= 5.1.0 – Reflected Cross-Site Scripting via easyazon-cloaking-locale

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2023-6956
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
EasyAzon – Amazon Associates Affiliate Plugin
Researcher

More Details >

Eduma <= 5.4.7 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35697
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Eduma
Researcher

More Details >

Event Tickets with Ticket Scanner <= 2.3.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35652
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Event Tickets with Ticket Scanner
Researcher

More Details >

Formula <= 0.5.1 – Reflected Cross-Site Scripting via quality_customizer_notify_dismiss_action

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5613
Patch Status
Patched
Published
Jun 7, 2024

Affected Software
Formula
Researcher

More Details >

Formula <= 0.5.1 – Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5638
Patch Status
Patched
Published
Jun 7, 2024

Affected Software
Formula
Researcher

More Details >

GiveWP – Donation Plugin and Fundraising Platform <= 3.12.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35679
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
GiveWP – Donation Plugin and Fundraising Platform
Researcher

More Details >

GP Premium <= 2.4.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-3469
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
GP Premium
Researchers

More Details >

Link Library <= 7.6.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35687
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Link Library
Researcher

More Details >

Logo Manager For Enamad <= 0.7.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-4757
Patch Status
Unpatched
Published
Jun 4, 2024

Affected Software
Logo Manager For Enamad
Researcher

More Details >

Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue <= 3.1.77 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35668
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue)
Researcher

More Details >

Newsletters <= 4.9.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35718
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Newsletters
Researcher

More Details >

Pagerank Tools <= 1.1.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5730
Patch Status
Unpatched
Published
Jun 7, 2024

Affected Software
Pagerank tools
Researcher

More Details >

Simple AL Slider <= 1.2.10 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5729
Patch Status
Unpatched
Published
Jun 7, 2024

Affected Software
Simple AL Slider
Researcher

More Details >

Widget4Call <= 1.0.7 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-5727
Patch Status
Unpatched
Published
Jun 7, 2024

Affected Software
Widget4Call
Researcher

More Details >

WP Docs <= 2.1.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35696
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
WP Docs
Researcher

More Details >

WP Visitors Tracker <= 2.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35737
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
WP Visitors Tracker
Researcher

More Details >

WPMobile.App — Android and iOS Mobile Application <= 11.41 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-35694
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
WPMobile.App — Android and iOS Mobile Application
Researcher

More Details >

Bosa Elementor Addons and Templates for WooCommerce <= 1.0.12 – Missing Authorization

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-35724
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Bosa Elementor Addons and Templates for WooCommerce
Researcher

More Details >

Clever Fox – One Click Website Importer by Nayra Themes <= 25.2.0 – Missing Authorization to arbitrary theme activation via clever-fox-activate-theme

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2023-6876
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Clever Fox
Researcher

More Details >

Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.7.8 – Missing Authorization to Authenticated (Subscriber+) PHP Object Injection

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2017
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Countdown, Coming Soon, Maintenance – Countdown & Clock
Researcher

More Details >

Debug Log Manager <= 2.3.1 – Missing Authorization

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-35669
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Debug Log Manager
Researcher

More Details >

GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 – Missing Authorization to Settings Update and Stored Cross-Site Scripting

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-5607
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
GDPR CCPA Compliance & Cookie Consent Banner
Researcher

More Details >

Kenta Blocks – Responsive Blocks and block templates library <= 1.3.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-35731
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Kenta Blocks – Responsive Blocks and block templates library
Researcher

More Details >

Pure Chat – Live Chat Plugin & More! <= 2.22 – Cross-Site Request Forgery

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-35673
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Pure Chat – Live Chat & More!
Researcher

More Details >

WP Mobile Menu – The Mobile-Friendly Responsive Menu <= 2.8.4.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Image Alt

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-3987
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
WP Mobile Menu – The Mobile-Friendly Responsive Menu
Researcher

More Details >

Authorize.net Payment Gateway For WooCommerce <= 8.0 – Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2382
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Authorize.net Payment Gateway For WooCommerce
Researcher

More Details >

BuddyPress Members Only <= 3.3.5 – Improper Access Control to Sensitive Information Exposure via REST API

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-0972
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
BuddyPress Members Only
Researcher

More Details >

Claudio Sanches – Checkout Cielo for WooCommerce <= 1.1.0 – Insufficient Verification of Data Authenticity to Order Payment Status Update

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1718
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Claudio Sanches – Checkout Cielo for WooCommerce
Researcher

More Details >

Contact Form Builder, Contact Widget <= 2.1.7 – Authentication Request Bypass

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35747
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
Contact Form Builder, Contact Widget
Researcher

More Details >

Easy Forms for Mailchimp <= 6.9.0 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35742
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
Easy Forms for Mailchimp
Researcher

More Details >

GDPR/CCPA Cookie Consent Banner <= 3.2 – Missing Authorization via handle_consent_toggle()

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35692
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
GDPR/CCPA Cookie Consent Banner
Researcher

More Details >

Insert Post Ads <= 1.3.2 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35665
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Insert Post Ads
Researcher

More Details >

Integrate Google Drive <= 1.3.93 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35670
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site
Researcher

More Details >

LA-Studio Element Kit for Elementor <= 1.3.6 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35725
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
LA-Studio Element Kit for Elementor
Researcher

More Details >

LearnPress – WordPress LMS Plugin <= 4.2.6.8 – Basic Information Disclosure via JSON API

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-5483
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
LearnPress – WordPress LMS Plugin
Researcher

More Details >

Leyka <= 3.31.1 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35683
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Leyka
Researcher

More Details >

Master Addons for Elementor <= 2.0.5.4.1 – Missing Authorization via get_jltma_save_menuitem_settings()

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35660
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Researcher

More Details >

Open Graph <= 1.11.2 – Unauthenticated Sensitive Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-5615
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Open Graph
Researcher

More Details >

Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.11 – Authenticated (Subscriber+) Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35682
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Otter Blocks PRO – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Researcher

More Details >

Podlove Web Player <= 5.7.3 – Missing Authorization to Unauthenticated Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35710
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Podlove Web Player
Researcher

More Details >

PPOM for WooCommerce <= 32.0.20 – Unauthenticated Content Injection Vulnerability

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35728
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Product Addons & Fields for WooCommerce
Researcher

More Details >

Radcliffe 2 <= 2.0.17 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35685
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Radcliffe 2
Researcher

More Details >

Restrict for Elementor <= 1.0.6 – Protection Mechanism Bypass

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-0910
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Restrict for Elementor
Researcher

More Details >

Sensei LMS <= 4.23.1 & Sensei Pro (WC Paid Courses) <= 4.24.0.1.24.0 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35686
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Sensei LMS – Online Courses, Quizzes, & Learning
woothemes-sensei
Researcher

More Details >

Under Construction / Maintenance Mode from Acurax <= 2.6 – Unauthenticated IP Spoofing

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35749
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
Under Construction / Maintenance Mode from Acurax
Researcher

More Details >

Upload Fields for WPForms <= 1.0.2 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35661
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Upload Fields for WPForms – Drag and Drop Multiple File Upload, Image Upload, and Google Drive Upload for WPForms
Researcher

More Details >

WooCommerce Dropshipping <= 5.0.4 – Missing Authorization to Unauthenticated Arbitrary Email Send

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35748
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
WooCommerce Dropshipping Premium
Researcher

More Details >

WooCommerce Tools <= 1.2.9 – Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1689
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
WooCommerce Tools
Researcher

More Details >

WP EasyCart <= 5.5.19 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35667
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Shopping Cart & eCommerce Store
Researcher

More Details >

WP Time Slots Booking Form <= 1.2.11 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35735
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
WP Time Slots Booking Form
Researcher

More Details >

WP Translate <= 5.3.0 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35663
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
WP Translate – WordPress Translation Plugin
Researcher

More Details >

WP-Recall – Registration, Profile, Commerce & More <= 16.26.6 – Unauthenticated Payment Deletion via delete_payment

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1175
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
WP-Recall – Registration, Profile, Commerce & More
Researcher

More Details >

WPUpper Share Buttons <= 3.43 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-4997
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
WPUpper Share Buttons
Researcher

More Details >

YITH WooCommerce Product Add-Ons <= 4.9.2 – Unauthenticated Content Injection

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-35680
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
YITH WooCommerce Product Add-Ons
Researcher

More Details >

Database Cleaner <= 1.0.5 – Authenticated (Admin+) Arbitrary File Read

4.9

CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-35712
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Database Cleaner: Clean, Optimize & Repair
Researcher

More Details >

SC filechecker <= 0.6 – Authenticated (Admin+) Arbitrary File Deletion

4.9

CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-35743
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
SC filechecker
Researcher

More Details >

Upunzipper <= 1.0.0 – Authenticated (Admin+) Arbitrary File Deletion

4.9

CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-35744
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
Upunzipper
Researcher

More Details >

WS Form LITE <= 1.9.217 – Unauthenticated CSV Injection

4.7

CVSS Rating
Medium (4.7)
CVE-ID
CVE-2023-5424
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
WS Form LITE – Drag & Drop Contact Form Builder for WordPress
WS Form Pro
Researcher

More Details >

Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content <= 0.6.8 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-35655
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
Researcher

More Details >

Custom Dash <= 1.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4942
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Custom Dash
Researcher

More Details >

Fluid Notification Bar <= 3.2.3 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3031
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Fluid Notification Bar
Researcher

More Details >

Nafeza Prayer Time <= 1.2.9 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4462
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Nafeza Prayer Time
Researcher

More Details >

Stellissimo Text Box <= 1.1.4 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-35752
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
Stellissimo Text Box
Researcher

More Details >

Visual Composer Website Builder <= 45.8.0 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-35653
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages
Researcher

More Details >

Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.4.10 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-35751
Patch Status
Unpatched
Published
Jun 6, 2024

Affected Software
Woody code snippets – Insert Header Footer Code, AdSense Ads
Researcher

More Details >

YITH WooCommerce Tab Manager <= 1.35.0 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-35698
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
YITH WooCommerce Tab Manager
Researcher

More Details >

Admin Notices Manager <= 1.4.0 – Missing Authorization to Authenticated (Subscriber+) User Email Retrieval

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1717
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Admin Notices Manager
Researcher

More Details >

Album Gallery – WordPress Gallery <= 1.5.7 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35720
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Album Gallery – WordPress Gallery
Researcher

More Details >

Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35689
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy)
Researcher

More Details >

Boostify Header Footer Builder for Elementor <= 1.3.3 – Missing Authorization to Page/Post Creation

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4788
Patch Status
Unpatched
Published
Jun 5, 2024

Affected Software
Boostify Header Footer Builder for Elementor
Researcher

More Details >

BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.19 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35726
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
Researcher

More Details >

Copymatic – AI Content Writer & Generator <= 1.9 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35716
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Copymatic – AI Content Writer & Generator
Researcher

More Details >

Dashboard To-Do List <= 1.2.0 – Missing Authorization via ardtdw_widgetsetup()

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35723
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Dashboard To-Do List
Researcher

More Details >

ElasticPress <= 5.1.0 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35684
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
ElasticPress
Researcher

More Details >

Emergency Password Reset <= 8.0 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35648
Patch Status
Patched
Published
Jun 3, 2024

Affected Software
Emergency Password Reset
Researcher

More Details >

Essential Real Estate <= 4.4.2 – Insecure Direct Object Reference to Arbitrary Attachment Deletion

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4274
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Essential Real Estate
Researcher

More Details >

Extra Product Options for WooCommerce <= 3.0.6 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35727
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Extra Product Options for WooCommerce
Researcher

More Details >

Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.2 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4088
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Gutenberg Blocks and Page Layouts – Attire Blocks
Researcher

More Details >

Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery <= 1.4.5 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35721
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery
Researcher

More Details >

KiviCare <= 3.6.2 – Authenticated (Patient+) Insecure Direct Object Reference

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35659
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
KiviCare – Clinic & Patient Management System (EHR)
Researcher

More Details >

Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 – 2.7.2 – Missing Authorization to Arbitrary Options Exposure

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5665
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Login/Signup Popup ( Inline Form + Woocommerce )
Researcher

More Details >

Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow <= 1.3.9 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35717
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Media Slider – Photo Slider, Video Slider, Link Slider, Carousal Slideshow
Researcher

More Details >

Mollie Forms <= 2.6.13 – Cross-Site Request Forgery to Arbitrary Post Duplication

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2368
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Mollie Forms
Researcher

More Details >

ProfileGrid <= 5.8.6 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5453
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
ProfileGrid – User Profiles, Groups and Communities
Researcher

More Details >

Restaurant Menu and Food Ordering <= 2.4.16 – Missing Authorization to Menu Creation

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5459
Patch Status
Patched
Published
Jun 4, 2024

Affected Software
Five Star Restaurant Menu and Food Ordering
Researcher

More Details >

Salon booking system <= 9.9 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4468
Patch Status
Patched
Published
Jun 7, 2024

Affected Software
Salon Booking System
Researcher

More Details >

Simple COD Fees for WooCommerce <= 2.0.2 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35662
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
Simple COD Fees for WooCommerce
Researcher

More Details >

Slider Responsive Slideshow – Image slider, Gallery slideshow <= 1.4.0 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35722
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Slider Responsive Slideshow – Image slider, Gallery slideshow
Researcher

More Details >

Strong Testimonials <= 3.1.12 – Authenticated(Contributor+) Improper Authorization to Views Modification

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2023-6491
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Strong Testimonials
Researcher

More Details >

Tickera <= 3.5.2.6 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35729
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Tickera – WordPress Event Ticketing
Researcher

More Details >

Tutor LMS – eLearning and online course solution <= 2.7.1 – Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5438
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Tutor LMS – eLearning and online course solution
Researcher

More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 – Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35674
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher

More Details >

Wbcom Designs – Custom Font Uploader <= 2.3.4 – Missing Authorization to Font Deletion

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5489
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
Wbcom Designs – Custom Font Uploader
Researcher

More Details >

Widget Options – Extended <= 5.1.0 & Widget Options <= 4.0.1 – Authenticated (Subscriber+) Information Disclosure

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35691
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
Widget Options – Extended
Widget Options – The #1 WordPress Widget & Block Control Plugin
Researcher

More Details >

WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5449
Patch Status
Patched
Published
Jun 5, 2024

Affected Software
WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing
Researcher

More Details >

WP Reset <= 2.02 – Missing Authorization to License Key Modification

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4661
Patch Status
Patched
Published
Jun 7, 2024

Affected Software
WP Reset – Most Advanced WordPress Reset Tool
Researcher

More Details >

WP-Recall <= 16.26.6 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-35657
Patch Status
Unpatched
Published
Jun 3, 2024

Affected Software
WP-Recall – Registration, Profile, Commerce & More
Researcher

More Details >

WP Force SSL & HTTPS SSL Redirect <= 1.66 – Missing Authorization to Settings Update

4.2

CVSS Rating
Medium (4.2)
CVE-ID
CVE-2024-5770
Patch Status
Patched
Published
Jun 7, 2024

Affected Software
WP Force SSL & HTTPS SSL Redirect
Researcher

More Details >

YITH Custom Login <= 1.7.0 – Authenticated (Admin+) Stored Cross-Site Scripting

4.0

CVSS Rating
Medium (4.0)
CVE-ID
CVE-2024-35732
Patch Status
Patched
Published
Jun 6, 2024

Affected Software
YITH Custom Login
Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (June 3, 2024 to June 9, 2024) appeared first on Wordfence.

Leave a Reply

Your email address will not be published. Required fields are marked *

*

Tap To Call