Wordfence Intelligence Weekly WordPress Vulnerability Report (March 25, 2024 to March 31, 2024)

???? Did you know we’re running a Bug Bounty Extravaganza again?

Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!

Last week, there were 375 vulnerabilities disclosed in 297 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 75 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 15,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • WAF-RULE-685 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-687 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 295
Unpatched 80

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 321
High Severity 31
Critical Severity 22

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 220
Missing Authorization 38
Cross-Site Request Forgery (CSRF) 34
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 24
Deserialization of Untrusted Data 7
Information Exposure 7
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 6
Unrestricted Upload of File with Dangerous Type 6
Authorization Bypass Through User-Controlled Key 5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 5
Server-Side Request Forgery (SSRF) 5
Use of Less Trusted Source 5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 3
Improper Input Validation 3
Guessable CAPTCHA 1
Improper Control of Generation of Code ('Code Injection') 1
Improper Neutralization of Special Elements used in a Command ('Command Injection') 1
Improper Privilege Management 1
Incomplete Blacklist to Cross-Site Scripting 1
Incorrect Privilege Assignment 1
Use of Insufficiently Random Values 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

46

32

23

23

16

14

14

14

12

11

10

9

9

8

7

6

6

6

5

5

5

5

5

4

4

4

3

3

3

3

3

3

3

2

2

2
ST

2

2

2

2

2

2

2

2

2

2

2

2

2

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
10Web Map Builder for Google Maps wd-google-maps
140+ Widgets | Best Addons For Elementor – FREE xpro-elementor-addons
A WordPress Testimonial Plugin to Showcase Testimonial Slider, Testimonial Grid and More: Solid Testimonials gs-testimonial
Action Network wp-action-network
Add Shortcodes Actions And Filters add-actions-and-filters
AdsPlace'r – Ad Manager, Inserter, AdSense Ads adsplacer
Advanced Sermons advanced-sermons
Aesop Story Engine aesop-story-engine
affiliate-toolkit – WordPress Affiliate Plugin affiliate-toolkit-starter
AI Twitter Feeds (Twitter widget & shortcode) ai-twitter-feeds
AI WP Writer – автонаполнение сайта ChatGPT 3.5, GPT 4 и изображениями лучших нейросетей ai-wp-writer
All In One Redirection all-in-one-redirection
Announcement & Notification Banner – Bulletin bulletin-announcements
Aparat for WordPress wp-aparat
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments
Appointment Calendar appointment-calendar
Author Box, Guest Author and Co-Authors for Your Posts – Molongui molongui-authorship
Awesome Support – WordPress HelpDesk & Support Plugin awesome-support
B Slider – Slider for your block editor b-slider
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net woo-bulk-editor
Better Elementor Addons better-elementor-addons
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg betterdocs
BizPrint – Print WooCommerce Order Receipts, Invoices, Labels & More. print-google-cloud-print-gcp-woocommerce
Bold Page Builder bold-page-builder
BoldGrid Easy SEO – Simple and Effective SEO boldgrid-easy-seo
Booking Activities booking-activities
Booking Package booking-package
Booster for WooCommerce woocommerce-jetpack
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content brave-popup-builder
Breeze – WordPress Cache Plugin breeze
Broken Images wp-broken-images
BuddyPress Moderation youzify-moderation
Builderall Builder for WordPress builderall-cheetah-for-wp
Bulk NoIndex & NoFollow Toolkit bulk-noindex-nofollow-toolkit-by-mad-fish
Button button
Calculated Fields Form calculated-fields-form
Calendarista Basic Edition – WordPress appointment booking system calendarista-basic-edition
Carousel Anything For WPBakery Page Builder – Touch Slider and Carousel carousel-anything
CGC Maintenance Mode cgc-maintenance-mode
Change default login logo,url and title change-default-login-logo-url-and-title
Chauffeur Taxi Booking System for WordPress chauffeur-booking-system
Check & Log Email check-email
Christmas Greetings christmas-greetings
Church Admin church-admin
CM Download Manager – Document and File Management cm-download-manager
CMP – Coming Soon & Maintenance Plugin by NiteoThemes cmp-coming-soon-maintenance
Co-marquage service-public.fr co-marquage-service-public
Collect.chat – Chatbot ⚡ collectchat
Comic Easel comic-easel
Compact WP Audio Player compact-wp-audio-player
Contact Form 7 Newsletter contact-form-7-newsletter
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce enhanced-e-commerce-for-woocommerce-store
Convert Post Types convert-post-types
Creative Image Slider – Responsive Slider Plugin creative-image-slider
CRM Perks Forms – WordPress Form Builder crm-perks-forms
Crypto Converter ⚡ Widget crypto-converter-widget
CubeWP – All-in-One Dynamic Content Framework cubewp-framework
Custom Field Bulk Editor custom-field-bulk-editor
Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce
DD Rating dd-rating
DELUCKS SEO delucks-seo
Doneren met Mollie doneren-met-mollie
Dracula Dark Mode – Enhanced Accessibility, Dark Mode & Reading Mode for WordPress dracula-dark-mode
Dropdown multisite selector dropdown-multisite-selector
DX-Watermark dx-watermark
Easy Appointments easy-appointments
Easy Form Builder easy-form-builder
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box easy-facebook-likebox
Easy Textillate easy-textillate
easy-social-share-buttons3 easy-social-share-buttons3
Ecwid Ecommerce Shopping Cart ecwid-shopping-cart
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) bdthemes-element-pack-lite
Elementor Addon Elements addon-elements-for-elementor-page-builder
Elementor Website Builder Pro elementor-pro
Elementor Website Builder – More than Just a Page Builder elementor
ElementsKit Elementor addons elementskit-lite
Email Newsletter, Marketing, Email Automation and CRM Plugin for WordPress by FluentCRM fluent-crm
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce email-subscribers
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders essential-addons-for-elementor-lite
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates essential-blocks
Event Tickets and Registration event-tickets
EventPrime – Events Calendar, Bookings and Tickets eventprime-event-calendar-management
Events Manager – Calendar, Bookings, Tickets, and more! events-manager
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin everest-backup
Exchange Rates Widget exchange-rates-widget
Exclusive Addons for Elementor exclusive-addons-for-elementor
Export and Import Users and Customers users-customers-import-export-for-wp-woocommerce
Falang multilanguage for WordPress falang
Fancy Comments WordPress fancy-facebook-comments
Favorites favorites
FG PrestaShop to WooCommerce fg-prestashop-to-woocommerce
Filter Custom Fields & Taxonomies Light filter-custom-fields-taxonomies-light
Finale Lite – Sales Countdown Timer & Discount for WooCommerce finale-woocommerce-sales-countdown-timer-discount
FlatPM – Ad Manager, AdSense and Custom Code flatpm-wp
Forminator – Contact Form, Payment Form & Custom Form Builder forminator
FOX – Currency Switcher Professional for WooCommerce woocommerce-currency-switcher
Frontend Dashboard frontend-dashboard
Fullscreen Galleria fullscreen-galleria
FV Flowplayer Video Player fv-wordpress-flowplayer
Gallery – Image and Video Gallery with Thumbnails gallery-album
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress gamipress
Geo Controller cf-geoplugin
GetResponse for WordPress getresponse-integration
Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce
Grid Shortcodes grid-shortcodes
Gutenberg Block Editor Toolkit – EditorsKit block-options
Gutenberg Blocks by Kadence Blocks – Page Builder Features kadence-blocks
Hacklog Down As PDF down-as-pdf
Hash Elements hash-elements
Header Image Slider header-image-slider
HeartThis heart-this
Hot Random Image hot-random-image
HT Mega – Absolute Addons For Elementor ht-mega-for-elementor
Hubbub Lite – Fast, Reliable Social Sharing Buttons social-pug
HUSKY – Products Filter Professional for WooCommerce woocommerce-products-filter
iCalendrier icalendrier
iFlyChat – WordPress Chat iflychat
Image Hover Effects – Elementor Addon image-hover-effects-addon-for-elementor
Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site integrate-google-drive
Kanban Boards for WordPress kanban
Klarna Payments for WooCommerce klarna-payments-for-woocommerce
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages page-builder-add
Landingi Landing Pages landingi-landing-pages
Layouts for Elementor layouts-for-elementor
Lightbox slider – Responsive Lightbox Gallery simple-lightbox-gallery
Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms limit-attempts
Link Whisper Free link-whisper
LionScripts: IP Blocker Lite ip-address-blocker
List category posts list-category-posts
Locatoraid Store Locator locatoraid
Lordicon Animated Icons lordicon-interactive-icons
LWS Optimize lws-optimize
MailChimp Forms by MailMunch mailchimp-forms-by-mailmunch
Mailster WordPress Newsletter Plugin Compatibility Tester mailster
Mang Board WP mangboard
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor master-addons
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MDTF – Meta Data and Taxonomies Filter wp-meta-data-filter-and-taxonomy-filter
Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more ilab-media-tools
Media Library Assistant media-library-assistant
Media Library Folders media-library-plus
Meta Tag Manager meta-tag-manager
Mighty Classic Pros And Cons joomdev-wp-pros-cons
Move Addons for Elementor move-addons
MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar
Multiple Page Generator Plugin – MPG multiple-pages-generator-by-porthas
MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution dc-woocommerce-multi-vendor
MyBookTable Bookstore by Stormhill Media mybooktable
Nelio Content – Best Editorial Calendar & Social Media Scheduling nelio-content
New Order Notification for Woocommerce new-order-notification-for-woocommerce
News Wall news-wall
Newsletter – Send awesome emails from WordPress newsletter
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress ninja-forms
NPS computy nps-computy
Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars
OpenID openid
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) stepbyteservice-openstreetmap
OSS Aliyun oss-aliyun
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE otter-blocks
Page Builder: Pagelayer – Drag and Drop website builder pagelayer
pageMash > Page Management pagemash
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions paid-memberships-pro
Paid Memberships Pro – Mailchimp Add On pmpro-mailchimp
Paid Memberships Pro – Payfast Gateway Add On pmpro-payfast
PDF Builder for WPForms pdf-builder-for-wpforms
PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip 3d-flipbook-dflip-lite
PDF Viewer for Elementor pdf-viewer-for-elementor
Photo Gallery by Ays – Responsive Image Gallery gallery-photo-gallery
Photo Gallery by Supsystic gallery-by-supsystic
Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress contest-gallery
Platinum SEO platinum-seo-pack
Pocket News Generator pocket-news-generator
Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress
Podlove Web Player podlove-web-player
Pods – Custom Content Types and Fields pods
Popup Builder – Create highly converting, mobile friendly marketing popups. popup-builder
Popup Cart Lite for WooCommerce woocommerce-woocart-popup-lite
Portfolio Gallery – Image Gallery Plugin portfolio-filter-gallery
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor post-and-page-builder
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) buddyforms
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks post-grid
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget post-grid-carousel-ultimate
Post-Plugin Library post-plugin-library
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) powerpack-lite-for-elementor
Premium Packages – Sell Digital Products Securely wpdm-premium-packages
Prenotazioni prenotazioni
Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin pretty-link
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) bdthemes-prime-slider-lite
Print Page block – Print the entire page or Section. print-page
Product Import Export for WooCommerce product-import-export-for-woo
ProfileGrid – User Profiles, Memberships, Groups and Communities profilegrid-user-profiles-groups-and-communities
PropertyHive propertyhive
Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress radio-player
Real Media Library: Media Library Folder & File Manager real-media-library-lite
ReDi Restaurant Reservation redi-restaurant-reservation
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login custom-registration-form-builder-with-submission-manager
Responsive flipbook wordpress plugin free download wppdf
ReviewX – Multi-criteria Rating & Reviews for WooCommerce reviewx
RoyalSlider new-royalslider
RT Easy Builder – Advanced addons for Elementor rt-easy-builder-advanced-addons-for-elementor
Salon booking system salon-booking-system
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster sellkit
SEO Backlink Monitor seo-backlink-monitor
SEO Plugin by Squirrly SEO squirrly-seo
SEO Title Tag seo-title-tag
Shipping with Venipak for WooCommerce wc-venipak-shipping
Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension shortcode-addons
Shortcodes and extra features for Phlox theme auxin-elements
Simple Ajax Chat – Add a Fast, Secure Chat Box simple-ajax-chat
Simple Buttons Creator simple-buttons-creator
Simple Revisions Delete simple-revisions-delete
Simply Static simply-static
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) sina-extension-for-elementor
Sliced Invoices – WordPress Invoice Plugin sliced-invoices
Slider by Supsystic slider-by-supsystic
Slider Hero with Animation, Video Background slider-hero
Slugs Manager: Delete Old Permalinks from WordPress Database remove-old-slugspermalinks
Social Author Bio social-autho-bio
Social Icons Widget & Block by WPZOOM social-icons-widget-by-wpzoom
SP Project & Document Manager sp-client-document-manager
Special Box for Content special-box-for-content
SpiderFAQ spider-faq
Spiffy Calendar spiffy-calendar
Spin 360 deg and 3D Model Viewer spin360
Sponsors wp-sponsors
Stackable – Page Builder Gutenberg Blocks stackable-ultimate-gutenberg-blocks
Sticky Anything toast-stick-anything
Stratum – Elementor Widgets stratum
StreamWeasels Twitch Integration streamweasels-twitch-integration
Sunshine Photo Cart: Free Client Galleries for Photographers sunshine-photo-cart
Survey Maker – Best WordPress Survey Plugin survey-maker
Sydney Toolbox sydney-toolbox
Tainacan tainacan
Tax Rate Upload tax-rate-upload
The Plus Addons for Elementor the-plus-addons-for-elementor-page-builder
The Plus Blocks for Block Editor | Gutenberg the-plus-addons-for-block-editor
Themify Event Post themify-event-post
Themify Shortcodes themify-shortcodes
Thumbs Rating thumbs-rating
Travelers' Map travelers-map
Tumult Hype Animations tumult-hype-animations
Tutor LMS Elementor Addons tutor-lms-elementor-addons
Ultimate Addons for Beaver Builder – Lite ultimate-addons-for-beaver-builder-lite
Ultimate Social Comments – Email Notification & Lazy Load ultimate-facebook-comments
underConstruction underconstruction
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor
User Rights Access Manager user-rights-access-manager
VK All in One Expansion Unit vk-all-in-one-expansion-unit
VS Contact Form very-simple-contact-form
WC Builder – WooCommerce Page Builder for WPBakery wc-builder
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible wc-frontend-manager
Web Icons icon
Webinar and Video Conference with Jitsi Meet – Create Branded Webinars for WordPress, Meetings & Livestreaming webinar-and-video-conference-with-jitsi-meet
Weekly Class Schedule weekly-class-schedule
weForms – Easy Drag & Drop Contact Form Builder For WordPress weforms
Whizzy whizzy
Wholesale For WooCommerce woocommerce-wholesale-pricing
WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) wholesalex
Woo Viet – WooCommerce for Vietnam woo-viet
WooCommerce Bookings Calendar woo-bookings-calendar
WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce cartflows
WooCommerce Multilingual & Multicurrency with WPML woocommerce-multilingual
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce
Woocommerce Social Media Share Buttons woocommerce-social-media-share-buttons
WordPress Contact Forms by Cimatti contact-forms
WordPress CRM Plugin – WP-CRM System wp-crm-system
WordPress File Upload wp-file-upload
WordPress Infinite Scroll – Ajax Load More ajax-load-more
WordPress Page Builder – Zion Builder zionbuilder
WP Change Email Sender wp-change-email-sender
WP Chat App wp-whatsapp
WP Cost Estimation & Payment Forms Builder wp-estimation-form
WP Directory Kit wpdirectorykit
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting erp
WP Express Checkout (Accept PayPal Payments Easily) wp-express-checkout
WP Fast Total Search – The Power of Indexed Search fulltext-search
WP Go Maps (formerly WP Google Maps) wp-google-maps
WP Hotel Booking wp-hotel-booking
WP Poll Maker – Best WordPress Poll Plugin for Voting Contest epoll-wp-voting
WP Post Disclaimer wp-post-disclaimer
WP Reset – Most Advanced WordPress Reset Tool wp-reset
WP Responsive Tabs horizontal vertical and accordion Tabs responsive-horizontal-vertical-and-accordion-tabs
WP Smart Import : Import any XML File to WordPress wp-smart-import
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc wp-sms
WP Travel Engine – Best Travel Booking WordPress Plugin wp-travel-engine
WP Twitter Mega Fan Box Widget wp-twitter-mega-fan-box
WP User Profile Avatar wp-user-profile-avatar
WP-Eggdrop wp-eggdrop
wp-forecast wp-forecast
WP-Lister Lite for Amazon wp-lister-for-amazon
WPBakery Page Builder Addons by Livemesh addons-for-visual-composer
WPC Badge Management for WooCommerce wpc-badge-management
WPCS – WordPress Currency Switcher Professional currency-switcher
WPFront Notification Bar wpfront-notification-bar
YITH WooCommerce Account Funds Premium yith-woocommerce-account-funds-premium
Yoo Slider – Image Slider & Video Slider yoo-slider
Zotpress zotpress

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Astra astra
Jobeleon WPJobBoard jobeleon-wpjobboard
Networker – Tech News WordPress Theme with Dark Mode networker
Newsmatic newsmatic
Nictitate nictitate
OceanWP oceanwp
Responsive responsive

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Chauffeur Taxi Booking System for WordPress <= 6.9 – Unauthenticated Arbitrary File Upload

10.0

CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-31115
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Chauffeur Taxi Booking System for WordPress
Researcher

More Details >

CRM Perks Forms <= 1.1.4 – Unauthenticated SQL Injection

10.0

CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-30498
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
CRM Perks Forms – WordPress Form Builder
Researcher

More Details >

Integrate Google Drive <= 1.3.8 – Missing Authorization to Unauthenticated Settings Modification and Export

10.0

CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-2086
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site
Researcher

More Details >

Layouts for Elementor <= 1.7 – Missing Authorization to Unauthenticated Arbitrary File Upload

10.0

CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-30533
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Layouts for Elementor
Researcher

More Details >

ProfileGrid <= 5.7.8 – Unauthenticated SQL Injection

10.0

CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-30490
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
ProfileGrid – User Profiles, Memberships, Groups and Communities
Researcher

More Details >

Salon booking system <= 9.5 – Unauthenticated Arbitrary File Upload

10.0

CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-30510
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Salon booking system
Researcher

More Details >

WP Travel Engine <= 5.7.9 – Unauthenticated SQL Injection

10.0

CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-30502
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WP Travel Engine – Best Travel Booking WordPress Plugin
Researcher

More Details >

CRM Perks Forms <= 1.1.4 – Authenticated (Contributor+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30499
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
CRM Perks Forms – WordPress Form Builder
Researcher

More Details >

CubeWP – All-in-One Dynamic Content Framework <= 1.1.12 – Authenticated (Subscriber+) Arbitrary File Upload

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30500
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
CubeWP – All-in-One Dynamic Content Framework
Researcher

More Details >

Easy Form Builder <= 3.7.4 – Authenticated (Contributor+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30535
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Easy Form Builder
Researcher

More Details >

Element Pack Elementor Addons <= 5.5.3 – Authenticated (Contributor+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30496
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Researcher

More Details >

Media Library Folders <= 8.1.7 – Authenticated (Author+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30486
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Media Library Folders
Researcher

More Details >

ProfileGrid <= 5.7.8 – Authenticated (Subscriber+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30491
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
ProfileGrid – User Profiles, Memberships, Groups and Communities
Researcher

More Details >

WP Cost Estimation & Payment Forms Builder <= 10.1.75 – Authenticated (Contributor+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30489
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WP Cost Estimation & Payment Forms Builder
Researcher

More Details >

WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.17 – Authenticated (Contributor+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30497
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WP Responsive Tabs horizontal vertical and accordion Tabs
Researcher

More Details >

Zotpress <= 7.3.7 – Authenticated (Contributor+) SQL Injection

9.9

CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30488
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Zotpress
Researcher

More Details >

MasterStudy LMS <= 3.3.0 – Unauthenticated Local File Inclusion via modal

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-2411
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Researcher

More Details >

MasterStudy LMS <= 3.3.1 – Unauthenticated Privilege Escalation via stm_lms_register AJAX Action

9.8

CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-2409
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Researcher

More Details >

10Web Map Builder for Google Maps <= 1.0.74 – Authenticated (Administrator+) SQL Injection

9.1

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-31116
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
10Web Map Builder for Google Maps
Researcher

More Details >

OSS Aliyun <= 1.4.10 – Authenticated (Administrator+) SQL Injection

9.1

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-30494
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
OSS Aliyun
Researcher

More Details >

Shortcode Addons <= 3.2.5 – Authenticated (Admin+) Arbitrary File Upload

9.1

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-31114
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension
Researcher

More Details >

WP Travel Engine <= 5.7.9 – Authenticated (Administrator+) SQL Injection

9.1

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-30504
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WP Travel Engine – Best Travel Booking WordPress Plugin
Researcher

More Details >

Button <= 1.1.28 – Authenticated (Contributor+) PHP Object Injection in button_shortcode

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1872
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
Button
Researcher

More Details >

ElementsKit Elementor addons <= 3.0.6 – Authenticated (Contributor+) Local File Inclusion in render_raw

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-2047
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
ElementsKit Elementor addons
Researcher

More Details >

Essential Addons for Elementor <= 5.9.13 – Authenticated (Author+) PHP Object Injection via error_resetpassword

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-3018
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Researcher

More Details >

Filter Custom Fields & Taxonomies Light <= 1.05 – Authenticated (Contributor+) PHP Object Injection

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-31094
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Filter Custom Fields & Taxonomies Light
Researcher

More Details >

Link Whisper Free <= 0.7.1 – Authenticated (Contributor+) PHP Object Injection

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-2693
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Link Whisper Free
Researcher

More Details >

Meta Tag Manager <= 3.0.2 – Authenticated (Subscriber+) PHP Object Injection

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1770
Patch Status
Patched
Published
Mar 27, 2024

Affected Software
Meta Tag Manager
Researcher

More Details >

Pods – Custom Content Types and Fields – Authenticated (Contributor+) Remote Code Execution

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2023-6999
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Pods – Custom Content Types and Fields
Researcher

More Details >

Pods – Custom Content Types and Fields – Authenticated (Contributor+) SQL Injection via Shortcode

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2023-6967
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Pods – Custom Content Types and Fields
Researcher

More Details >

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 – Authenticated (Contributor+) SQL Injection via Shortcode

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1990
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Researcher

More Details >

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.12.9 – Authenticated (Subscriber+) SQL Injection

8.8

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-0608
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher

More Details >

Check & Log Email <= 1.0.9 – Unauthenticated Hook Injection

8.1

CVSS Rating
High (8.1)
CVE-ID
CVE-2024-0866
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Check & Log Email
Researcher

More Details >

Hubbub Lite – Fast, Reliable Social Network Sharing Buttons <= 1.33.1 – PHP Object Injection

7.5

CVSS Rating
High (7.5)
CVE-ID
CVE-2024-2501
Patch Status
Patched
Published
Mar 27, 2024

Affected Software
Hubbub Lite – Fast, Reliable Social Sharing Buttons
Researcher

More Details >

Responsive <= 5.0.2 – Missing Authorization to HMTL Injection

7.5

CVSS Rating
High (7.5)
CVE-ID
CVE-2024-2848
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Responsive
Researchers

More Details >

Brave Popup Builder <= 0.6.5 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30453
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
Researcher

More Details >

Builderall Builder for WordPress <= 2.0.1 – Unauthenticated Server-Side Request Forgery

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30532
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Builderall Builder for WordPress
Researcher

More Details >

Everest Backup <= 2.2.4 – Authenticated (Admin+) Arbitrary File Upload

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2023-7201
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin
Researcher

More Details >

Falang multilanguage <= 1.3.47 – Authenticated (Administrator+) SQL Injection

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30495
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Falang multilanguage for WordPress
Researcher

More Details >

Favorites <= 2.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-2948
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Favorites
Researcher

More Details >

Forminator <= 1.29.0 – Unauthenticated Stored Cross-Site Scripting via File Upload

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-1794
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Forminator – Contact Form, Payment Form & Custom Form Builder
Researcher

More Details >

HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.2 – Authenticated (Admin+) Local File Inclusion

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-3061
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
HUSKY – Products Filter Professional for WooCommerce
Researcher

More Details >

Podlove Web Player <= 5.7.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-29788
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Podlove Web Player
Researcher

More Details >

Product Import Export for WooCommerce <= 2.4.1 – Authenticated(Shop Manager+) Arbitrary File Upload

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30231
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Product Import Export for WooCommerce
Researcher

More Details >

Simple Ajax Chat <= 20240216 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-2957
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Simple Ajax Chat – Add a Fast, Secure Chat Box
Researcher

More Details >

Simple Buttons Creator <=1.04 – Unauthenticated Stored Cross-Site Scripting via Add Button

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-2857
Patch Status
Unpatched
Published
Mar 25, 2024

Affected Software
Simple Buttons Creator
Researcher

More Details >

Sticky Anything <= 2.1.5 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30551
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Sticky Anything
Researcher

More Details >

WordPress Action Network 1.4.3 -Authentcated (Admin+) SQL Injection

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-2954
Patch Status
Unpatched
Published
Mar 26, 2024

Affected Software
Action Network
Researchers

More Details >

WordPress Announcement & Notification Banner Plugin – Bulletin <= 3.8.5 – Authenticated (Administrator+) SQL Injection

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30478
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Announcement & Notification Banner – Bulletin
Researcher

More Details >

WP ERP <= 1.12.9 – Authenticated (Accounting Manager+) SQL Injection

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-0913
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher

More Details >

WP ERP <= 1.12.9 – Authenticated (Accounting Manager+) SQL Injection via id

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-0952
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher

More Details >

WP ERP <= 1.12.9 – Authenticated (AccountingManager+) SQL Injection

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-0956
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher

More Details >

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.12.9 – Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-0609
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher

More Details >

Elementor Addon Elements <= 1.13.2 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-2792
Patch Status
Patched
Published
Mar 27, 2024

Affected Software
Elementor Addon Elements
Researcher

More Details >

SellKit <= 1.8.1 – Authenticated (Subscriber+) Arbitrary File Download

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-30509
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster
Researcher

More Details >

VK All in One Expansion Unit <= 9.95.0.1 – Information Exposure

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-2093
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
VK All in One Expansion Unit
Researcher

More Details >

WholesaleX <= 1.3.2 – Unauthenticated Privilege Escalation

6.5

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-30542
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing)
Researcher

More Details >

130+ Widgets | Best Addons For Elementor – FREE <= 1.4.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2250
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
140+ Widgets | Best Addons For Elementor – FREE
Researcher

More Details >

Aesop Story Engine <= 2.3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30557
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Aesop Story Engine
Researcher

More Details >

affiliate-toolkit <= 3.4.5 – Authenticated (Author+) Stored Cross-Site Scripting via ratings

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29817
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
affiliate-toolkit – WordPress Affiliate Plugin
Researcher

More Details >

AI Twitter Feeds (Twitter widget & shortcode) <= 2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31101
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
AI Twitter Feeds (Twitter widget & shortcode)
Researcher

More Details >

Aparat for WordPress <= 2.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29765
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Aparat for WordPress
Researcher

More Details >

Astra <= 4.6.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2347
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Astra
Researcher

More Details >

B Slider – Slider for your block editor <= 1.1.12 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30432
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
B Slider – Slider for your block editor
Researcher

More Details >

Better Elementor Addons <= 1.3.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30423
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Better Elementor Addons
Researcher

More Details >

Better Elementor Addons <= 1.4.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via widget links

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2280
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Better Elementor Addons
Researcher

More Details >

BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2845
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg
Researcher

More Details >

Bold Page Builder <= 4.7.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via class

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30179
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Bold Page Builder
Researcher

More Details >

BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.13 – Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1692
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
BoldGrid Easy SEO – Simple and Effective SEO
Researcher

More Details >

Carousel Anything For WPBakery Page Builder <= 2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30520
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
Carousel Anything For WPBakery Page Builder – Touch Slider and Carousel
Researcher

More Details >

Church Admin <= 4.0.26 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30197
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Church Admin
Researcher

More Details >

Church Admin <= 4.1.17 – Authenticated (Contributor+) Stored Cross-Site Scripting via meta-text

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30193
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Church Admin
Researcher

More Details >

Co-marquage service-public.fr <= 0.5.71 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29908
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Co-marquage service-public.fr
Researcher

More Details >

collectchat <= 2.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30436
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Collect.chat – Chatbot ⚡
Researcher

More Details >

Compact WP Audio Player <= 1.9.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via fileurl

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29917
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Compact WP Audio Player
Researcher

More Details >

CRM Perks Forms <= 1.1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30446
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
CRM Perks Forms – WordPress Form Builder
Researcher

More Details >

Crypto Converter Widget <= 1.8.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29930
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Crypto Converter ⚡ Widget
Researcher

More Details >

DD Rating <= 1.7.1 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30554
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
DD Rating
Researcher

More Details >

DearFlip <= 2.2.26 – Authenticated (Contributor+) Stored Cross-Site Scripting via force_fit

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29807
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip
Researcher

More Details >

Dracula Dark Mode – The Revolutionary Dark Mode Plugin For WordPress <= 1.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29771
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Dracula Dark Mode – Enhanced Accessibility, Dark Mode & Reading Mode for WordPress
Researcher

More Details >

Dropdown Multisite selector <= 0.9.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29910
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Dropdown multisite selector
Researcher

More Details >

Easy Appointments <= 3.11.18 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2842
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Easy Appointments
Researcher

More Details >

Easy Social Feed <= 6.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via fb_appid

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30180
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Researcher

More Details >

Easy Textillate <= 2.01 – Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2303
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Easy Textillate
Researcher

More Details >

Ecwid Ecommerce Shopping Cart <= 6.12.10 – Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2456
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Ecwid Ecommerce Shopping Cart
Researcher

More Details >

Element Pack Elementor Addons <= 5.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via link

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30185
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Researcher

More Details >

Elementor Addon Elements <= 1.13.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30422
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Elementor Addon Elements
Researcher

More Details >

Elementor Website Builder – More than Just a Page Builder <= 3.20.2 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2117
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Elementor Website Builder – More than Just a Page Builder
Researcher

More Details >

Elementor Website Builder Pro <= 3.20.1 – Authententicated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1364
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Elementor Website Builder Pro
Researcher

More Details >

Elementor Website Builder Pro <= 3.20.1 – Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2781
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Elementor Website Builder Pro
Researcher

More Details >

Elementor Website Builder Pro <= 3.20.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1521
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Elementor Website Builder Pro
Researcher

More Details >

ElementsKit Elementor addons <= 3.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1238
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
ElementsKit Elementor addons
Researcher

More Details >

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2623
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Researcher

More Details >

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2650
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Researchers

More Details >

Events Manager <= 6.4.7.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2111
Patch Status
Patched
Published
Mar 27, 2024

Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher

More Details >

Exchange Rates Widget <= 1.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29814
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Exchange Rates Widget
Researcher

More Details >

Exclusive Addons Elementor <= 2.6.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30177
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Exclusive Addons for Elementor
Researcher

More Details >

Exclusive Addons Elementor <= 2.6.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30232
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Exclusive Addons for Elementor
Researcher

More Details >

Fancy Comments WordPress <= 1.2.14 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29804
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Fancy Comments WordPress
Researcher

More Details >

FlatPM < 3.1.05 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29803
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
FlatPM – Ad Manager, AdSense and Custom Code
Researcher

More Details >

Frontend Dashboard <= 2.2.1 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29775
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Frontend Dashboard
Researcher

More Details >

Fullscreen Galleria <= 1.6.11 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29801
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Fullscreen Galleria
Researcher

More Details >

GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2783
Patch Status
Patched
Published
Mar 27, 2024

Affected Software
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress
Researcher

More Details >

Geo Controller <= 8.6.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30451
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Geo Controller
Researcher

More Details >

GetResponse for WordPress <= 5.5.33 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31104
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
GetResponse for WordPress
Researcher

More Details >

Gratisfaction <= 4.3.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29798
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program
Researcher

More Details >

Grid Shortcodes <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29797
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Grid Shortcodes
Researcher

More Details >

GS Testimonial Slider <= 3.1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30443
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
A WordPress Testimonial Plugin to Showcase Testimonial Slider, Testimonial Grid and More: Solid Testimonials
Researcher

More Details >

Gutenberg Block Editor Toolkit – EditorsKit <= 1.40.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2794
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Gutenberg Block Editor Toolkit – EditorsKit
Researcher

More Details >

Gutenberg Blocks by Kadence Blocks <= 3.2.25 – Authenticated (Author+) Server-Side Request Forgery

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-24888
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Gutenberg Blocks by Kadence Blocks – Page Builder Features
Researcher

More Details >

Hash Elements <= 1.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30426
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Hash Elements
Researcher

More Details >

HeartThis <= 0.1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31121
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
HeartThis
Researcher

More Details >

Hot Random Image <= 1.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29796
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Hot Random Image
Researcher

More Details >

HT Mega <= 2.4.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30182
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
HT Mega – Absolute Addons For Elementor
Researcher

More Details >

iCalendrier <= 1.80 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29912
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
iCalendrier
Researcher

More Details >

iFlyChat – WordPress Chat <= 4.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31108
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
iFlyChat – WordPress Chat
Researcher

More Details >

Image Hover Effects – Elementor Addon <= 1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'eihe_align'

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29936
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Image Hover Effects – Elementor Addon
Researcher

More Details >

List category posts <= 0.89.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1051
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
List category posts
Researcher

More Details >

Livemesh Addons for WPBakery Page Builder <= 3.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30183
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WPBakery Page Builder Addons by Livemesh
Researcher

More Details >

Lordicon Animated Icons <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30519
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
Lordicon Animated Icons
Researcher

More Details >

MailChimp Forms by MailMunch <= 3.2.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29793
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
MailChimp Forms by MailMunch
Researcher

More Details >

Master Addons for Elementor <= 2.0.5.4.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29911
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Researcher

More Details >

Master Addons for Elementor <= 2.0.5.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2139
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Researcher

More Details >

Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more <= 4.5.24 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29795
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more
Researcher

More Details >

Media Library Assistant <= 3.13 – Authenticated (Contributor+) SQL Injection via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2871
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Media Library Assistant
Researcher

More Details >

Media Library Assistant <= 3.13 – Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2475
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Media Library Assistant
Researcher

More Details >

Mighty Classic Pros And Cons <= 2.0.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30556
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Mighty Classic Pros And Cons
Researcher

More Details >

MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30530
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Researcher

More Details >

MyBookTable Bookstore <= 3.3.7 – Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29772
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
MyBookTable Bookstore by Stormhill Media
Researcher

More Details >

Nelio Content <= 3.2.0 – Authenticated (Contributor+) Server-Side Request Forgery

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30531
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Nelio Content – Best Editorial Calendar & Social Media Scheduling
Researcher

More Details >

Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29762
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Off-Canvas Sidebars & Menus (Slidebars)
Researcher

More Details >

OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) <= 1.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30450
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
Researcher

More Details >

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2841
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Researcher

More Details >

Otter Blocks <= 2.6.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2729
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Researcher

More Details >

PDF Builder for WPForms <= 1.2.88 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29820
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
PDF Builder for WPForms
Researcher

More Details >

PDF Viewer for Elementor <= 2.9.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30524
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
PDF Viewer for Elementor
Researcher

More Details >

Popup Builder <= 4.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30184
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Popup Builder – Create highly converting, mobile friendly marketing popups.
Researcher

More Details >

Portfolio Gallery – Image Gallery Plugin <= 1.5.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29769
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Portfolio Gallery – Image Gallery Plugin
Researcher

More Details >

Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.26.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2888
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
Researcher

More Details >

Post Grid, Slider & Carousel Ultimate <= 1.6.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29925
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget
Researcher

More Details >

PowerPack Addons for Elementor <= 2.7.17 – Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag*

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2491
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
Researcher

More Details >

PowerPack Addons for Elementor <= 2.7.18 – Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2492
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
Researcher

More Details >

Prime Slider – Addons For Elementor <= 3.13.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via title

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30186
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)
Researcher

More Details >

Print Page block <= 1.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30438
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Print Page block – Print the entire page or Section.
Researcher

More Details >

Real Media Library: Media Library Folder & File Manager <= 4.22.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2027
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Real Media Library: Media Library Folder & File Manager
Researchers

More Details >

Responsive flipbook <= 1.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30552
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Responsive flipbook wordpress plugin free download
Researcher

More Details >

Responsive Image Gallery, Gallery Album <= 2.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31120
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Gallery – Image and Video Gallery with Thumbnails
Researcher

More Details >

ReviewX <= 1.6.22 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29812
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
ReviewX – Multi-criteria Rating & Reviews for WooCommerce
Researcher

More Details >

Sina Extension for Elementor <= 3.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29935
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)
Researcher

More Details >

SP Project & Document Manager <= 4.70 – Missing Authorization Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31118
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
SP Project & Document Manager
Researcher

More Details >

Spin 360 deg and 3D Model Viewer <= 1.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30559
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Spin 360 deg and 3D Model Viewer
Researcher

More Details >

Sponsors <= 3.5.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30483
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
Sponsors
Researcher

More Details >

Stackable – Page Builder Gutenberg Blocks <= 3.12.11 – Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Block

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2039
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Stackable – Page Builder Gutenberg Blocks
Researchers

More Details >

Stratum <= 1.3.15 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29914
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Stratum – Elementor Widgets
Researcher

More Details >

StreamWeasels Twitch Integration <= 1.7.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29766
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
StreamWeasels Twitch Integration
Researcher

More Details >

Sydney Toolbox <= 1.26 – Authenticated (Contributor+) Stored Cross-Site Scripting via _id

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2936
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Sydney Toolbox
Researchers

More Details >

The Plus Addons for Elementor <= 5.4.1 – Authenticated (Contributor+) Local File Inclusion via Clients Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2203
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
The Plus Addons for Elementor
Researcher

More Details >

The Plus Addons for Elementor <= 5.4.1 – Authenticated (Contributor+) Local File Inclusion via Team Member Listing

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2210
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
The Plus Addons for Elementor
Researcher

More Details >

Travelers' Map <= 2.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29909
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Travelers' Map
Researcher

More Details >

Tutor LMS Elementor Addons <= 2.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29913
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Tutor LMS Elementor Addons
Researcher

More Details >

Ultimate Addons for Beaver Builder – Lite <= 1.5.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2140
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Ultimate Addons for Beaver Builder – Lite
Researcher

More Details >

Ultimate Addons for Beaver Builder – Lite <= 1.5.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2141
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Ultimate Addons for Beaver Builder – Lite
Researcher

More Details >

Ultimate Addons for Beaver Builder – Lite <= 1.5.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2143
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Ultimate Addons for Beaver Builder – Lite
Researcher

More Details >

Ultimate Addons for Beaver Builder – Lite <= 1.5.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2144
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Ultimate Addons for Beaver Builder – Lite
Researcher

More Details >

Ultimate Addons for Beaver Builder – Lite <= 1.5.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2142
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Ultimate Addons for Beaver Builder – Lite
Researcher

More Details >

Ultimate Social Comments – Email Notification & Lazy Load <= 1.4.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30555
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Ultimate Social Comments – Email Notification & Lazy Load
Researcher

More Details >

Unlimited Elements For Elementor <= 1.5.96 – Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0367
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher

More Details >

VK All in One Expansion Unit <= 9.96.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via className

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2170
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
VK All in One Expansion Unit
Researchers

More Details >

WC Builder <= 1.0.18 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29926
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WC Builder – WooCommerce Page Builder for WPBakery
Researcher

More Details >

WC Marketplace <= 4.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30433
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution
Researcher

More Details >

Web Icons <= 1.0.0.10 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30445
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Web Icons
Researcher

More Details >

Web Icons <= 1.0.0.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29933
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Web Icons
Researcher

More Details >

Webinar and Video Conference with Jitsi Meet <= 2.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30437
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Webinar and Video Conference with Jitsi Meet – Create Branded Webinars for WordPress, Meetings & Livestreaming
Researcher

More Details >

WooCommerce Bookings Calendar <= 1.0.36 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31117
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
WooCommerce Bookings Calendar
Researcher

More Details >

WordPress File Upload <= 4.24.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2847
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
WordPress File Upload
Researcher

More Details >

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29906
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher

More Details >

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29932
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher

More Details >

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29763
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher

More Details >

WP Chat App <= 3.6.2 – Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2513
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
WP Chat App
Researcher

More Details >

WP Fast Total Search <= 1.59.211 – Authenticated (Contributor+) Stored Cross-Site Scripting via WPFTS Live Search Widget

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29799
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WP Fast Total Search – The Power of Indexed Search
Researcher

More Details >

WP Post Disclaimer <= 1.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29761
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WP Post Disclaimer
Researcher

More Details >

WP User Profile Avatar <= 1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2023-6067
Patch Status
Unpatched
Published
Mar 25, 2024

Affected Software
WP User Profile Avatar
Researcher

More Details >

wp-forecast <= 9.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30429
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
wp-forecast
Researcher

More Details >

WPFront Notification Bar <= 3.3.2 – Authenticated (Editor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29819
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WPFront Notification Bar
Researcher

More Details >

Add Shortcodes Actions And Filters <= 2.10 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30558
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Add Shortcodes Actions And Filters
Researcher

More Details >

AdsPlace'r – Ad Manager, Inserter, AdSense Ads <= 1.1.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31088
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
AdsPlace'r – Ad Manager, Inserter, AdSense Ads
Researcher

More Details >

Advanced Sermons <= 3.1 – Reflected Cross-Site Scripting via s

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29928
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Advanced Sermons
Researcher

More Details >

All In One Redirection <= 2.2.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30506
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
All In One Redirection
Researcher

More Details >

Appointment Calendar <= 2.9.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30561
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Appointment Calendar
Researcher

More Details >

BizPrint <= 4.5.4 – Cross-Site Request Forgery to Cross-Site Scripting via process.php

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29773
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
BizPrint – Print WooCommerce Order Receipts, Invoices, Labels & More.
Researcher

More Details >

Booking Activities <= 1.15.19 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30449
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Booking Activities
Researcher

More Details >

Booster for WooCommerce <= 7.1.7 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29760
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Booster for WooCommerce
Researcher

More Details >

BuddyForms <= 2.8.5 – Reflected Cross-Site Scripting via page

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30198
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Researcher

More Details >

Buddypress Moderation <= 1.2.5 – Unauthenticated Stored Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-2864
Patch Status
Unpatched
Published
Mar 25, 2024

Affected Software
BuddyPress Moderation
Researcher

More Details >

Bulk NoIndex & NoFollow Toolkit <= 2.01 – Reflected Cross-Site Scripting via tab, order, and orderby

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29791
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Bulk NoIndex & NoFollow Toolkit
Researcher

More Details >

Calculated Fields Form <= 1.2.54 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29759
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Calculated Fields Form
Researcher

More Details >

Christmas Greetings <= 1.2.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-2116
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
Christmas Greetings
Researcher

More Details >

Co-marquage service-public.fr <= 0.5.72 – Reflected Cross-Site Scripting via search_term

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29758
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Co-marquage service-public.fr
Researcher

More Details >

Comic Easel <= 1.15 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31092
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Comic Easel
Researcher

More Details >

Contact Form 7 Newsletter <= 2.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31110
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Contact Form 7 Newsletter
Researcher

More Details >

Contest Gallery <= 21.3.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30428
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress
Researcher

More Details >

Conversios.io <= 6.9.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29794
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
Researcher

More Details >

Convert Post Types <= 1.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31112
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Convert Post Types
Researcher

More Details >

Creative Image Slider – Responsive Slider Plugin <= 2.1.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30447
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Creative Image Slider – Responsive Slider Plugin
Researcher

More Details >

Custom Field Bulk Editor <= 1.9.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31091
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Custom Field Bulk Editor
Researcher

More Details >

Doneren met Mollie <= 2.10.2 – Unauthenticated Reflected Cross-Site Scripting via search

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29767
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Doneren met Mollie
Researcher

More Details >

Easy Social Share Buttons <= 9.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30196
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
easy-social-share-buttons3
Researcher

More Details >

Email Subscribers & Newsletters <= 5.7.11 – Reflected Cross-Site Scripting via campaign_id

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-22300
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Researcher

More Details >

Forminator <= 1.29.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29777
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Forminator – Contact Form, Payment Form & Custom Form Builder
Researcher

More Details >

FV Flowplayer Video Player <= 7.5.41.7212 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-22299
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
FV Flowplayer Video Player
Researcher

More Details >

Hacklog Down As PDF <= 2.3.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31090
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Hacklog Down As PDF
Researcher

More Details >

Header Image Slider <= 0.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30547
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Header Image Slider
Researcher

More Details >

Jobeleon Theme <= 1.9.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2022-47153
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Jobeleon WPJobBoard
Researcher

More Details >

Kanban Boards for WordPress <= 2.5.21 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31103
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Kanban Boards for WordPress
Researcher

More Details >

Limit Attempts by BestWebSoft <= 1.2.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30439
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms
Researcher

More Details >

Mailster <= 1.0.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30503
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Mailster WordPress Newsletter Plugin Compatibility Tester
Researcher

More Details >

Mang Board WP <= 1.8.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30431
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Mang Board WP
Researcher

More Details >

OpenID <= 3.6.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31107
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
OpenID
Researcher

More Details >

pageMash > Page Management <= 1.3.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31087
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
pageMash > Page Management
Researcher

More Details >

Photo Gallery by Ays <= 5.5.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29919
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Photo Gallery by Ays – Responsive Image Gallery
Researcher

More Details >

Podlove Podcast Publisher <= 4.0.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29915
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Podlove Podcast Publisher
Researcher

More Details >

Post Grid <= 2.2.74 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30441
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Researcher

More Details >

Post-Plugin Library <= 2.6.2.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31085
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Post-Plugin Library
Researcher

More Details >

Premium Packages <= 5.8.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29924
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Premium Packages – Sell Digital Products Securely
Researcher

More Details >

PropertyHive <= 2.0.8 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29923
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
PropertyHive
Researcher

More Details >

ReDi Restaurant Reservation <= 24.0128 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29806
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
ReDi Restaurant Reservation
Researcher

More Details >

Responsive Image Gallery, Gallery Album <= 2.0.3 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30550
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Gallery – Image and Video Gallery with Thumbnails
Researcher

More Details >

RoyalSlider <= 3.4.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30195
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
RoyalSlider
Researcher

More Details >

SEO Backlink Monitor <= 1.5.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29907
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
SEO Backlink Monitor
Researcher

More Details >

SEO Plugin by Squirrly SEO <= 12.3.16 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29790
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
SEO Plugin by Squirrly SEO
Researcher

More Details >

SEO Title Tag <= 3.5.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31097
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
SEO Title Tag
Researcher

More Details >

Shipping with Venipak for WooCommerce <= 1.19.5 – Reflected Cross-Site Scripting via 'venipak_labels_link'

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29805
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Shipping with Venipak for WooCommerce
Researcher

More Details >

Shortlinks by Pretty Links <= 3.6.2 – Reflected Cross-Site Scripting via post_status

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29770
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Researcher

More Details >

Simply Schedule Appointments <= 1.6.6.20 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-22311
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Researcher

More Details >

Social Author Bio <= 2.4 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30545
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Social Author Bio
Researcher

More Details >

SpiderFAQ <= 1.3.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31123
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
SpiderFAQ
Researcher

More Details >

Spiffy Calendar <= 4.9.7 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30427
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Spiffy Calendar
Researcher

More Details >

Sunshine Photo Cart <= 3.1.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30194
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Sunshine Photo Cart: Free Client Galleries for Photographers
Researcher

More Details >

Survey Maker <= 4.0.6 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29918
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Survey Maker – Best WordPress Survey Plugin
Researcher

More Details >

Tax Rate Upload <= 2.4.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31105
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Tax Rate Upload
Researcher

More Details >

The Plus Blocks for Block Editor | Gutenberg <= 3.2.5 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30435
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
The Plus Blocks for Block Editor | Gutenberg
Researcher

More Details >

Tumult Hype Animations <= 1.9.11 – Cross-Site Request Forgery to Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30461
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Tumult Hype Animations
Researcher

More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.93 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29792
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher

More Details >

User Rights Access Manager <= 1.1.2 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31122
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
User Rights Access Manager
Researcher

More Details >

Weekly Class Schedule <= 3.19 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31084
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Weekly Class Schedule
Researcher

More Details >

WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.0 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-22288
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Researcher

More Details >

Woocommerce Social Media Share Buttons <= 1.3.0 – Cross-Site Request Forgery to Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31109
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Woocommerce Social Media Share Buttons
Researcher

More Details >

WordPress Importer <= 1.0.4 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30201
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WP Smart Import : Import any XML File to WordPress
Researcher

More Details >

WP Directory Kit <= 1.2.9 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29774
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WP Directory Kit
Researcher

More Details >

WP Google Maps <= 9.0.29 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29931
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WP Go Maps (formerly WP Google Maps)
Researcher

More Details >

WP-Lister Lite for Amazon <= 2.6.8 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30199
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WP-Lister Lite for Amazon
Researcher

More Details >

Yoo Slider <= 2.1.1 – Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31106
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Yoo Slider – Image Slider & Video Slider
Researcher

More Details >

WP Reset <= 1.99 – Sensitive Information Exposure due to Insufficient Randomness

5.9

CVSS Rating
Medium (5.9)
CVE-ID
CVE-2023-6799
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
WP Reset – Most Advanced WordPress Reset Tool
Researcher

More Details >

AI WP Writer <= 3.6.5 – Missing Authorization

5.6

CVSS Rating
Medium (5.6)
CVE-ID
CVE-2024-30459
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
AI WP Writer – автонаполнение сайта ChatGPT 3.5, GPT 4 и изображениями лучших нейросетей
Researcher

More Details >

Astra <= 4.6.4 – Authenticated (Editor+) Stored Cross-Site Scripting via Theme Header/Footer

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29768
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Astra
Researcher

More Details >

Breeze <= 2.1.3 – Authenticated (Administrator+) Stored Cross-Site Scripting via breeze_api_token

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-27188
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Breeze – WordPress Cache Plugin
Researcher

More Details >

CMP – Coming Soon & Maintenance <= 4.1.10 – Authenticated (Admin+) Server-Side Request Forgery

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2023-50374
Patch Status
Patched
Published
Mar 27, 2024

Affected Software
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
Researcher

More Details >

EventPrime <= 3.3.9 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29776
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
EventPrime – Events Calendar, Bookings and Tickets
Researcher

More Details >

Funnel Builder by CartFlows <= 2.0.1 – Authenticated (Editor+) Stored Cross-Site Scripting via settings

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29813
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce
Researcher

More Details >

Locatoraid Store Locator <= 3.9.30 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-30181
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Locatoraid Store Locator
Researcher

More Details >

Molongui <= 4.7.7 – Authenticated (Author+) Stored Cross-Site Scripting

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29764
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Author Box, Guest Author and Co-Authors for Your Posts – Molongui
Researcher

More Details >

Photo Gallery by Supsystic <= 1.15.16 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29921
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Photo Gallery by Supsystic
Researcher

More Details >

Simply Static <= 3.1.3 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-30178
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Simply Static
Researcher

More Details >

Slider Hero <= 8.6.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

5.5

CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29922
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Slider Hero with Animation, Video Background
Researcher

More Details >

Elementor Addon Elements <= 1.13.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2091
Patch Status
Patched
Published
Mar 27, 2024

Affected Software
Elementor Addon Elements
Researcher

More Details >

Elementor Website Builder Pro <= 3.20.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2121
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Elementor Website Builder Pro
Researcher

More Details >

Elementor Website Builder Pro <= 3.20.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2120
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Elementor Website Builder Pro
Researcher

More Details >

Finale Lite <= 2.18.0 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-30485
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Finale Lite – Sales Countdown Timer & Discount for WooCommerce
Researcher

More Details >

Lightbox slider – Responsive Lightbox Gallery <= 1.9.9 – Authenticated (Contributor+) PHP Object Injection

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1858
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
Lightbox slider – Responsive Lightbox Gallery
Researcher

More Details >

Pocket News Generator <= 0.2.0 – Cross-Site Request Forgery to Settings Update

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2964
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
Pocket News Generator
Researcher

More Details >

Themify Shortcodes <= 2.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2732
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Themify Shortcodes
Researcher

More Details >

Whizzy <= 1.1.18 – Authenticated (Subscriber+) Insecure Direct Object Reference

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-30543
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Whizzy
Researcher

More Details >

WP-Eggdrop <= 0.1 – Cross-Site Request Forgery to Settings Update

5.4

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2969
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
WP-Eggdrop
Researcher

More Details >

Awesome Support <= 6.1.7 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30539
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Awesome Support – WordPress HelpDesk & Support Plugin
Researcher

More Details >

BEAR <= 1.1.4.3 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30463
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Researcher

More Details >

Booking Package <= 1.6.27 – Unauthenticated Price Manipulation

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30516
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Booking Package
Researcher

More Details >

Calendarista Basic Edition <= 3.0.5 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30534
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Calendarista Basic Edition – WordPress appointment booking system
Researcher

More Details >

CGC Maintenance Mode <= 1.2 – IP Spoofing

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30480
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
CGC Maintenance Mode
Researcher

More Details >

DELUCKS SEO <= 2.5.4 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30538
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
DELUCKS SEO
Researcher

More Details >

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 – Unauthenticated Sensitive Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2974
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Researcher

More Details >

FG PrestaShop to WooCommerce <= 4.45.1 – Unauthenticated Sensitive Information Disclosure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30511
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
FG PrestaShop to WooCommerce
Researcher

More Details >

IP Blocker Lite <= 11.1.1 – IP Spoofing

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30479
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
LionScripts: IP Blocker Lite
Researcher

More Details >

Klarna Payments for WooCommerce <= 3.2.4 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30477
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Klarna Payments for WooCommerce
Researcher

More Details >

Move Addons for Elementor <= 1.2.9 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30525
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Move Addons for Elementor
Researcher

More Details >

Networker – Tech News WordPress Theme with Dark Mode <= 1.1.9 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2962
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Networker – Tech News WordPress Theme with Dark Mode
Researcher

More Details >

Newsletter <= 8.2.0 – IP Spoofing

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30522
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Newsletter – Send awesome emails from WordPress
Researcher

More Details >

Newsmatic <= 1.3.4 – Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_content

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1587
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Newsmatic
Researcher

More Details >

Paid Memberships Pro – Mailchimp Add On <= 2.3.4 – Unauthenticated Information Disclosure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30523
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Paid Memberships Pro – Mailchimp Add On
Researcher

More Details >

Paid Memberships Pro – Payfast Gateway Add On <= 1.4.1 – Unauthenticated Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30514
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Paid Memberships Pro – Payfast Gateway Add On
Researcher

More Details >

Radio Player <= 2.0.73 – Missing Authorization via get_players

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2906
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress
Researcher

More Details >

RT Easy Builder – Advanced addons for Elementor <= 2.0 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30484
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
RT Easy Builder – Advanced addons for Elementor
Researcher

More Details >

Simple Buttons Creator <=1.04 – Cross-Site Request Forgery to Arbitrary Button Deletion

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2858
Patch Status
Unpatched
Published
Mar 25, 2024

Affected Software
Simple Buttons Creator
Researcher

More Details >

Tainacan <= 0.20.7 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30529
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Tainacan
Researcher

More Details >

Thumbs Rating <= 5.1.0 – Unauthenticated Insecure Direct Object Reference

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-31095
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Thumbs Rating
Researcher

More Details >

VS Contact Form <= 14.7 – CAPTCHA Bypass

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30540
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
VS Contact Form
Researcher

More Details >

weForms <= 1.6.20 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30512
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
weForms – Easy Drag & Drop Contact Form Builder For WordPress
Researcher

More Details >

Whizzy <= 1.1.18 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30544
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Whizzy
Researcher

More Details >

Wholesale For WooCommerce <= 2.3.0 – Unauthenticated Information Exposure

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30469
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Wholesale For WooCommerce
Researcher

More Details >

WP Express Checkout (Accept PayPal Payments) <= 2.3.7 – Unauthenticated Price Manipulation

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30527
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
WP Express Checkout (Accept PayPal Payments Easily)
Researcher

More Details >

WP Hotel Booking <= 2.0.9.2 – Missing Authorization

5.3

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30508
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WP Hotel Booking
Researcher

More Details >

Ajax Load More <= 7.0.1 – Authenticated (Admin+) Directory Traversal to Arbitrary File Read

4.9

CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-1790
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
WordPress Infinite Scroll – Ajax Load More
Researcher

More Details >

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 – Authenticated (Author+) Stored Cross-Site Scripting

4.6

CVSS Rating
Medium (4.6)
CVE-ID
CVE-2024-2108
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Researcher

More Details >

Ajax Load More <= 7.0.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
Unknown
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WordPress Infinite Scroll – Ajax Load More
Researcher

More Details >

Contact Forms by Cimatti <= 1.8.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30549
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
WordPress Contact Forms by Cimatti
Researcher

More Details >

Fluent CRM <= 2.8.44 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30430
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Email Newsletter, Marketing, Email Automation and CRM Plugin for WordPress by FluentCRM
Researcher

More Details >

Landing Page Builder <= 1.5.1.7 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30452
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages
Researcher

More Details >

NPS computy <= 2.7.5 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-1754
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
NPS computy
Researcher

More Details >

Platinum SEO <= 2.4.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-31089
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Platinum SEO
Researcher

More Details >

Pocket News Generator <= 0.2.0 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2963
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
Pocket News Generator
Researcher

More Details >

Prenotazioni <= 1.7.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-31102
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Prenotazioni
Researcher

More Details >

Simple Ajax Chat <= 20231101 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2956
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Simple Ajax Chat – Add a Fast, Secure Chat Box
Researcher

More Details >

Slider by Supsystic <= 1.8.10 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30448
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Slider by Supsystic
Researcher

More Details >

Special Box for Content <= 1 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-31119
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Special Box for Content
Researcher

More Details >

Themify Event Post <= 1.2.7 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30440
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Themify Event Post
Researcher

More Details >

underConstruction <= 1.21 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30548
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
underConstruction
Researcher

More Details >

WCFM – Frontend Manager for WooCommerce <= 6.7.8 – Authenticated (Shop manager+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-29929
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
Researcher

More Details >

Woo Viet <= 1.5.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-29816
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Woo Viet – WooCommerce for Vietnam
Researcher

More Details >

WordPress Page Builder – Zion Builder <= 3.6.9 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30444
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WordPress Page Builder – Zion Builder
Researcher

More Details >

WP Change Email Sender <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-29815
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WP Change Email Sender
Researcher

More Details >

WP Poll Maker <= 3.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-29818
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
WP Poll Maker – Best WordPress Poll Plugin for Voting Contest
Researcher

More Details >

WP Twitter Mega Fan Box Widget <= 1.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30553
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
WP Twitter Mega Fan Box Widget
Researcher

More Details >

WP-CRM System <= 3.2.9 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30434
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WordPress CRM Plugin – WP-CRM System
Researcher

More Details >

WP-Eggdrop <= 0.1 – Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2968
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
WP-Eggdrop
Researcher

More Details >

WP-Lister Lite for Amazon <= 2.6.11 – Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2889
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
WP-Lister Lite for Amazon
Researcher

More Details >

Broken Images <= 0.2 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31093
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Broken Images
Researcher

More Details >

Change default login logo,url and title <= 2.0 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31086
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Change default login logo,url and title
Researcher

More Details >

Church Admin <= 4.1.18 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30505
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Church Admin
Researcher

More Details >

Church Admin <= 4.1.7 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30493
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Church Admin
Researcher

More Details >

CM Download Manager < 2.9.0 – Cross-Site Request Forgery via delHeader

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1232
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
CM Download Manager – Document and File Management
Researcher

More Details >

CM Download Manager < 2.9.0 – Cross-Site Request Forgery via unpublishHeader

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1231
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
CM Download Manager – Document and File Management
Researcher

More Details >

CM Download Manager < 2.9.1 – Cross-Site Request Forgery via editHeader

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1962
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
CM Download Manager – Document and File Management
Researcher

More Details >

Custom WooCommerce Checkout Fields Editor <= 1.3.0 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30518
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Custom WooCommerce Checkout Fields Editor
Researcher

More Details >

DX-Watermark <= 1.0.4 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30560
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
DX-Watermark
Researcher

More Details >

Easy Appointments <= 3.11.18 – Insufficient Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2844
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Easy Appointments
Researcher

More Details >

Easy Social Feed <= 6.5.6 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30526
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Researcher

More Details >

Essential Blocks for Gutenberg <= 4.4.9 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30467
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Researcher

More Details >

Event Tickets and Registration <= 5.8.2 – Improper Authorization to Information Disclosure

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2261
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Event Tickets and Registration
Researcher

More Details >

Events Manager <= 6.4.6.4 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30515
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher

More Details >

Events Manager <= 6.4.7.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30421
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher

More Details >

Events Manager <= 6.4.7.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2110
Patch Status
Patched
Published
Mar 27, 2024

Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher

More Details >

GamiPress <= 6.8.5 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30455
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress
Researcher

More Details >

HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.5.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30462
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
HUSKY – Products Filter Professional for WooCommerce
Researcher

More Details >

Landingi Landing Pages <= 3.1.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30521
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Landingi Landing Pages
Researcher

More Details >

LWS Optimize <= 1.9.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30541
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
LWS Optimize
Researcher

More Details >

Molongui <= 4.7.7 – Authenticated (Author+) Insecure Direct Object Reference

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30507
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Author Box, Guest Author and Co-Authors for Your Posts – Molongui
Researcher

More Details >

MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30487
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Researcher

More Details >

Multiple Page Generator Plugin – MPG <= 3.4.0 – Missing Authorization via mpg_get_log_by_project_id

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30235
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
Multiple Page Generator Plugin – MPG
Researcher

More Details >

New Order Notification for Woocommerce <= 2.0.2 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31098
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
New Order Notification for Woocommerce
Researcher

More Details >

News Wall <= 1.1.0 – Cross-Site Request Forgery to Plugin Settings Update

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2970
Patch Status
Unpatched
Published
Mar 28, 2024

Affected Software
News Wall
Researcher

More Details >

Nictitate <= 1.1.4 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31096
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Nictitate
Researcher

More Details >

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 – Cross-Site Request Forgery to Publicly Accessible Form Submission Export

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2113
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Researcher

More Details >

NPS computy <= 2.7.5 – Cross-Site Request Forgery to Results Deletion

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1755
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
NPS computy
Researcher

More Details >

OceanWP <= 3.5.4 – Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2476
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
OceanWP
Researcher

More Details >

PageLayer <= 1.8.1 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30465
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Page Builder: Pagelayer – Drag and Drop website builder
Researcher

More Details >

Paid Memberships Pro <= 2.12.10 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-0588
Patch Status
Patched
Published
Mar 25, 2024

Affected Software
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Researcher

More Details >

Pods – Custom Content Types and Fields – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2023-6965
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Pods – Custom Content Types and Fields
Researcher

More Details >

Popup Cart Lite for WooCommerce <= 1.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31100
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Popup Cart Lite for WooCommerce
Researcher

More Details >

ProfileGrid <= 5.7.2 – Authenticated (Subscriber+) Insecure Direct Object Reference

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30513
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
ProfileGrid – User Profiles, Memberships, Groups and Communities
Researcher

More Details >

RegistrationMagic <= 5.3.0.0 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2951
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Researcher

More Details >

Shortcodes and extra features for Phlox theme <= 2.15.5 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31099
Patch Status
Unpatched
Published
Mar 29, 2024

Affected Software
Shortcodes and extra features for Phlox theme
Researcher

More Details >

Simple Revisions Delete <= 1.5.3 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30482
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Simple Revisions Delete
Researcher

More Details >

Sliced Invoices <= 3.9.2 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30517
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Sliced Invoices – WordPress Invoice Plugin
Researcher

More Details >

Slugs Manager <= 2.6.7 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30536
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Slugs Manager: Delete Old Permalinks from WordPress Database
Researcher

More Details >

Social Icons Widget & Block by WPZOOM <= 4.2.15 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30464
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Social Icons Widget & Block by WPZOOM
Researcher

More Details >

Spiffy Calendar <= 4.9.10 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30528
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
Spiffy Calendar
Researcher

More Details >

WholesaleX <= 1.3.1 – Authenticated(Subscriber+) Missing Authorization via multiple AJAX actions

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30234
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing)
Researcher

More Details >

WholesaleX <= 1.3.1 – Sensitive Information Exposure via export_users

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30233
Patch Status
Patched
Published
Mar 26, 2024

Affected Software
WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing)
Researcher

More Details >

WooCommerce Multilingual & Multicurrency <= 5.3.4 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30466
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WooCommerce Multilingual & Multicurrency with WPML
Researcher

More Details >

WOOCS – WooCommerce Currency Switcher <= 1.4.1.7 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30458
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
FOX – Currency Switcher Professional for WooCommerce
Researcher

More Details >

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30457
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher

More Details >

WP SMS <= 6.6.2 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30454
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
Researcher

More Details >

WPC Badge Management for WooCommerce <= 2.4.0 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30537
Patch Status
Patched
Published
Mar 29, 2024

Affected Software
WPC Badge Management for WooCommerce
Researcher

More Details >

WPCS <= 1.2.0.1 – Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30456
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
WPCS – WordPress Currency Switcher Professional
Researcher

More Details >

YITH WooCommerce Account Funds Premium <= 1.33.0 – Missing Authorization

4.3

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30470
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
YITH WooCommerce Account Funds Premium
Researcher

More Details >

Import Export WordPress Users <= 2.5.2 – Authenticated (Shop Manager+) Path Traversal

2.7

CVSS Rating
Low (2.7)
CVE-ID
CVE-2024-30492
Patch Status
Patched
Published
Mar 28, 2024

Affected Software
Export and Import Users and Customers
Researcher

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (March 25, 2024 to March 31, 2024) appeared first on Wordfence.

Leave a Reply

Your email address will not be published. Required fields are marked *

*

Tap To Call