Chloe Chamberland
April 4, 2024

Wordfence Intelligence Weekly WordPress Vulnerability Report (March 25, 2024 to March 31, 2024)

🎉 Did you know we’re running a Bug Bounty Extravaganza again?

Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!

Last week, there were 406 vulnerabilities disclosed in 321 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 82 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 15,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • WAF-RULE-685 – Data redacted while we work with the vendor on a patch.
  • WAF-RULE-687 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 326
Unpatched 80

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 347
High Severity 33
Critical Severity 25

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 241
Missing Authorization 39
Cross-Site Request Forgery (CSRF) 35
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 28
Information Exposure 9
Deserialization of Untrusted Data 7
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 6
Unrestricted Upload of File with Dangerous Type 6
Use of Less Trusted Source 6
Authorization Bypass Through User-Controlled Key 5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 5
Server-Side Request Forgery (SSRF) 5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 3
Improper Input Validation 3
Guessable CAPTCHA 1
Improper Control of Generation of Code ('Code Injection') 1
Improper Neutralization of Special Elements used in a Command ('Command Injection') 1
Improper Privilege Management 1
Incomplete Blacklist to Cross-Site Scripting 1
Incorrect Privilege Assignment 1
URL Redirection to Untrusted Site ('Open Redirect') 1
Use of Insufficiently Random Values 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
50
32
25
24
16
15
14
14
12
12
11
10
9
9
8
7
7
6
6
6
5
5
5
5
4
4
4
4
3
3
3
3
3
3
3
2
2
2
ST
2
2
2
2
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
10Web Map Builder for Google Maps wd-google-maps
140+ Widgets | Best Addons For Elementor – FREE xpro-elementor-addons
A WordPress Testimonial Plugin to Showcase Testimonial Slider, Testimonial Grid and More: Solid Testimonials gs-testimonial
Action Network wp-action-network
Add Shortcodes Actions And Filters add-actions-and-filters
AdsPlace'r – Ad Manager, Inserter, AdSense Ads adsplacer
Advanced Search advance-search
Advanced Sermons advanced-sermons
Aesop Story Engine aesop-story-engine
affiliate-toolkit – WordPress Affiliate Plugin affiliate-toolkit-starter
AI Twitter Feeds (Twitter widget & shortcode) ai-twitter-feeds
AI WP Writer – автонаполнение сайта ChatGPT 3.5, GPT 4 и изображениями лучших нейросетей ai-wp-writer
All In One Redirection all-in-one-redirection
Announcement & Notification Banner – Bulletin bulletin-announcements
Aparat for WordPress wp-aparat
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments
Appointment Calendar appointment-calendar
Author Box, Guest Author and Co-Authors for Your Posts – Molongui molongui-authorship
Awesome Support – WordPress HelpDesk & Support Plugin awesome-support
B Slider- Best Gutenberg Slider Block for WordPress b-slider
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net woo-bulk-editor
Better Elementor Addons better-elementor-addons
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg betterdocs
BizPrint – Print WooCommerce Order Receipts, Invoices, Labels & More. print-google-cloud-print-gcp-woocommerce
Bold Page Builder bold-page-builder
BoldGrid Easy SEO – Simple and Effective SEO boldgrid-easy-seo
Booking Activities booking-activities
Booking Package booking-package
Booster for WooCommerce woocommerce-jetpack
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content brave-popup-builder
Breeze – WordPress Cache Plugin breeze
Broken Images wp-broken-images
BuddyPress Moderation youzify-moderation
Builderall Builder for WordPress builderall-cheetah-for-wp
Bulk NoIndex & NoFollow Toolkit bulk-noindex-nofollow-toolkit-by-mad-fish
Button button
Calculated Fields Form calculated-fields-form
Calendarista Basic Edition – WordPress appointment booking system calendarista-basic-edition
Carousel Anything For WPBakery Page Builder – Touch Slider and Carousel carousel-anything
CGC Maintenance Mode cgc-maintenance-mode
Change default login logo,url and title change-default-login-logo-url-and-title
Chauffeur Taxi Booking System for WordPress chauffeur-booking-system
Check & Log Email check-email
Christmas Greetings christmas-greetings
Church Admin church-admin
CM Download Manager – Document and File Management cm-download-manager
CMP – Coming Soon & Maintenance Plugin by NiteoThemes cmp-coming-soon-maintenance
Co-marquage service-public.fr co-marquage-service-public
Collect.chat – Chatbot ⚡️ collectchat
Comic Easel comic-easel
Compact WP Audio Player compact-wp-audio-player
Contact Form 7 Newsletter contact-form-7-newsletter
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce enhanced-e-commerce-for-woocommerce-store
Convert Post Types convert-post-types
coreActivity: Activity Logging plugin for WordPress coreactivity
Creative Image Slider – Responsive Slider Plugin creative-image-slider
CRM Perks Forms – WordPress Form Builder crm-perks-forms
Crypto Converter ⚡ Widget crypto-converter-widget
CubeWP – All-in-One Dynamic Content Framework cubewp-framework
Custom Field Bulk Editor custom-field-bulk-editor
Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce
DD Rating dd-rating
DELUCKS SEO delucks-seo
Doneren met Mollie doneren-met-mollie
Dracula Dark Mode – Enhanced Accessibility, Dark Mode & Reading Mode for WordPress dracula-dark-mode
Dropdown multisite selector dropdown-multisite-selector
DX-Watermark dx-watermark
Easy Appointments easy-appointments
Easy Form Builder easy-form-builder
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box easy-facebook-likebox
Easy Social Share Buttons for WordPress easy-social-share-buttons3
Easy Textillate easy-textillate
Ecwid Ecommerce Shopping Cart ecwid-shopping-cart
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) bdthemes-element-pack-lite
Elementor Addon Elements addon-elements-for-elementor-page-builder
Elementor Website Builder Pro elementor-pro
Elementor Website Builder – More than Just a Page Builder elementor
ElementsKit Elementor addons and Templates Library elementskit-lite
Email Newsletter, Marketing, Email Automation and CRM Plugin for WordPress by FluentCRM fluent-crm
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce email-subscribers
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders essential-addons-for-elementor-lite
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates essential-blocks
Event Tickets and Registration event-tickets
EventPrime – Events Calendar, Bookings and Tickets eventprime-event-calendar-management
Events Manager – Calendar, Bookings, Tickets, and more! events-manager
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin everest-backup
Exchange Rates Widget exchange-rates-widget
Exclusive Addons for Elementor exclusive-addons-for-elementor
Export and Import Users and Customers users-customers-import-export-for-wp-woocommerce
Falang multilanguage for WordPress falang
Fancy Comments WordPress fancy-facebook-comments
Fancy Product Designer fancy-product-designer
Favorites favorites
FG PrestaShop to WooCommerce fg-prestashop-to-woocommerce
Filter Custom Fields & Taxonomies Light filter-custom-fields-taxonomies-light
Finale Lite – Sales Countdown Timer & Discount for WooCommerce finale-woocommerce-sales-countdown-timer-discount
FlatPM – Ad Manager, AdSense and Custom Code flatpm-wp
Forminator – Contact Form, Payment Form & Custom Form Builder forminator
FOX – Currency Switcher Professional for WooCommerce woocommerce-currency-switcher
Frontend Dashboard frontend-dashboard
Fullscreen Galleria fullscreen-galleria
FV Flowplayer Video Player fv-wordpress-flowplayer
Gallery – Image and Video Gallery with Thumbnails gallery-album
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress gamipress
Geo Controller cf-geoplugin
GetResponse for WordPress getresponse-integration
Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce
Grid Shortcodes grid-shortcodes
Gutenberg Block Editor Toolkit – EditorsKit block-options
Gutenberg Blocks with AI by Kadence WP – Page Builder Features kadence-blocks
Hacklog Down As PDF down-as-pdf
Hash Elements hash-elements
Header Image Slider header-image-slider
HeartThis heart-this
Hot Random Image hot-random-image
HT Mega – Absolute Addons For Elementor ht-mega-for-elementor
Hubbub Lite – Fast, Reliable Social Sharing Buttons social-pug
HUSKY – Products Filter Professional for WooCommerce woocommerce-products-filter
iCalendrier icalendrier
iFlyChat – WordPress Chat iflychat
Image Hover Effects – Elementor Addon image-hover-effects-addon-for-elementor
Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site integrate-google-drive
Kanban Boards for WordPress kanban
Klarna Payments for WooCommerce klarna-payments-for-woocommerce
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages page-builder-add
Landingi Landing Pages landingi-landing-pages
Layouts for Elementor layouts-for-elementor
Lightbox slider – Responsive Lightbox Gallery simple-lightbox-gallery
Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms limit-attempts
Link Whisper Free link-whisper
LionScripts: IP Blocker Lite ip-address-blocker
List category posts list-category-posts
Locatoraid Store Locator locatoraid
Lordicon Animated Icons lordicon-interactive-icons
LWS Optimize lws-optimize
MailChimp Forms by MailMunch mailchimp-forms-by-mailmunch
Mailster WordPress Newsletter Plugin Compatibility Tester mailster
Mang Board WP mangboard
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor master-addons
MasterStudy LMS WordPress Plugin – for Online Courses and Education masterstudy-lms-learning-management-system
MDTF – Meta Data and Taxonomies Filter wp-meta-data-filter-and-taxonomy-filter
Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more ilab-media-tools
Media Library Assistant media-library-assistant
Media Library Folders media-library-plus
Meta Box – WordPress Custom Fields Framework meta-box
Meta Tag Manager meta-tag-manager
Mighty Classic Pros And Cons joomdev-wp-pros-cons
Move Addons for Elementor move-addons
MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar
Multiple Page Generator Plugin – MPG multiple-pages-generator-by-porthas
MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution dc-woocommerce-multi-vendor
MyBookTable Bookstore by Stormhill Media mybooktable
Nelio Content – Best Editorial Calendar & Social Media Scheduling nelio-content
New Order Notification for Woocommerce new-order-notification-for-woocommerce
News Wall news-wall
Newsletter – Send awesome emails from WordPress newsletter
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress ninja-forms
NPS computy nps-computy
Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars
OneClick Chat to Order oneclick-whatsapp-order
OpenID openid
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) stepbyteservice-openstreetmap
OSS Aliyun oss-aliyun
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE otter-blocks
Page Builder: Pagelayer – Drag and Drop website builder pagelayer
pageMash > Page Management pagemash
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions paid-memberships-pro
Paid Memberships Pro – Mailchimp Add On pmpro-mailchimp
Paid Memberships Pro – Payfast Gateway Add On pmpro-payfast
PDF Builder for WPForms pdf-builder-for-wpforms
PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip 3d-flipbook-dflip-lite
PDF Viewer for Elementor pdf-viewer-for-elementor
Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery
Photo Gallery by Ays – Responsive Image Gallery gallery-photo-gallery
Photo Gallery by Supsystic gallery-by-supsystic
Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress contest-gallery
Piotnet Addons For Elementor piotnet-addons-for-elementor
Platinum SEO platinum-seo-pack
Pocket News Generator pocket-news-generator
Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress
Podlove Web Player podlove-web-player
Pods – Custom Content Types and Fields pods
Popup Builder – Create highly converting, mobile friendly marketing popups. popup-builder
Popup Cart Lite for WooCommerce woocommerce-woocart-popup-lite
Portfolio Gallery – Image Gallery Plugin portfolio-filter-gallery
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor post-and-page-builder
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) buddyforms
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks post-grid
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget post-grid-carousel-ultimate
Post-Plugin Library post-plugin-library
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) powerpack-lite-for-elementor
Premium Packages – Sell Digital Products Securely wpdm-premium-packages
Prenotazioni prenotazioni
Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin pretty-link
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) bdthemes-prime-slider-lite
Print Page block – Print the entire page or Section. print-page
Product Feed PRO for WooCommerce by AdTribes – WooCommerce Product Feeds for Google, Facebook/Meta, Bing, & More woo-product-feed-pro
Product Import Export for WooCommerce product-import-export-for-woo
ProfileGrid – User Profiles, Memberships, Groups and Communities profilegrid-user-profiles-groups-and-communities
PropertyHive propertyhive
Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress radio-player
Real Media Library: Media Library Folder & File Manager real-media-library-lite
ReDi Restaurant Reservation redi-restaurant-reservation
RegistrationMagic – Custom User Registration Forms, Payment Forms, and User Login custom-registration-form-builder-with-submission-manager
Responsive flipbook wordpress plugin free download wppdf
Responsive Tabs responsive-tabs
ReviewX – Multi-criteria Rating & Reviews for WooCommerce reviewx
RoyalSlider new-royalslider
RT Easy Builder – Advanced addons for Elementor rt-easy-builder-advanced-addons-for-elementor
Salon booking system salon-booking-system
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster sellkit
SEO Backlink Monitor seo-backlink-monitor
SEO Plugin by Squirrly SEO squirrly-seo
SEO Title Tag seo-title-tag
Seriously Simple Podcasting seriously-simple-podcasting
Shipping with Venipak for WooCommerce wc-venipak-shipping
Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension shortcode-addons
Shortcodes and extra features for Phlox theme auxin-elements
Simple Ajax Chat – Add a Fast, Secure Chat Box simple-ajax-chat
Simple Buttons Creator simple-buttons-creator
Simple Revisions Delete simple-revisions-delete
Simply Static simply-static
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) sina-extension-for-elementor
Sliced Invoices – WordPress Invoice Plugin sliced-invoices
Slider by Supsystic slider-by-supsystic
Slider Hero with Animation, Video Background slider-hero
Slugs Manager: Delete Old Permalinks from WordPress Database remove-old-slugspermalinks
Smart Forms – when you need more than just a contact form smart-forms
Social Author Bio social-autho-bio
Social Icons Widget & Block by WPZOOM social-icons-widget-by-wpzoom
Social Media Share Buttons & Social Sharing Icons ultimate-social-media-icons
Social Share, Social Login and Social Comments Plugin – Super Socializer super-socializer
SP Project & Document Manager sp-client-document-manager
Special Box for Content special-box-for-content
SpiderFAQ spider-faq
Spiffy Calendar spiffy-calendar
Spin 360 deg and 3D Model Viewer spin360
Sponsors wp-sponsors
Stackable – Page Builder Gutenberg Blocks stackable-ultimate-gutenberg-blocks
Sticky Anything toast-stick-anything
Stratum – Elementor Widgets stratum
StreamWeasels Twitch Integration streamweasels-twitch-integration
Sunshine Photo Cart: Free Client Photo Galleries for Photographers sunshine-photo-cart
Survey Maker – Best WordPress Survey Plugin survey-maker
Sydney Toolbox sydney-toolbox
Tainacan tainacan
Tax Rate Upload tax-rate-upload
Testimonial Slider testimonial
The Plus Addons for Elementor the-plus-addons-for-elementor-page-builder
The Plus Blocks for Block Editor | Gutenberg the-plus-addons-for-block-editor
Themify Event Post themify-event-post
Themify Shortcodes themify-shortcodes
Thumbs Rating thumbs-rating
Top Bar top-bar
Travelers' Map travelers-map
Tumult Hype Animations tumult-hype-animations
Tutor LMS Elementor Addons tutor-lms-elementor-addons
Ultimate Addons for Beaver Builder – Lite ultimate-addons-for-beaver-builder-lite
Ultimate Social Comments – Email Notification & Lazy Load ultimate-facebook-comments
underConstruction underconstruction
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor
User Rights Access Manager user-rights-access-manager
VK All in One Expansion Unit vk-all-in-one-expansion-unit
VS Contact Form very-simple-contact-form
WC Builder – WooCommerce Page Builder for WPBakery wc-builder
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible wc-frontend-manager
Web Icons icon
Webinar and Video Conference with Jitsi Meet – Create Branded Webinars for WordPress, Meetings & Livestreaming webinar-and-video-conference-with-jitsi-meet
Weekly Class Schedule weekly-class-schedule
weForms – Easy Drag & Drop Contact Form Builder For WordPress weforms
Whizzy whizzy
Wholesale For WooCommerce woocommerce-wholesale-pricing
WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing) wholesalex
WishSuite – Wishlist for WooCommerce wishsuite
Woo Viet – WooCommerce for Vietnam woo-viet
WooCommerce post-new
WooCommerce Bookings Calendar woo-bookings-calendar
WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce cartflows
WooCommerce Customers Manager woocommerce-customers-manager
WooCommerce Multilingual & Multicurrency with WPML woocommerce-multilingual
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce
Woocommerce Social Media Share Buttons woocommerce-social-media-share-buttons
WordPress Contact Forms by Cimatti contact-forms
WordPress CRM Plugin – WP-CRM System wp-crm-system
WordPress File Upload wp-file-upload
WordPress Infinite Scroll – Ajax Load More ajax-load-more
WordPress Page Builder – Zion Builder zionbuilder
WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout gs-pinterest-portfolio
WordPress Tooltips wordpress-tooltips
WP Change Email Sender wp-change-email-sender
WP Chat App wp-whatsapp
WP Cost Estimation & Payment Forms Builder wp-estimation-form
WP Customer Reviews wp-customer-reviews
WP Directory Kit wpdirectorykit
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting erp
WP Express Checkout (Accept PayPal Payments Easily) wp-express-checkout
WP Fast Total Search – The Power of Indexed Search fulltext-search
WP Go Maps (formerly WP Google Maps) wp-google-maps
WP Hotel Booking wp-hotel-booking
WP Poll Maker – Best WordPress Poll Plugin for Voting Contest epoll-wp-voting
WP Post Disclaimer wp-post-disclaimer
WP Reset – Most Advanced WordPress Reset Tool wp-reset
WP Responsive Tabs horizontal vertical and accordion Tabs responsive-horizontal-vertical-and-accordion-tabs
WP Smart Import : Import any XML File to WordPress wp-smart-import
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc wp-sms
WP STAGING Pro WordPress Backup Plugin wp-staging-pro
WP STAGING WordPress Backup Plugin – Migration Backup Restore wp-staging
WP Travel Engine – Best Travel Booking WordPress Plugin wp-travel-engine
WP Twitter Mega Fan Box Widget wp-twitter-mega-fan-box
WP User Profile Avatar wp-user-profile-avatar
WP-Eggdrop wp-eggdrop
wp-forecast wp-forecast
WP-Lister Lite for Amazon wp-lister-for-amazon
WPBakery Page Builder Addons by Livemesh addons-for-visual-composer
WPC Badge Management for WooCommerce wpc-badge-management
WPCS – WordPress Currency Switcher Professional currency-switcher
WPFront Notification Bar wpfront-notification-bar
YITH WooCommerce Account Funds Premium yith-woocommerce-account-funds-premium
Yoo Slider – Image Slider & Video Slider yoo-slider
Zoho Campaigns zoho-campaigns
Zotpress zotpress

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Astra astra
Jobeleon WPJobBoard jobeleon-wpjobboard
Networker - Tech News WordPress Theme with Dark Mode networker
Newsmatic newsmatic
Nictitate nictitate
OceanWP oceanwp
Responsive responsive

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Chauffeur Taxi Booking System for WordPress <= 6.9 - Unauthenticated Arbitrary File Upload

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-31115
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Chauffeur Taxi Booking System for WordPress
Researcher
More Details >

CRM Perks Forms <= 1.1.4 - Unauthenticated SQL Injection

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-30498
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
CRM Perks Forms – WordPress Form Builder
Researcher
More Details >

Integrate Google Drive <= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and Export

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-2086
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site
Researcher
More Details >

Layouts for Elementor <= 1.7 - Missing Authorization to Unauthenticated Arbitrary File Upload

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-30533
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Layouts for Elementor
Researcher
More Details >

ProfileGrid <= 5.7.8 - Unauthenticated SQL Injection

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-30490
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
ProfileGrid – User Profiles, Memberships, Groups and Communities
Researcher
More Details >

Salon booking system <= 9.5 - Unauthenticated Arbitrary File Upload

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-30510
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Salon booking system
Researcher
More Details >

WP Travel Engine <= 5.7.9 - Unauthenticated SQL Injection

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-30502
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WP Travel Engine – Best Travel Booking WordPress Plugin
Researcher
More Details >

CRM Perks Forms <= 1.1.4 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30499
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
CRM Perks Forms – WordPress Form Builder
Researcher
More Details >

CubeWP – All-in-One Dynamic Content Framework <= 1.1.12 - Authenticated (Subscriber+) Arbitrary File Upload

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30500
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
CubeWP – All-in-One Dynamic Content Framework
Researcher
More Details >

Easy Form Builder <= 3.7.4 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30535
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Easy Form Builder
Researcher
More Details >

Element Pack Elementor Addons <= 5.5.3 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30496
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Researcher
More Details >

Media Library Folders <= 8.1.7 - Authenticated (Author+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30486
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Media Library Folders
Researcher
More Details >

ProfileGrid <= 5.7.8 - Authenticated (Subscriber+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30491
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
ProfileGrid – User Profiles, Memberships, Groups and Communities
Researcher
More Details >

WooCommerce Customers Manager <= 29.6 - Authenticated (Subscriber+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-0399
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WooCommerce Customers Manager
Researcher
More Details >

WordPress Tooltips <= 9.4.3 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30243
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
WordPress Tooltips
Researcher
More Details >

WP Cost Estimation & Payment Forms Builder <= 10.1.75 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30489
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WP Cost Estimation & Payment Forms Builder
Researcher
More Details >

WP Responsive Tabs horizontal vertical and accordion Tabs <= 1.1.17 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30497
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WP Responsive Tabs horizontal vertical and accordion Tabs
Researcher
More Details >

Zoho Campaigns <= 2.0.6 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30239
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Zoho Campaigns
Researcher
More Details >

Zotpress <= 7.3.7 - Authenticated (Contributor+) SQL Injection

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-30488
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Zotpress
Researcher
More Details >

MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-2411
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Researcher
More Details >

MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-2409
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education
Researcher
More Details >

10Web Map Builder for Google Maps <= 1.0.74 - Authenticated (Administrator+) SQL Injection

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-31116
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
10Web Map Builder for Google Maps
Researcher
More Details >

OSS Aliyun <= 1.4.10 - Authenticated (Administrator+) SQL Injection

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-30494
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
OSS Aliyun
Researcher
More Details >

Shortcode Addons <= 3.2.5 - Authenticated (Admin+) Arbitrary File Upload

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-31114
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension
Researcher
More Details >

WP Travel Engine <= 5.7.9 - Authenticated (Administrator+) SQL Injection

9.1
CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-30504
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WP Travel Engine – Best Travel Booking WordPress Plugin
Researcher
More Details >

Button <= 1.1.27 - Authenticated (Contributor+) PHP Object Injection in button_shortcode

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1872
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Button
Researcher
More Details >

Church Admin <= 4.0.27 - Authenticated (Contributor+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-30244
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Church Admin
Researcher
More Details >

ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-2047
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
ElementsKit Elementor addons and Templates Library
Researcher
More Details >

Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-3018
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Researcher
More Details >

Filter Custom Fields & Taxonomies Light <= 1.05 - Authenticated (Contributor+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-31094
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Filter Custom Fields & Taxonomies Light
Researcher
More Details >

Link Whisper Free <= 0.7.1 - Authenticated (Contributor+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-2693
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Link Whisper Free
Researcher
More Details >

Meta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1770
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
Meta Tag Manager
Researcher
More Details >

Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2023-6999
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Pods – Custom Content Types and Fields
Researcher
More Details >

Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2023-6967
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Pods – Custom Content Types and Fields
Researcher
More Details >

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1990
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
RegistrationMagic – Custom User Registration Forms, Payment Forms, and User Login
Researcher
More Details >

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.12.9 - Authenticated (Subscriber+) SQL Injection

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-0608
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher
More Details >

Check & Log Email <= 1.0.9 - Unauthenticated Hook Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-0866
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Check & Log Email
Researcher
More Details >

Hubbub Lite – Fast, Reliable Social Network Sharing Buttons <= 1.33.1 - PHP Object Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-2501
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
Hubbub Lite – Fast, Reliable Social Sharing Buttons
Researcher
More Details >

Responsive <= 5.0.2 - Missing Authorization to HTML Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-2848
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Responsive
Researchers
More Details >

Brave Popup Builder <= 0.6.5 - Unauthenticated Server-Side Request Forgery

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30453
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
Researcher
More Details >

Builderall Builder for WordPress <= 2.0.1 - Unauthenticated Server-Side Request Forgery

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30532
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Builderall Builder for WordPress
Researcher
More Details >

Everest Backup <= 2.2.4 - Authenticated (Admin+) Arbitrary File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2023-7201
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin
Researcher
More Details >

Falang multilanguage <= 1.3.47 - Authenticated (Administrator+) SQL Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30495
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Falang multilanguage for WordPress
Researcher
More Details >

Favorites <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-2948
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Favorites
Researcher
More Details >

Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-1794
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Forminator – Contact Form, Payment Form & Custom Form Builder
Researcher
More Details >

HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-3061
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
HUSKY – Products Filter Professional for WooCommerce
Researcher
More Details >

Podlove Web Player <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-29788
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Podlove Web Player
Researcher
More Details >

Product Import Export for WooCommerce <= 2.4.1 - Authenticated(Shop Manager+) Arbitrary File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30231
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Product Import Export for WooCommerce
Researcher
More Details >

Salon booking system <= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting via 'sms_prefix'

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-2102
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
Salon booking system
Researcher
More Details >

Simple Ajax Chat <= 20240216 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-1983
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Simple Ajax Chat – Add a Fast, Secure Chat Box
Researcher
More Details >

Simple Buttons Creator <=1.04 - Unauthenticated Stored Cross-Site Scripting via Add Button

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-2857
Patch Status
Unpatched
Published
Mar 25, 2024
Affected Software
Simple Buttons Creator
Researcher
More Details >

Sticky Anything <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30551
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Sticky Anything
Researcher
More Details >

WordPress Action Network 1.4.3 -Authentcated (Admin+) SQL Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-2954
Patch Status
Unpatched
Published
Mar 26, 2024
Affected Software
Action Network
Researchers
More Details >

WordPress Announcement & Notification Banner Plugin – Bulletin <= 3.8.5 - Authenticated (Administrator+) SQL Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-30478
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Announcement & Notification Banner – Bulletin
Researcher
More Details >

WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-0913
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher
More Details >

WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-0952
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher
More Details >

WP ERP <= 1.12.9 - Authenticated (AccountingManager+) SQL Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-0956
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher
More Details >

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.12.9 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-0609
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Researcher
More Details >

Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-2792
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
Elementor Addon Elements
Researcher
More Details >

SellKit <= 1.8.1 - Authenticated (Subscriber+) Arbitrary File Download

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-30509
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster
Researcher
More Details >

VK All in One Expansion Unit <= 9.95.0.1 - Information Exposure

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-2093
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
VK All in One Expansion Unit
Researcher
More Details >

WholesaleX <= 1.3.2 - Unauthenticated Privilege Escalation

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-30542
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing)
Researcher
More Details >

130+ Widgets | Best Addons For Elementor – FREE <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2250
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
140+ Widgets | Best Addons For Elementor – FREE
Researcher
More Details >

Aesop Story Engine <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30557
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Aesop Story Engine
Researcher
More Details >

affiliate-toolkit <= 3.4.5 - Authenticated (Author+) Stored Cross-Site Scripting via ratings

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29817
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
affiliate-toolkit – WordPress Affiliate Plugin
Researcher
More Details >

AI Twitter Feeds (Twitter widget & shortcode) <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31101
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
AI Twitter Feeds (Twitter widget & shortcode)
Researcher
More Details >

Aparat for WordPress <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29765
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Aparat for WordPress
Researcher
More Details >

Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2347
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Astra
Researcher
More Details >

B Slider - Slider for your block editor <= 1.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30432
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
B Slider- Best Gutenberg Slider Block for WordPress
Researcher
More Details >

Better Elementor Addons <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30423
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Better Elementor Addons
Researcher
More Details >

Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2280
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Better Elementor Addons
Researcher
More Details >

BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2845
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg
Researcher
More Details >

Bold Page Builder <= 4.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via class

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30179
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Bold Page Builder
Researcher
More Details >

BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1692
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
BoldGrid Easy SEO – Simple and Effective SEO
Researcher
More Details >

Carousel Anything For WPBakery Page Builder <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30520
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
Carousel Anything For WPBakery Page Builder – Touch Slider and Carousel
Researcher
More Details >

Church Admin <= 4.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30197
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Church Admin
Researcher
More Details >

Church Admin <= 4.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via meta-text

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30193
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Church Admin
Researcher
More Details >

Co-marquage service-public.fr <= 0.5.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29908
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Co-marquage service-public.fr
Researcher
More Details >

collectchat <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30436
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Collect.chat – Chatbot ⚡️
Researcher
More Details >

Compact WP Audio Player <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fileurl

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29917
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Compact WP Audio Player
Researcher
More Details >

CRM Perks Forms <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30446
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
CRM Perks Forms – WordPress Form Builder
Researcher
More Details >

Crypto Converter Widget <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29930
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Crypto Converter ⚡ Widget
Researcher
More Details >

DD Rating <= 1.7.1 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30554
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
DD Rating
Researcher
More Details >

DearFlip <= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via force_fit

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29807
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip
Researcher
More Details >

Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29771
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Dracula Dark Mode – Enhanced Accessibility, Dark Mode & Reading Mode for WordPress
Researcher
More Details >

Dropdown Multisite selector <= 0.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29910
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Dropdown multisite selector
Researcher
More Details >

Easy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2842
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Easy Appointments
Researcher
More Details >

Easy Social Feed <= 6.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via fb_appid

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30180
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Researcher
More Details >

Easy Social Feed <= 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1219
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Researcher
More Details >

Easy Textillate <= 2.01 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2303
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Easy Textillate
Researcher
More Details >

Ecwid Ecommerce Shopping Cart <= 6.12.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2456
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Ecwid Ecommerce Shopping Cart
Researcher
More Details >

Element Pack Elementor Addons <= 5.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via link

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30185
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Researcher
More Details >

Elementor Addon Elements <= 1.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30422
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Elementor Addon Elements
Researcher
More Details >

Elementor Website Builder – More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2117
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Elementor Website Builder – More than Just a Page Builder
Researcher
More Details >

Elementor Website Builder Pro <= 3.20.1 - Authententicated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1364
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Elementor Website Builder Pro
Researcher
More Details >

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2781
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Elementor Website Builder Pro
Researcher
More Details >

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1521
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Elementor Website Builder Pro
Researcher
More Details >

ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1238
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
ElementsKit Elementor addons and Templates Library
Researcher
More Details >

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2623
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Researcher
More Details >

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2650
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Researchers
More Details >

Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2111
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher
More Details >

Exchange Rates Widget <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29814
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Exchange Rates Widget
Researcher
More Details >

Exclusive Addons Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30177
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Exclusive Addons for Elementor
Researcher
More Details >

Exclusive Addons Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30232
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Exclusive Addons for Elementor
Researcher
More Details >

Fancy Comments WordPress <= 1.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29804
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Fancy Comments WordPress
Researcher
More Details >

FlatPM < 3.1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29803
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
FlatPM – Ad Manager, AdSense and Custom Code
Researcher
More Details >

Frontend Dashboard <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29775
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Frontend Dashboard
Researcher
More Details >

Fullscreen Galleria <= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29801
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Fullscreen Galleria
Researcher
More Details >

GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2783
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress
Researcher
More Details >

Geo Controller <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30451
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Geo Controller
Researcher
More Details >

GetResponse for WordPress <= 5.5.35 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31104
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
GetResponse for WordPress
Researcher
More Details >

Gratisfaction <= 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29798
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Gratisfaction- Loyalty, Rewards , Referral, Birthday and Giveaway Program
Researcher
More Details >

Grid Shortcodes <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29797
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Grid Shortcodes
Researcher
More Details >

GS Pins for Pinterest <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shorcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30192
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WordPress Pinterest Plugin – Make a Popup, User Profile, Masonry and Gallery Layout
Researcher
More Details >

GS Testimonial Slider <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30443
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
A WordPress Testimonial Plugin to Showcase Testimonial Slider, Testimonial Grid and More: Solid Testimonials
Researcher
More Details >

Gutenberg Block Editor Toolkit – EditorsKit <= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2794
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Gutenberg Block Editor Toolkit – EditorsKit
Researcher
More Details >

Gutenberg Blocks by Kadence Blocks <= 3.2.25 - Authenticated (Author+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-24888
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Gutenberg Blocks with AI by Kadence WP – Page Builder Features
Researcher
More Details >

Hash Elements <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30426
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Hash Elements
Researcher
More Details >

HeartThis <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31121
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
HeartThis
Researcher
More Details >

Hot Random Image <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29796
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Hot Random Image
Researcher
More Details >

HT Mega <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30182
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
HT Mega – Absolute Addons For Elementor
Researcher
More Details >

iCalendrier <= 1.80 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29912
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
iCalendrier
Researcher
More Details >

iFlyChat – WordPress Chat <= 4.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31108
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
iFlyChat – WordPress Chat
Researcher
More Details >

Image Hover Effects – Elementor Addon <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'eihe_align'

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29936
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Image Hover Effects – Elementor Addon
Researcher
More Details >

List category posts <= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1051
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
List category posts
Researcher
More Details >

Livemesh Addons for WPBakery Page Builder <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30183
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WPBakery Page Builder Addons by Livemesh
Researcher
More Details >

Lordicon Animated Icons <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30519
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
Lordicon Animated Icons
Researcher
More Details >

MailChimp Forms by MailMunch <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29793
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
MailChimp Forms by MailMunch
Researcher
More Details >

Master Addons for Elementor <= 2.0.5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29911
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Researcher
More Details >

Master Addons for Elementor <= 2.0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2139
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor
Researcher
More Details >

Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more <= 4.5.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29795
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more
Researcher
More Details >

Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2871
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Media Library Assistant
Researcher
More Details >

Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2475
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Media Library Assistant
Researcher
More Details >

Mighty Classic Pros And Cons <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30556
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Mighty Classic Pros And Cons
Researcher
More Details >

MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30530
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Researcher
More Details >

MyBookTable Bookstore <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29772
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
MyBookTable Bookstore by Stormhill Media
Researcher
More Details >

Nelio Content <= 3.2.0 - Authenticated (Contributor+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30531
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Nelio Content – Best Editorial Calendar & Social Media Scheduling
Researcher
More Details >

Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29762
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Off-Canvas Sidebars & Menus (Slidebars)
Researcher
More Details >

OneClick Chat to Order <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29789
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
OneClick Chat to Order
Researcher
More Details >

OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30450
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
Researcher
More Details >

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2841
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Researcher
More Details >

Otter Blocks <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2729
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Researcher
More Details >

PDF Builder for WPForms <= 1.2.88 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29820
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
PDF Builder for WPForms
Researcher
More Details >

PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30524
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
PDF Viewer for Elementor
Researcher
More Details >

Piotnet Addons For Elementor <= 2.4.25 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29934
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Piotnet Addons For Elementor
Researcher
More Details >

Popup Builder <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30184
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Popup Builder – Create highly converting, mobile friendly marketing popups.
Researcher
More Details >

Portfolio Gallery – Image Gallery Plugin <= 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29769
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Portfolio Gallery – Image Gallery Plugin
Researcher
More Details >

Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.26.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2888
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
Researcher
More Details >

Post Grid, Slider & Carousel Ultimate <= 1.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29925
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget
Researcher
More Details >

PowerPack Addons for Elementor <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag*

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2491
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
Researcher
More Details >

PowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2492
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
Researcher
More Details >

Prime Slider – Addons For Elementor <= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30186
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)
Researcher
More Details >

Print Page block <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30438
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Print Page block – Print the entire page or Section.
Researcher
More Details >

Real Media Library: Media Library Folder & File Manager <= 4.22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2027
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Real Media Library: Media Library Folder & File Manager
Researchers
More Details >

Responsive flipbook <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30552
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Responsive flipbook wordpress plugin free download
Researcher
More Details >

Responsive Image Gallery, Gallery Album <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31120
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Gallery – Image and Video Gallery with Thumbnails
Researcher
More Details >

Responsive Tabs <= 4.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1846
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Responsive Tabs
Researcher
More Details >

ReviewX <= 1.6.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29812
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
ReviewX – Multi-criteria Rating & Reviews for WooCommerce
Researcher
More Details >

Sina Extension for Elementor <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29935
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)
Researcher
More Details >

SP Project & Document Manager <= 4.70 - Missing Authorization Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31118
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
SP Project & Document Manager
Researcher
More Details >

Spin 360 deg and 3D Model Viewer <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30559
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Spin 360 deg and 3D Model Viewer
Researcher
More Details >

Sponsors <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30483
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
Sponsors
Researcher
More Details >

Stackable – Page Builder Gutenberg Blocks <= 3.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Block

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2039
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Stackable – Page Builder Gutenberg Blocks
Researchers
More Details >

Stratum <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29914
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Stratum – Elementor Widgets
Researcher
More Details >

StreamWeasels Twitch Integration <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29766
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
StreamWeasels Twitch Integration
Researcher
More Details >

Sydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2936
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Sydney Toolbox
Researchers
More Details >

The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Clients Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2203
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
The Plus Addons for Elementor
Researcher
More Details >

The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2210
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
The Plus Addons for Elementor
Researcher
More Details >

Travelers' Map <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29909
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Travelers' Map
Researcher
More Details >

Tutor LMS Elementor Addons <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29913
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Tutor LMS Elementor Addons
Researcher
More Details >

Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2140
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Ultimate Addons for Beaver Builder – Lite
Researcher
More Details >

Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2141
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Ultimate Addons for Beaver Builder – Lite
Researcher
More Details >

Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2143
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Ultimate Addons for Beaver Builder – Lite
Researcher
More Details >

Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2144
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Ultimate Addons for Beaver Builder – Lite
Researcher
More Details >

Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2142
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Ultimate Addons for Beaver Builder – Lite
Researcher
More Details >

Ultimate Social Comments – Email Notification & Lazy Load <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30555
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Ultimate Social Comments – Email Notification & Lazy Load
Researcher
More Details >

Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0367
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher
More Details >

VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2170
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
VK All in One Expansion Unit
Researchers
More Details >

WC Builder <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29926
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WC Builder – WooCommerce Page Builder for WPBakery
Researcher
More Details >

WC Marketplace <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30433
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution
Researcher
More Details >

Web Icons <= 1.0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30445
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Web Icons
Researcher
More Details >

Web Icons <= 1.0.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29933
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Web Icons
Researcher
More Details >

Webinar and Video Conference with Jitsi Meet <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30437
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Webinar and Video Conference with Jitsi Meet – Create Branded Webinars for WordPress, Meetings & Livestreaming
Researcher
More Details >

WishSuite <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29927
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WishSuite – Wishlist for WooCommerce
Researcher
More Details >

WooCommerce Bookings Calendar <= 1.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-31117
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
WooCommerce Bookings Calendar
Researcher
More Details >

WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2847
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
WordPress File Upload
Researcher
More Details >

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29906
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher
More Details >

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29932
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher
More Details >

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29763
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher
More Details >

WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2513
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
WP Chat App
Researcher
More Details >

WP Customer Reviews <= 3.7.0 - Authenticated (Contributor+) Malicious Redirect via HTTP-EQUIV Injection

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1849
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WP Customer Reviews
Researcher
More Details >

WP Fast Total Search <= 1.59.211 - Authenticated (Contributor+) Stored Cross-Site Scripting via WPFTS Live Search Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29799
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WP Fast Total Search – The Power of Indexed Search
Researcher
More Details >

WP Post Disclaimer <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29761
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WP Post Disclaimer
Researcher
More Details >

WP User Profile Avatar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2023-6067
Patch Status
Unpatched
Published
Mar 25, 2024
Affected Software
WP User Profile Avatar
Researcher
More Details >

wp-forecast <= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-30429
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
wp-forecast
Researcher
More Details >

WPFront Notification Bar <= 3.3.2 - Authenticated (Editor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-29819
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WPFront Notification Bar
Researcher
More Details >

Add Shortcodes Actions And Filters <= 2.10 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30558
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Add Shortcodes Actions And Filters
Researcher
More Details >

AdsPlace'r – Ad Manager, Inserter, AdSense Ads <= 1.1.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31088
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
AdsPlace'r – Ad Manager, Inserter, AdSense Ads
Researcher
More Details >

Advanced Sermons <= 3.1 - Reflected Cross-Site Scripting via s

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29928
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Advanced Sermons
Researcher
More Details >

All In One Redirection <= 2.2.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30506
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
All In One Redirection
Researcher
More Details >

Appointment Calendar <= 2.9.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30561
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Appointment Calendar
Researcher
More Details >

BizPrint <= 4.5.4 - Cross-Site Request Forgery to Cross-Site Scripting via process.php

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29773
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
BizPrint – Print WooCommerce Order Receipts, Invoices, Labels & More.
Researcher
More Details >

Booking Activities <= 1.15.19 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30449
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Booking Activities
Researcher
More Details >

Booster for WooCommerce <= 7.1.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29760
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Booster for WooCommerce
Researcher
More Details >

BuddyForms <= 2.8.5 - Reflected Cross-Site Scripting via page

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30198
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
Researcher
More Details >

Buddypress Moderation <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-2864
Patch Status
Unpatched
Published
Mar 25, 2024
Affected Software
BuddyPress Moderation
Researcher
More Details >

Bulk NoIndex & NoFollow Toolkit <= 2.01 - Reflected Cross-Site Scripting via tab, order, and orderby

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29791
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Bulk NoIndex & NoFollow Toolkit
Researcher
More Details >

Calculated Fields Form <= 1.2.54 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29759
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Calculated Fields Form
Researcher
More Details >

Christmas Greetings <= 1.2.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-2116
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
Christmas Greetings
Researcher
More Details >

Co-marquage service-public.fr <= 0.5.72 - Reflected Cross-Site Scripting via search_term

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29758
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Co-marquage service-public.fr
Researcher
More Details >

Comic Easel <= 1.15 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31092
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Comic Easel
Researcher
More Details >

Contact Form 7 Newsletter <= 2.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31110
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Contact Form 7 Newsletter
Researcher
More Details >

Contest Gallery <= 21.3.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30428
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress
Researcher
More Details >

Conversios.io <= 6.9.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29794
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
Researcher
More Details >

Convert Post Types <= 1.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31112
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Convert Post Types
Researcher
More Details >

Creative Image Slider – Responsive Slider Plugin <= 2.1.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30447
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Creative Image Slider – Responsive Slider Plugin
Researcher
More Details >

Custom Field Bulk Editor <= 1.9.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31091
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Custom Field Bulk Editor
Researcher
More Details >

Doneren met Mollie <= 2.10.2 - Unauthenticated Reflected Cross-Site Scripting via search

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29767
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Doneren met Mollie
Researcher
More Details >

Easy Social Share Buttons <= 9.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30196
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Easy Social Share Buttons for WordPress
Researcher
More Details >

Email Subscribers & Newsletters <= 5.7.11 - Reflected Cross-Site Scripting via campaign_id

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-22300
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Researcher
More Details >

Forminator <= 1.29.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29777
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Forminator – Contact Form, Payment Form & Custom Form Builder
Researcher
More Details >

FV Flowplayer Video Player <= 7.5.41.7212 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-22299
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
FV Flowplayer Video Player
Researcher
More Details >

Hacklog Down As PDF <= 2.3.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31090
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Hacklog Down As PDF
Researcher
More Details >

Header Image Slider <= 0.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30547
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Header Image Slider
Researcher
More Details >

Jobeleon Theme <= 1.9.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2022-47153
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Jobeleon WPJobBoard
Researcher
More Details >

Kanban Boards for WordPress <= 2.5.21 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31103
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Kanban Boards for WordPress
Researcher
More Details >

Limit Attempts by BestWebSoft <= 1.2.9 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30439
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms
Researcher
More Details >

Mailster <= 1.0.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30503
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Mailster WordPress Newsletter Plugin Compatibility Tester
Researcher
More Details >

Mang Board WP <= 1.8.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30431
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Mang Board WP
Researcher
More Details >

OpenID <= 3.6.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31107
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
OpenID
Researcher
More Details >

pageMash > Page Management <= 1.3.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31087
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
pageMash > Page Management
Researcher
More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'current_url'

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29832
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Researcher
More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_id'

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29808
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Researcher
More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'image_url'

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29809
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Researcher
More Details >

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.21 - Reflected Cross-Site Scripting via 'thumb_url'

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29810
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Researcher
More Details >

Photo Gallery by Ays <= 5.5.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29919
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Photo Gallery by Ays – Responsive Image Gallery
Researcher
More Details >

Podlove Podcast Publisher <= 4.0.9 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29915
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Podlove Podcast Publisher
Researcher
More Details >

Post Grid <= 2.2.74 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30441
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks
Researcher
More Details >

Post-Plugin Library <= 2.6.2.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31085
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Post-Plugin Library
Researcher
More Details >

Premium Packages <= 5.8.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29924
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Premium Packages – Sell Digital Products Securely
Researcher
More Details >

Product Feed PRO for WooCommerce by AdTribes – WooCommerce Product Feeds for Google, Facebook/Meta, Bing, & More <= 13.2.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-24800
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Product Feed PRO for WooCommerce by AdTribes – WooCommerce Product Feeds for Google, Facebook/Meta, Bing, & More
Researcher
More Details >

PropertyHive <= 2.0.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29923
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
PropertyHive
Researcher
More Details >

ReDi Restaurant Reservation <= 24.0128 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29806
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
ReDi Restaurant Reservation
Researcher
More Details >

Responsive Image Gallery, Gallery Album <= 2.0.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30550
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Gallery – Image and Video Gallery with Thumbnails
Researcher
More Details >

RoyalSlider <= 3.4.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30195
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
RoyalSlider
Researcher
More Details >

SEO Backlink Monitor <= 1.5.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29907
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
SEO Backlink Monitor
Researcher
More Details >

SEO Plugin by Squirrly SEO <= 12.3.16 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29790
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
SEO Plugin by Squirrly SEO
Researcher
More Details >

SEO Title Tag <= 3.5.9 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31097
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
SEO Title Tag
Researcher
More Details >

Seriously Simple Podcasting <= 3.0.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-25599
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Seriously Simple Podcasting
Researcher
More Details >

Shipping with Venipak for WooCommerce <= 1.19.5 - Reflected Cross-Site Scripting via 'venipak_labels_link'

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29805
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Shipping with Venipak for WooCommerce
Researcher
More Details >

Shortlinks by Pretty Links <= 3.6.2 - Reflected Cross-Site Scripting via post_status

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29770
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
Researcher
More Details >

Simply Schedule Appointments <= 1.6.6.20 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-22311
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Researcher
More Details >

Social Author Bio <= 2.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30545
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Social Author Bio
Researcher
More Details >

SpiderFAQ <= 1.3.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31123
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
SpiderFAQ
Researcher
More Details >

Spiffy Calendar <= 4.9.7 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30427
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Spiffy Calendar
Researcher
More Details >

Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30194
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Sunshine Photo Cart: Free Client Photo Galleries for Photographers
Researcher
More Details >

Survey Maker <= 4.0.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29918
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Survey Maker – Best WordPress Survey Plugin
Researcher
More Details >

Tax Rate Upload <= 2.4.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31105
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Tax Rate Upload
Researcher
More Details >

The Plus Blocks for Block Editor | Gutenberg <= 3.2.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30435
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
The Plus Blocks for Block Editor | Gutenberg
Researcher
More Details >

Tumult Hype Animations <= 1.9.11 - Cross-Site Request Forgery to Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30461
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Tumult Hype Animations
Researcher
More Details >

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.93 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29792
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher
More Details >

User Rights Access Manager <= 1.1.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31122
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
User Rights Access Manager
Researcher
More Details >

Weekly Class Schedule <= 3.19 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31084
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Weekly Class Schedule
Researcher
More Details >

WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-22288
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
Researcher
More Details >

Woocommerce Social Media Share Buttons <= 1.3.0 - Cross-Site Request Forgery to Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31109
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Woocommerce Social Media Share Buttons
Researcher
More Details >

WordPress Importer <= 1.0.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30201
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WP Smart Import : Import any XML File to WordPress
Researcher
More Details >

WP Directory Kit <= 1.2.9 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29774
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WP Directory Kit
Researcher
More Details >

WP Google Maps <= 9.0.29 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-29931
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WP Go Maps (formerly WP Google Maps)
Researcher
More Details >

WP-Lister Lite for Amazon <= 2.6.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-30199
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WP-Lister Lite for Amazon
Researcher
More Details >

Yoo Slider <= 2.1.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-31106
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Yoo Slider – Image Slider & Video Slider
Researcher
More Details >

WP Reset <= 1.99 - Sensitive Information Exposure due to Insufficient Randomness

5.9
CVSS Rating
Medium (5.9)
CVE-ID
CVE-2023-6799
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
WP Reset – Most Advanced WordPress Reset Tool
Researcher
More Details >

AI WP Writer <= 3.6.5 - Missing Authorization

5.6
CVSS Rating
Medium (5.6)
CVE-ID
CVE-2024-30459
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
AI WP Writer – автонаполнение сайта ChatGPT 3.5, GPT 4 и изображениями лучших нейросетей
Researcher
More Details >

Astra <= 4.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Theme Header/Footer

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29768
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Astra
Researcher
More Details >

Breeze <= 2.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via breeze_api_token

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-27188
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Breeze – WordPress Cache Plugin
Researcher
More Details >

Carousel Slider <= 2.2.6 - Authenticated (Editor+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-1712
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Responsive Tabs
Researcher
More Details >

CMP – Coming Soon & Maintenance <= 4.1.10 - Authenticated (Admin+) Server-Side Request Forgery

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2023-50374
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
Researcher
More Details >

EventPrime <= 3.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29776
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
EventPrime – Events Calendar, Bookings and Tickets
Researcher
More Details >

Funnel Builder by CartFlows <= 2.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via settings

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29813
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce
Researcher
More Details >

Locatoraid Store Locator <= 3.9.30 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-30181
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Locatoraid Store Locator
Researcher
More Details >

Molongui <= 4.7.7 - Authenticated (Author+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29764
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Author Box, Guest Author and Co-Authors for Your Posts – Molongui
Researcher
More Details >

Photo Gallery by Supsystic <= 1.15.16 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29921
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Photo Gallery by Supsystic
Researcher
More Details >

Simply Static <= 3.1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-30178
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Simply Static
Researcher
More Details >

Slider Hero <= 8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-29922
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Slider Hero with Animation, Video Background
Researcher
More Details >

Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2091
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
Elementor Addon Elements
Researcher
More Details >

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2121
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Elementor Website Builder Pro
Researcher
More Details >

Elementor Website Builder Pro <= 3.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2120
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Elementor Website Builder Pro
Researcher
More Details >

Finale Lite <= 2.18.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-30485
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Finale Lite – Sales Countdown Timer & Discount for WooCommerce
Researcher
More Details >

Lightbox slider – Responsive Lightbox Gallery <= 1.9.9 - Authenticated (Contributor+) PHP Object Injection

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1858
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
Lightbox slider – Responsive Lightbox Gallery
Researcher
More Details >

Pocket News Generator <= 0.2.0 - Cross-Site Request Forgery to Settings Update

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2964
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
Pocket News Generator
Researcher
More Details >

Salon booking system <= 9.6.2 - Authenticated (Customer+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2101
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
Salon booking system
Researcher
More Details >

Themify Shortcodes <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2732
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Themify Shortcodes
Researcher
More Details >

Whizzy <= 1.1.18 - Authenticated (Subscriber+) Insecure Direct Object Reference

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-30543
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Whizzy
Researcher
More Details >

WP-Eggdrop <= 0.1 - Cross-Site Request Forgery to Settings Update

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-2969
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
WP-Eggdrop
Researcher
More Details >

Awesome Support <= 6.1.7 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30539
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Awesome Support – WordPress HelpDesk & Support Plugin
Researcher
More Details >

BEAR <= 1.1.4.3 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30463
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net
Researcher
More Details >

Booking Package <= 1.6.27 - Unauthenticated Price Manipulation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30516
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Booking Package
Researcher
More Details >

Calendarista Basic Edition <= 3.0.5 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30534
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Calendarista Basic Edition – WordPress appointment booking system
Researcher
More Details >

CGC Maintenance Mode <= 1.2 - IP Spoofing

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30480
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
CGC Maintenance Mode
Researcher
More Details >

coreActivity <= 2.0.1 - IP Spoofing

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-0868
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
coreActivity: Activity Logging plugin for WordPress
Researcher
More Details >

DELUCKS SEO <= 2.5.4 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30538
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
DELUCKS SEO
Researcher
More Details >

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2974
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders
Researcher
More Details >

FG PrestaShop to WooCommerce <= 4.45.1 - Unauthenticated Sensitive Information Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30511
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
FG PrestaShop to WooCommerce
Researcher
More Details >

IP Blocker Lite <= 11.1.1 - IP Spoofing

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30479
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
LionScripts: IP Blocker Lite
Researcher
More Details >

Klarna Payments for WooCommerce <= 3.2.4 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30477
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Klarna Payments for WooCommerce
Researcher
More Details >

Move Addons for Elementor <= 1.2.9 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30525
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Move Addons for Elementor
Researcher
More Details >

Networker - Tech News WordPress Theme with Dark Mode <= 1.1.9 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2962
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Networker - Tech News WordPress Theme with Dark Mode
Researcher
More Details >

Newsletter <= 8.2.0 - IP Spoofing

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30522
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Newsletter – Send awesome emails from WordPress
Researcher
More Details >

Newsmatic <= 1.3.4 - Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_content

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1587
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Newsmatic
Researcher
More Details >

Paid Memberships Pro – Mailchimp Add On <= 2.3.4 - Unauthenticated Information Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30523
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Paid Memberships Pro – Mailchimp Add On
Researcher
More Details >

Paid Memberships Pro – Payfast Gateway Add On <= 1.4.1 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30514
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Paid Memberships Pro – Payfast Gateway Add On
Researcher
More Details >

Radio Player <= 2.0.73 - Missing Authorization via get_players

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2906
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress
Researcher
More Details >

RT Easy Builder – Advanced addons for Elementor <= 2.0 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30484
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
RT Easy Builder – Advanced addons for Elementor
Researcher
More Details >

Simple Buttons Creator <=1.04 - Cross-Site Request Forgery to Arbitrary Button Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-2858
Patch Status
Unpatched
Published
Mar 25, 2024
Affected Software
Simple Buttons Creator
Researcher
More Details >

Tainacan <= 0.20.7 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30529
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Tainacan
Researcher
More Details >

Thumbs Rating <= 5.1.0 - Unauthenticated Insecure Direct Object Reference

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-31095
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Thumbs Rating
Researcher
More Details >

VS Contact Form <= 14.7 - CAPTCHA Bypass

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30540
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
VS Contact Form
Researcher
More Details >

weForms <= 1.6.20 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30512
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
weForms – Easy Drag & Drop Contact Form Builder For WordPress
Researcher
More Details >

Whizzy <= 1.1.18 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30544
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Whizzy
Researcher
More Details >

Wholesale For WooCommerce <= 2.3.0 - Unauthenticated Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30469
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Wholesale For WooCommerce
Researcher
More Details >

WP Express Checkout (Accept PayPal Payments) <= 2.3.7 - Unauthenticated Price Manipulation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30527
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
WP Express Checkout (Accept PayPal Payments Easily)
Researcher
More Details >

WP Hotel Booking <= 2.0.9.2 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-30508
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WP Hotel Booking
Researcher
More Details >

Ajax Load More <= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-1790
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
WordPress Infinite Scroll – Ajax Load More
Researcher
More Details >

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting

4.6
CVSS Rating
Medium (4.6)
CVE-ID
CVE-2024-2108
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Researcher
More Details >

Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
Unknown
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WordPress Infinite Scroll – Ajax Load More
Researcher
More Details >

Contact Forms by Cimatti <= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30549
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
WordPress Contact Forms by Cimatti
Researcher
More Details >

Fancy Product Designer < 6.1.81 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-0902
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Fancy Product Designer
Researcher
More Details >

Fluent CRM <= 2.8.44 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30430
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Email Newsletter, Marketing, Email Automation and CRM Plugin for WordPress by FluentCRM
Researcher
More Details >

Landing Page Builder <= 1.5.1.7 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30452
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages
Researcher
More Details >

NPS computy <= 2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-1754
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
NPS computy
Researcher
More Details >

Platinum SEO <= 2.4.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-31089
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Platinum SEO
Researcher
More Details >

Pocket News Generator <= 0.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2963
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
Pocket News Generator
Researcher
More Details >

Prenotazioni <= 1.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-31102
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Prenotazioni
Researcher
More Details >

Simple Ajax Chat <= 20231101 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2956
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Simple Ajax Chat – Add a Fast, Secure Chat Box
Researcher
More Details >

Slider by Supsystic <= 1.8.10 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30448
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Slider by Supsystic
Researcher
More Details >

Social Media Share Buttons <= 2.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2118
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
Social Media Share Buttons & Social Sharing Icons
Researcher
More Details >

Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.13.63 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2836
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Social Share, Social Login and Social Comments Plugin – Super Socializer
Researcher
More Details >

Special Box for Content <= 1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-31119
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Special Box for Content
Researcher
More Details >

Testimonial Slider <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-1746
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Testimonial Slider
Researcher
More Details >

Themify Event Post <= 1.2.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30440
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Themify Event Post
Researcher
More Details >

Top Bar <= 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-1660
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Top Bar
Researcher
More Details >

underConstruction <= 1.21 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30548
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
underConstruction
Researcher
More Details >

WCFM – Frontend Manager for WooCommerce <= 6.7.8 - Authenticated (Shop manager+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-29929
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
Researcher
More Details >

Woo Viet <= 1.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-29816
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Woo Viet – WooCommerce for Vietnam
Researcher
More Details >

WordPress Page Builder – Zion Builder <= 3.6.9 - Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30444
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WordPress Page Builder – Zion Builder
Researcher
More Details >

WP Change Email Sender <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-29815
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WP Change Email Sender
Researcher
More Details >

WP Poll Maker <= 3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-29818
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WP Poll Maker – Best WordPress Poll Plugin for Voting Contest
Researcher
More Details >

WP Staging (Free <= 3.3.3, Pro <= 5.3.3) - Authenticated (Administrator+) Stored Cross-Site-Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2309
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
WP STAGING WordPress Backup Plugin – Migration Backup Restore
WP STAGING Pro WordPress Backup Plugin
Researcher
More Details >

WP Twitter Mega Fan Box Widget <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30553
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
WP Twitter Mega Fan Box Widget
Researcher
More Details >

WP-CRM System <= 3.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-30434
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WordPress CRM Plugin – WP-CRM System
Researcher
More Details >

WP-Eggdrop <= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2968
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
WP-Eggdrop
Researcher
More Details >

WP-Lister Lite for Amazon <= 2.6.11 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-2889
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
WP-Lister Lite for Amazon
Researcher
More Details >

Advance Search <= 1.1.6 - Cross-Site Request Forgery to Shortcode Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2739
Patch Status
Unpatched
Published
Mar 25, 2024
Affected Software
Advanced Search
Researcher
More Details >

Broken Images <= 0.2 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31093
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Broken Images
Researcher
More Details >

Change default login logo,url and title <= 2.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31086
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Change default login logo,url and title
Researcher
More Details >

Church Admin <= 4.1.18 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30505
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Church Admin
Researcher
More Details >

Church Admin <= 4.1.7 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30493
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Church Admin
Researcher
More Details >

CM Download Manager < 2.9.0 - Cross-Site Request Forgery via delHeader

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1232
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
CM Download Manager – Document and File Management
Researcher
More Details >

CM Download Manager < 2.9.0 - Cross-Site Request Forgery via unpublishHeader

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1231
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
CM Download Manager – Document and File Management
Researcher
More Details >

CM Download Manager < 2.9.1 - Cross-Site Request Forgery via editHeader

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1962
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
CM Download Manager – Document and File Management
Researcher
More Details >

Custom WooCommerce Checkout Fields Editor <= 1.3.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30518
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Custom WooCommerce Checkout Fields Editor
Researcher
More Details >

DX-Watermark <= 1.0.4 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30560
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
DX-Watermark
Researcher
More Details >

Easy Appointments <= 3.11.18 - Insufficient Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2844
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Easy Appointments
Researcher
More Details >

Easy Social Feed <= 6.5.6 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30526
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Easy Social Feed – Social Photos Gallery – Post Feed – Like Box
Researcher
More Details >

Essential Blocks for Gutenberg <= 4.4.9 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30467
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Researcher
More Details >

Event Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2261
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Event Tickets and Registration
Researcher
More Details >

Events Manager <= 6.4.6.4 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30515
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher
More Details >

Events Manager <= 6.4.7.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30421
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher
More Details >

Events Manager <= 6.4.7.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2110
Patch Status
Patched
Published
Mar 27, 2024
Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!
Researcher
More Details >

GamiPress <= 6.8.5 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30455
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress
Researcher
More Details >

HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.5.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30462
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
HUSKY – Products Filter Professional for WooCommerce
Researcher
More Details >

Landingi Landing Pages <= 3.1.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30521
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Landingi Landing Pages
Researcher
More Details >

LWS Optimize <= 1.9.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30541
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
LWS Optimize
Researcher
More Details >

Meta Box – WordPress Custom Fields Framework <= 5.9.3 - Authenticated (Contributor+) Information Exposure via Post Meta

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1204
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Meta Box – WordPress Custom Fields Framework
Researcher
More Details >

Molongui <= 4.7.7 - Authenticated (Author+) Insecure Direct Object Reference

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30507
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Author Box, Guest Author and Co-Authors for Your Posts – Molongui
Researcher
More Details >

MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.1 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30487
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
MP3 Audio Player for Music, Radio & Podcast by Sonaar
Researcher
More Details >

Multiple Page Generator Plugin – MPG <= 3.4.0 - Missing Authorization via mpg_get_log_by_project_id

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30235
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
Multiple Page Generator Plugin – MPG
Researcher
More Details >

New Order Notification for Woocommerce <= 2.0.2 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31098
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
New Order Notification for Woocommerce
Researcher
More Details >

News Wall <= 1.1.0 - Cross-Site Request Forgery to Plugin Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2970
Patch Status
Unpatched
Published
Mar 28, 2024
Affected Software
News Wall
Researcher
More Details >

Nictitate <= 1.1.4 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31096
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Nictitate
Researcher
More Details >

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2113
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Researcher
More Details >

NPS computy <= 2.7.5 - Cross-Site Request Forgery to Results Deletion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1755
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
NPS computy
Researcher
More Details >

OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2476
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
OceanWP
Researcher
More Details >

PageLayer <= 1.8.1 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30465
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Page Builder: Pagelayer – Drag and Drop website builder
Researcher
More Details >

Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-0588
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Researcher
More Details >

Pods - Custom Content Types and Fields - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2023-6965
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Pods – Custom Content Types and Fields
Researcher
More Details >

Popup Cart Lite for WooCommerce <= 1.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31100
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Popup Cart Lite for WooCommerce
Researcher
More Details >

ProfileGrid <= 5.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30513
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
ProfileGrid – User Profiles, Memberships, Groups and Communities
Researcher
More Details >

RegistrationMagic <= 5.3.0.0 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2951
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
RegistrationMagic – Custom User Registration Forms, Payment Forms, and User Login
Researcher
More Details >

Shortcodes and extra features for Phlox theme <= 2.15.5 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-31099
Patch Status
Unpatched
Published
Mar 29, 2024
Affected Software
Shortcodes and extra features for Phlox theme
Researcher
More Details >

Simple Revisions Delete <= 1.5.3 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30482
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Simple Revisions Delete
Researcher
More Details >

Sliced Invoices <= 3.9.2 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30517
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Sliced Invoices – WordPress Invoice Plugin
Researcher
More Details >

Slugs Manager <= 2.6.7 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30536
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Slugs Manager: Delete Old Permalinks from WordPress Database
Researcher
More Details >

Smart Forms <= 2.6.93 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1307
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
Smart Forms – when you need more than just a contact form
Researcher
More Details >

Social Icons Widget & Block by WPZOOM <= 4.2.15 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30464
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Social Icons Widget & Block by WPZOOM
Researcher
More Details >

Spiffy Calendar <= 4.9.10 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30528
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
Spiffy Calendar
Researcher
More Details >

WholesaleX <= 1.3.1 - Authenticated(Subscriber+) Missing Authorization via multiple AJAX actions

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30234
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing)
Researcher
More Details >

WholesaleX <= 1.3.1 - Sensitive Information Exposure via export_users

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30233
Patch Status
Patched
Published
Mar 26, 2024
Affected Software
WholesaleX – WooCommerce Wholesale Plugin (Wholesale Prices, Dynamic Pricing, Tiered Pricing)
Researcher
More Details >

WooCommerce <= 8.5.2 - Missing Authorization to Private/Draft Product Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1310
Patch Status
Patched
Published
Mar 25, 2024
Affected Software
WooCommerce
Researcher
More Details >

WooCommerce Multilingual & Multicurrency <= 5.3.4 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30466
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WooCommerce Multilingual & Multicurrency with WPML
Researcher
More Details >

WOOCS – WooCommerce Currency Switcher <= 1.4.1.7 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30458
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
FOX – Currency Switcher Professional for WooCommerce
Researcher
More Details >

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30457
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
MDTF – Meta Data and Taxonomies Filter
Researcher
More Details >

WP SMS <= 6.6.2 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30454
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
Researcher
More Details >

WPC Badge Management for WooCommerce <= 2.4.0 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30537
Patch Status
Patched
Published
Mar 29, 2024
Affected Software
WPC Badge Management for WooCommerce
Researcher
More Details >

WPCS <= 1.2.0.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30456
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
WPCS – WordPress Currency Switcher Professional
Researcher
More Details >

YITH WooCommerce Account Funds Premium <= 1.33.0 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-30470
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
YITH WooCommerce Account Funds Premium
Researcher
More Details >

Import Export WordPress Users <= 2.5.2 - Authenticated (Shop Manager+) Path Traversal

2.7
CVSS Rating
Low (2.7)
CVE-ID
CVE-2024-30492
Patch Status
Patched
Published
Mar 28, 2024
Affected Software
Export and Import Users and Customers
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Did you enjoy this post? Share it!

LinkedIn 

Comments

No Comments

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.