Wordfence Intelligence Weekly WordPress Vulnerability Report (April 29, 2024 to May 5, 2024)

🎉 Did you know we’re running a Bug Bounty Extravaganza again?

Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!

Last week, there were 162 vulnerabilities disclosed in 143 WordPress Plugins and 7 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 71 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 16,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• WAF-RULE-698 – Data redacted while we work with the vendor on a patch.
• WAF-RULE-696 – Data redacted while we work with the vendor on a patch.
• WAF-RULE-693 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Total Vulnerabilities by CVSS Severity Last Week

Total Vulnerabilities by CWE Type Last Week

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Francesco Carlucci	16
stealthcopter	15
Krzysztof Zając	11
Ngô Thiên An (ancorn_)	10
Steven Julian	8
Benedictus Jovan (aillesiM)	8
Lucio Sá	8
Dhabaleshwar Das	7
wesley (wcraft)	7
Abdi Pranata	6
Dimas Maulana	5
Bob Matyas	5
Dmitrii Ignatyev	4
Joshua Chan	4
Mika	4
Webbernaut	3
Khalid	3
Tim Coen	2
Cronus	2
Nathaniel Oh (0x4n3)	2
Manab Jyoti Dowarah	2
István Márton	2
Peng Zhou	2
LVT-tholv2k	2
M.Awad	1
Etan Imanol Castro Aldrete	1
Eduardo Berlanga (seqode)	1
Joaquin Alvarez	1
Abraham de León (h4m1)	1
José Vazquez (AKA Retr0_1000101)	1
Samuel Gonzalez (Winsad)	1
j0r38	1
Manuel Manjarrez	1
Alex Delgado	1
Emiliano Perez	1
M41w4r3	1
Xeniel	1
Cr4zyD14m0nd	1
l1ttl3Bugc4t	1
Dr4c0t4	1
Bryan Velez	1
mrgh057	1
D4ZC	1
Deibyd	1
MindFall	1
PumaHat	1
Tr3ckR	1
xm4nd0	1
pCix	1
0xjar8	1
Majed Refaea	1
Van Lyubov	1
Peter Thaleikis	1
Ivan Spiridonov (xbz0n)	1
andrea bocchetti	1
Abu Hurayra	1
Asaf Mozes	1
Richard Telleng (stueotue)	1
Edwin Siebel (edwinsiebel)	1
Le Ngoc Anh	1
thiennv	1
Muhammad Daffa	1
Dikshita Trivedi (Cybersecdexter)	1
Dave Jong	1
mike harris	1
Ray Wilson	1
Dau Hoang Tai	1
Jean Tirstan T	1
Pavel Palii	1
Mike	1
1337_Wannabe	1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

WordPress Themes with Reported Vulnerabilities Last Week

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Last Viewed Posts by WPBeginner <= 1.0.0 - Unauthenticated PHP Object Injection

9.8

CVSS Rating
Critical (9.8)

CVE-ID
CVE-2024-3070

Patch Status
Patched

Published
May 2, 2024

Affected Software
Last Viewed Posts by WPBeginner

Researcher

Francesco Carlucci

More Details >

School Management Pro <= 10.3.4 - Authenticated (School Admin+) SQL Injection

9.1

CVSS Rating
Critical (9.1)

CVE-ID
CVE-2024-33911

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
The School Management Pro

Researcher

Ivan Spiridonov (xbz0n)

More Details >

WordPress Meta Data and Taxonomies Filter (MDTF) <= 1.3.3.2 - Unauthenticated Arbitrary Shortcode Execution

9.1

CVSS Rating
Critical (9.1)

CVE-ID
CVE-2024-34434

Patch Status
Patched

Published
May 3, 2024

Affected Software
MDTF – Meta Data and Taxonomies Filter

Researcher

stealthcopter

More Details >

All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-4033

Patch Status
Patched

Published
May 1, 2024

Affected Software
All-in-One Video Gallery

Researcher

stealthcopter

More Details >

Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Authenticated (Subscriber+) SQL Injection

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-2661

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.

Researcher

Peter Thaleikis

More Details >

Calendar <= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-2831

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Calendar

Researcher

Krzysztof Zając

More Details >

ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-3240

Patch Status
Patched

Published
May 3, 2024

Affected Software
ConvertPlus

Researcher

1337_Wannabe

More Details >

rtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Subscriber+) SQL Injection

8.8

CVSS Rating
High (8.8)

CVE-ID
Unknown

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
rtMedia for WordPress, BuddyPress and bbPress

Researcher(s): Unknown

More Details >

Sina Extension for Elementor <= 3.5.1 - Authenticated (Contributor+) Local File Inclusion

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-34384

Patch Status
Patched

Published
May 3, 2024

Affected Software
Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)

Researcher

Ray Wilson

More Details >

Xserver Migrator <= 1.6.2 - Cross-Site Request Forgery to Arbitrary File Upload

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-33913

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Xserver Migrator

Researcher

Dimas Maulana

More Details >

ZD YouTube FLV Player <= 1.2.6 - Server-Side Request Forgery

8.3

CVSS Rating
High (8.3)

CVE-ID
CVE-2024-2663

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
ZD YouTube FLV Player

Researcher

Mike

More Details >

Customer Email Verification for WooCommerce <= 2.7.4 - Email Verification and Authentication Bypass due to Insufficient Randomness

8.1

CVSS Rating
High (8.1)

CVE-ID
CVE-2024-4185

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Customer Email Verification for WooCommerce

Researcher

István Márton

More Details >

Event Monster <= 1.3.6 - Authenticated(Contributor+) PHP Object Injection via Custom Meta

7.5

CVSS Rating
High (7.5)

CVE-ID
CVE-2024-1895

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Event Monster – Event Management, Tickets Booking, Upcoming Event

Researcher

Francesco Carlucci

More Details >

Grid Gallery – Photo Image Grid Gallery <= 1.4.3 - Authenticated(Contributor+) PHP Object Injection via shortcode

7.5

CVSS Rating
High (7.5)

CVE-ID
CVE-2024-1897

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Grid Gallery – Photo Image Grid Gallery

Researcher

Francesco Carlucci

More Details >

Photo Gallery <= 1.4.1 - Authenticated(Contributor+) PHP Object Injection via Shortcode

7.5

CVSS Rating
High (7.5)

CVE-ID
CVE-2024-1896

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Photo Gallery – Responsive Photo Gallery, Image Gallery, Portfolio Gallery, Logo Gallery And Team Gallery

Researcher

Francesco Carlucci

More Details >

Cost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload

7.2

CVSS Rating
High (7.2)

CVE-ID
CVE-2024-4097

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Cost Calculator Builder PRO

Researcher

andrea bocchetti

More Details >

WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection

7.2

CVSS Rating
High (7.2)

CVE-ID
CVE-2024-1173

Patch Status
Patched

Published
May 1, 2024

Affected Software
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting

Researcher

Edwin Siebel (edwinsiebel)

More Details >

Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution

6.5

CVSS Rating
Medium (6.5)

CVE-ID
CVE-2024-3957

Patch Status
Patched

Published
May 1, 2024

Affected Software
Booster for WooCommerce

Researcher

stealthcopter

More Details >

LeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

6.5

CVSS Rating
Medium (6.5)

CVE-ID
CVE-2024-1371

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
LeadConnector

Researcher

Krzysztof Zając

More Details >

3D FlipBook <= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URL

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3883

Patch Status
Patched

Published
May 1, 2024

Affected Software
3D FlipBook – PDF Flipbook WordPress

Researcher

Tim Coen

More Details >

Adventure Journal <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33953

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Adventure Journal

Researcher

stealthcopter

More Details >

AJAX Login and Registration modal popup + inline form <= 2.23 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33918

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
AJAX Login and Registration modal popup + inline form

Researcher

Ngô Thiên An (ancorn_)

More Details >

All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3554

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic

Researcher

Krzysztof Zając

More Details >

All in One SEO <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3368

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic

Researcher

Dmitrii Ignatyev

More Details >

Blocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4158

Patch Status
Patched

Published
May 3, 2024

Affected Software
Blocksy

Researcher

Ngô Thiên An (ancorn_)

More Details >

Breakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2023-6854

Patch Status
Patched

Published
May 3, 2024

Affected Software
Breakdance

Researcher

Francesco Carlucci

More Details >

BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3974

Patch Status
Patched

Published
May 3, 2024

Affected Software
BuddyPress

Researcher

wesley (wcraft)

More Details >

CPO Companion <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33916

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
CPO Companion

Researcher

Ngô Thiên An (ancorn_)

More Details >

Edge <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-34376

Patch Status
Patched

Published
May 3, 2024

Affected Software
Edge

Researcher

stealthcopter

More Details >

Eleblog – Elementor Blog And Magazine Addons <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33945

Patch Status
Unpatched

Published
Apr 30, 2024

Affected Software
Eleblog – Elementor Blog And Magazine Addons

Researcher

Khalid

More Details >

Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3743

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Elementor Addon Elements

Researcher

stealthcopter

More Details >

Elementor ImageBox <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3074

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Elementor ImageBox

Researchers

Etan Imanol Castro Aldrete

Eduardo Berlanga (seqode)

Joaquin Alvarez

Abraham de León (h4m1)

José Vazquez (AKA Retr0_1000101)

Samuel Gonzalez (Winsad)

j0r38

Manuel Manjarrez

Alex Delgado

Emiliano Perez

M41w4r3

Xeniel

Cr4zyD14m0nd

l1ttl3Bugc4t

Dr4c0t4

Bryan Velez

mrgh057

D4ZC

Deibyd

MindFall

PumaHat

Tr3ckR

xm4nd0

pCix

0xjar8

More Details >

Elementor Website Builder Pro <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4107

Patch Status
Patched

Published
May 2, 2024

Affected Software
Elementor Website Builder Pro

Researcher

wesley (wcraft)

More Details >

ElementsKit Elementor addons 3.0.7 - 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3650

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
ElementsKit Elementor addons and Templates Library

Researcher

wesley (wcraft)

More Details >

ElementsReady Addons for Elementor <= 5.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-34374

Patch Status
Patched

Published
May 3, 2024

Affected Software
ElementsReady Addons for Elementor

Researcher

Khalid

More Details >

Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4156

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders

Researcher

wesley (wcraft)

More Details >

Fancy Elementor Flipbox <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-2349

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Fancy Elementor Flipbox

Researcher

Francesco Carlucci

More Details >

Follow Us Badges <= 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3280

Patch Status
Patched

Published
May 1, 2024

Affected Software
Follow Us Badges

Researcher

Lucio Sá

More Details >

Freesia Empire <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33955

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Freesia Empire

Researcher

stealthcopter

More Details >

Giphypress <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33927

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Giphypress

Researcher

Ngô Thiên An (ancorn_)

More Details >

Google Doc Embedder <= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgery

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-0216

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Google Doc Embedder

Researcher

István Márton

More Details >

Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-2273

Patch Status
Patched

Published
May 1, 2024

Affected Software
Gutenberg Blocks with AI by Kadence WP – Page Builder Features

Researcher

Dau Hoang Tai

More Details >

GWP-Histats <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33926

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
GWP-Histats

Researcher

Ngô Thiên An (ancorn_)

More Details >

Inline Google Spreadsheet Viewer <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3674

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Inline Google Spreadsheet Viewer

Researcher

Krzysztof Zając

More Details >

Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-0334

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Jeg Elementor Kit

Researcher

Webbernaut

More Details >

Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3161

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Jeg Elementor Kit

Researcher

Webbernaut

More Details >

LA-Studio Element Kit for Elementor <= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3005

Patch Status
Patched

Published
May 1, 2024

Affected Software
LA-Studio Element Kit for Elementor

Researcher

Abu Hurayra

More Details >

Login Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33932

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Login Logout Register Menu

Researcher

Ngô Thiên An (ancorn_)

More Details >

MailerLite – Signup forms (official) 1.5.0 - 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1386

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
MailerLite – Signup forms (official)

Researcher

Richard Telleng (stueotue)

More Details >

Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4265

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor

Researcher

stealthcopter

More Details >

Mini Loops <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33934

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Mini Loops

Researcher

Ngô Thiên An (ancorn_)

More Details >

PB MailCrypt <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33935

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
PB MailCrypt – AntiSpam Email Encryption

Researcher

Ngô Thiên An (ancorn_)

More Details >

Perfect Pullquotes <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33951

Patch Status
Unpatched

Published
Apr 30, 2024

Affected Software
Perfect Pullquotes

Researcher

LVT-tholv2k

More Details >

Pliska <= 0.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Display Name

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33954

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Pliska

Researcher

stealthcopter

More Details >

Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.7 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Templates

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1679

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce

Researcher

Lucio Sá

More Details >

Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33936

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Print-O-Matic

Researcher

Ngô Thiên An (ancorn_)

More Details >

PropertyHive <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-34381

Patch Status
Patched

Published
May 3, 2024

Affected Software
PropertyHive

Researcher

LVT-tholv2k

More Details >

Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4335

Patch Status
Patched

Published
May 3, 2024

Affected Software
Rank Math SEO with AI Best SEO Tools

Researcher

wesley (wcraft)

More Details >

ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3991

Patch Status
Patched

Published
May 2, 2024

Affected Software
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)

Researcher

stealthcopter

More Details >

Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4383

Patch Status
Patched

Published
May 3, 2024

Affected Software
Simple Membership

Researcher

wesley (wcraft)

More Details >

Slider Revolution <= 6.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via htmltag Parameter

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4092

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Slider Revolution

Researcher

wesley (wcraft)

More Details >

Sliding Widgets <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33938

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Sliding Widgets

Researcher

Dimas Maulana

More Details >

Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4334

Patch Status
Patched

Published
May 1, 2024

Affected Software
Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder

Researcher

Webbernaut

More Details >

Sydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4036

Patch Status
Patched

Published
May 1, 2024

Affected Software
Sydney Toolbox

Researcher

stealthcopter

More Details >

Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4193

Patch Status
Patched

Published
May 3, 2024

Affected Software
Testimonial Slider

Researcher

Krzysztof Zając

More Details >

TweetScroll Widget <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33948

Patch Status
Unpatched

Published
Apr 30, 2024

Affected Software
TweetScroll Widget

Researcher

Joshua Chan

More Details >

Unique <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-33952

Patch Status
Unpatched

Published
Apr 30, 2024

Affected Software
Unique

Researcher

stealthcopter

More Details >

WordPress Header Builder Plugin – Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4000

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
WordPress Header Builder Plugin – Pearl

Researcher

Krzysztof Zając

More Details >

WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3490

Patch Status
Patched

Published
May 1, 2024

Affected Software
WP Recipe Maker

Researcher

stealthcopter

More Details >

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-3550

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
WP Shortcodes Plugin — Shortcodes Ultimate

Researcher

stealthcopter

More Details >

WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-4324

Patch Status
Patched

Published
May 1, 2024

Affected Software
WP Video Lightbox

Researcher

Krzysztof Zając

More Details >

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization

6.3

CVSS Rating
Medium (6.3)

CVE-ID
CVE-2024-3942

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education

Researcher

Lucio Sá

More Details >

Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.7 - Improper Authorization

6.3

CVSS Rating
Medium (6.3)

CVE-ID
CVE-2024-1677

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce

Researcher

Lucio Sá

More Details >

AA Cash Calculator <= 1.0 - Reflected Cross-Site Scripting via invoice

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-0848

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
AA Cash Calculator

Researcher

Nathaniel Oh (0x4n3)

More Details >

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-4133

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup

Researcher

Krzysztof Zając

More Details >

CodeBard's Patron Button and Widgets for Patreon <= 2.2.0 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-33928

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
CodeBard's Patron Button and Widgets for Patreon

Researcher

Le Ngoc Anh

More Details >

Pet Manager <= 1.4 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-3917

Patch Status
Unpatched

Published
May 2, 2024

Affected Software
Pet Manager

Researcher

Bob Matyas

More Details >

Popup box <= 4.1.2 - Cross-Site Request Forgery

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-34367

Patch Status
Patched

Published
May 3, 2024

Affected Software
Popup Box – Best WordPress Popup Plugin

Researcher

Steven Julian

More Details >

Realtyna Organic IDX plugin <= 4.14.4 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-33924

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Realtyna Organic IDX plugin + WPL Real Estate

Researcher

Muhammad Daffa

More Details >

RegistrationMagic <= 5.3.2.0 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-33947

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
RegistrationMagic – User Registration Plugin with Custom Registration Forms

Researcher

Dimas Maulana

More Details >

Sailthru Triggermail <= 1.1 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-4289

Patch Status
Unpatched

Published
Apr 30, 2024

Affected Software
Sailthru Triggermail

Researcher

Bob Matyas

More Details >

Simple Basic Contact Form <= 20221201 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-4150

Patch Status
Patched

Published
May 3, 2024

Affected Software
Simple Basic Contact Form

Researcher

Krzysztof Zając

More Details >

Webpushr <= 4.35.0 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-34369

Patch Status
Patched

Published
May 3, 2024

Affected Software
Web Push Notifications – Webpushr

Researcher

Dimas Maulana

More Details >

WPify Woo Czech <= 4.0.10 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-33946

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
WPify Woo Czech

Researcher

Dimas Maulana

More Details >

Carousel Slider <= 2.2.10 - Authenticated (Editor+) Stored Cross-Site Scripting

5.5

CVSS Rating
Medium (5.5)

CVE-ID
CVE-2024-4372

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Carousel Slider

Researcher

Dmitrii Ignatyev

More Details >

Where Did You Hear About Us Checkout Field for WooCommerce <= 1.3.1 - Authenticated (Shop Manager+) Stored Cross-Site Scripting

5.5

CVSS Rating
Medium (5.5)

CVE-ID
CVE-2024-2752

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Where Did You Hear About Us Checkout Field for WooCommerce

Researcher

Francesco Carlucci

More Details >

Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorization

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2024-1809

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy)

Researcher

Lucio Sá

More Details >

ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2024-3237

Patch Status
Patched

Published
May 3, 2024

Affected Software
ConvertPlus

Researcher

M.Awad

More Details >

Exclusive Addons Elementor <= 2.6.9.1 - Missing Authorization to Post Duplication

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2024-33914

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Exclusive Addons for Elementor

Researcher

Khalid

More Details >

Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2024-3868

Patch Status
Patched

Published
May 3, 2024

Affected Software
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager

Researcher

mike harris

More Details >

Min and Max Purchase for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2024-33949

Patch Status
Unpatched

Published
Apr 30, 2024

Affected Software
Min and Max Purchase for WooCommerce

Researcher

Joshua Chan

More Details >

Pet Manager <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2024-3918

Patch Status
Unpatched

Published
May 2, 2024

Affected Software
Pet Manager

Researcher

Bob Matyas

More Details >

Premium Addons for Elementor <= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2024-4203

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Premium Addons for Elementor

Researcher

Ngô Thiên An (ancorn_)

More Details >

Share This Image <= 1.98 - Open Redirect

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2024-33930

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Share This Image

Researcher

stealthcopter

More Details >

Stop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2023-7065

Patch Status
Patched

Published
May 3, 2024

Affected Software
Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms

Researcher

Lucio Sá

More Details >

Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_display

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-2109

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Booster Extension

Researcher

Krzysztof Zając

More Details >

Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-3649

Patch Status
Patched

Published
May 1, 2024

Affected Software
Contact Form by WPForms – Drag & Drop Form Builder for WordPress

Researcher

Asaf Mozes

More Details >

Democracy Poll <= 6.0.3 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33920

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Democracy Poll

Researcher

thiennv

More Details >

Digital Publications by Supsystic <= 1.7.7 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33910

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
WordPress Flipbook by Supsystic

Researcher

Steven Julian

More Details >

Directorist <= 7.8.6 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33929

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Directorist – WordPress Business Directory Plugin with Classified Ads Listings

Researcher

Dhabaleshwar Das

More Details >

Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-3717

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Drag and Drop Multiple File Upload – Contact Form 7

Researcher

Tim Coen

More Details >

EAN for WooCommerce <= 4.8.9 - Authenticated (Shop Manager+) Arbitrary Options Update

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-34370

Patch Status
Patched

Published
May 3, 2024

Affected Software
EAN, UPC, ISBN Generator: Product Barcode Inventory for WooCommerce

Researcher

Majed Refaea

More Details >

iPages Flipbook <= 1.5.1 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33909

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
iPages Flipbook For WordPress

Researcher

Steven Julian

More Details >

iPanorama 360 WordPress Virtual Tour Builder <= 1.8.1 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33941

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
iPanorama 360 – WordPress Virtual Tour Builder

Researcher

Dhabaleshwar Das

More Details >

JW Player for WordPress <= 2.3.3 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33931

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
JW Player for WordPress

Researcher

Mika

More Details >

MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-2797

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
MailerLite – Signup forms (official)

Researcher

Krzysztof Zając

More Details >

Masteriyo - LMS <= 1.7.3 - Insecure Direct Object Reference

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33939

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Masteriyo LMS – eLearning and Online Course Builder for WordPress

Researcher

Steven Julian

More Details >

Media Cleaner: Clean your WordPress! <= 6.7.2 - Unauthenticated Information Exposure

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33922

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Media Cleaner: Clean your WordPress!

Researcher

Joshua Chan

More Details >

Mooberry Book Manager <= 4.15.12 - Unauthenticated Information Exposure via Export Files

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-34368

Patch Status
Patched

Published
May 3, 2024

Affected Software
Mooberry Book Manager

Researcher

Steven Julian

More Details >

Post Grid Master <= 3.4.7 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-34372

Patch Status
Patched

Published
May 3, 2024

Affected Software
Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder

Researcher

Dhabaleshwar Das

More Details >

Print My Blog – Print, PDF, & eBook Converter WordPress Plugin <= 3.26.2 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33907

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin

Researcher

Steven Julian

More Details >

Robo Gallery <= 3.2.18 - Unauthenticated Information Exposure

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-34382

Patch Status
Patched

Published
May 3, 2024

Affected Software
Photo Gallery, Images, Slider in Rbs Image Gallery

Researcher

Peng Zhou

More Details >

RomethemeKit For Elementor <= 1.4.1 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33919

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
RomethemeKit For Elementor

Researcher

Mika

More Details >

SEOPress <= 7.6.1 - Information Exposure

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-34383

Patch Status
Patched

Published
May 3, 2024

Affected Software
SEOPress – On-site SEO

Researcher

Peng Zhou

More Details >

ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2023-6327

Patch Status
Patched

Published
May 3, 2024

Affected Software
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)

Researcher

Francesco Carlucci

More Details >

SimpleShop <= 2.10.2 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1229

Patch Status
Patched

Published
May 3, 2024

Affected Software
SimpleShop

Researcher

Francesco Carlucci

More Details >

Social Share Icons & Social Share Buttons <= 3.6.2 - Missing Authorization to Notice Dismissal

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-32820

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Social Share Icons & Social Share Buttons

Researcher

Mika

More Details >

Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1678

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Subway – Private Site Option

Researcher

Francesco Carlucci

More Details >

Swift Framework <= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-3916

Patch Status
Unpatched

Published
May 3, 2024

Affected Software
Swift Framework

Researcher

Francesco Carlucci

More Details >

Swift Framework <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-3915

Patch Status
Unpatched

Published
May 3, 2024

Affected Software
Swift Framework

Researcher

Francesco Carlucci

More Details >

Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery <= 1.5.3 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-34377

Patch Status
Patched

Published
May 3, 2024

Affected Software
Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery

Researcher

Steven Julian

More Details >

WidgetKit <= 2.5.0 - Missing Authorization to Notice Dismissal

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33908

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
All-in-One Addons for Elementor – WidgetKit

Researcher

Dhabaleshwar Das

More Details >

Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1688

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Woo Total Sales

Researcher

Lucio Sá

More Details >

WooCommerce AWeber Newsletter Subscription <= 4.0.2 - Missing Authorization to Access Token Modification

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33944

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
AWeber for WooCommerce

Researcher

Dave Jong

More Details >

WTI Like Post <= 1.4.6 - IP Spoofing

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-33917

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
WTI Like Post

Researcher

Mika

More Details >

Admin Page Spider <= 3.31 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-2401

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Admin Page Spider

Researcher

Dikshita Trivedi (Cybersecdexter)

More Details >

AnnounceKit <= 2.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-3023

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
AnnounceKit

Researcher

Benedictus Jovan (aillesiM)

More Details >

Archives Calendar Widget <= 1.0.15 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-33950

Patch Status
Unpatched

Published
Apr 30, 2024

Affected Software
Archives Calendar Widget

Researcher

Joshua Chan

More Details >

Button contact VR <= 4.7 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-2220

Patch Status
Unpatched

Published
May 2, 2024

Affected Software
Button contact VR

Researcher

Dmitrii Ignatyev

More Details >

Conversational Forms for ChatBot <= 1.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-34380

Patch Status
Patched

Published
May 3, 2024

Affected Software
ChatBot Conversational Forms

Researcher

Jean Tirstan T

More Details >

Download Alt Text AI <= 1.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-34366

Patch Status
Patched

Published
May 3, 2024

Affected Software
Alt Text AI – Automatically generate image alt text for SEO and accessibility

Researcher

Manab Jyoti Dowarah

More Details >

EventON <= 2.2.14 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-33940

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
EventON

Researcher

Van Lyubov

More Details >

Flattr <= 1.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-3920

Patch Status
Unpatched

Published
May 2, 2024

Affected Software
Flattr

Researcher

Bob Matyas

More Details >

Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor <= 4.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-2967

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor

Researcher

Benedictus Jovan (aillesiM)

More Details >

Mhr Post Ticker <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-3021

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Mhr Post Ticker

Researcher

Benedictus Jovan (aillesiM)

More Details >

Sailthru Triggermail <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-4290

Patch Status
Unpatched

Published
Apr 30, 2024

Affected Software
Sailthru Triggermail

Researcher

Bob Matyas

More Details >

Sheets To WP Table Live Sync <= 3.7.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-34375

Patch Status
Patched

Published
May 3, 2024

Affected Software
Table Plugin for WordPress with Google Sheets Integration – Sheets to WP Table Live Sync

Researcher

Manab Jyoti Dowarah

More Details >

Simple Image Popup <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-4433

Patch Status
Unpatched

Published
May 2, 2024

Affected Software
Simple Image Popup

Researcher

Cronus

More Details >

Social Icons Widget & Block <= 4.2.17 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-2189

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Social Icons Widget & Block by WPZOOM

Researcher

Dmitrii Ignatyev

More Details >

SVS Pricing Tables <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-2958

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
SVS Pricing Tables

Researcher

Benedictus Jovan (aillesiM)

More Details >

Tabellen von faustball.com <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-4085

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Tabellen von faustball.com

Researcher

Benedictus Jovan (aillesiM)

More Details >

Ultimate Under Construction <= 1.9.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-33943

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Ultimate Under Construction

Researcher

Cronus

More Details >

5280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0847

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
5280 Bootstrap Modal Contact Form

Researcher

Nathaniel Oh (0x4n3)

More Details >

Academy LMS <= 1.9.16 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-33912

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Academy LMS – eLearning and online course solution for WordPress

Researcher

Steven Julian

More Details >

ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-3072

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
ACF Front End Editor

Researcher

Francesco Carlucci

More Details >

ACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-3071

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
ACF On-The-Go

Researcher

Francesco Carlucci

More Details >

Custom WooCommerce Checkout Fields Editor <= 1.3.1 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-33956

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
Custom WooCommerce Checkout Fields Editor

Researcher

Abdi Pranata

More Details >

Debug Log Manager <= 2.3.1 - Missing Authorization via toggle_debugging

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-33915

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
Debug Log Manager

Researcher

Dhabaleshwar Das

More Details >

Different Menu in Different Pages – Control Menu Visibility (All in One) <= 2.3.2 - Missing Authorization to Menu Duplication

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-3206

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Different Menu in Different Pages – Control Menu Visibility (All in One)

Researcher

Lucio Sá

More Details >

Easy Restaurant Table Booking <= 1.0.0 - Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-4083

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Easy Restaurant Table Booking

Researcher

Benedictus Jovan (aillesiM)

More Details >

Embed Google Fonts <= 3.1.0 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-33925

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Embed Google Fonts

Researcher

Abdi Pranata

More Details >

Google Typography <= 1.1.2 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-33942

Patch Status
Unpatched

Published
Apr 30, 2024

Affected Software
Google Typography

Researcher

Abdi Pranata

More Details >

Import and export users and customers <= 1.26.5 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1050

Patch Status
Patched

Published
May 3, 2024

Affected Software
Import and export users and customers

Researcher

Francesco Carlucci

More Details >

Login with phone number <= 1.7.18 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-34371

Patch Status
Patched

Published
May 3, 2024

Affected Software
Login with phone number

Researcher

Dhabaleshwar Das

More Details >

Progressive WordPress (PWA) <= 2.1.13 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-33937

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
Progressive WordPress (PWA)

Researcher

Abdi Pranata

More Details >

Restaurant and Cafe <= 1.2.1 - Cross-Site Request Forgery to Notice Dismissal

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-34379

Patch Status
Patched

Published
May 3, 2024

Affected Software
Restaurant and Cafe

Researcher

Dhabaleshwar Das

More Details >

ReviewX <= 1.6.21 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-33921

Patch Status
Patched

Published
Apr 29, 2024

Affected Software
ReviewX – Multi-criteria Rating & Reviews for WooCommerce

Researcher

Abdi Pranata

More Details >

SimpleShop <= 2.10.0 - Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1230

Patch Status
Patched

Published
May 3, 2024

Affected Software
SimpleShop

Researcher

Francesco Carlucci

More Details >

SP Project & Document Manager <= 4.69 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-33923

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
SP Project & Document Manager

Researcher

Abdi Pranata

More Details >

SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-2960

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
SVS Pricing Tables

Researcher

Benedictus Jovan (aillesiM)

More Details >

SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-2959

Patch Status
Unpatched

Published
Apr 29, 2024

Affected Software
SVS Pricing Tables

Researcher

Benedictus Jovan (aillesiM)

More Details >

The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-3936

Patch Status
Patched

Published
Apr 30, 2024

Affected Software
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid

Researcher

Pavel Palii

More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.