Chloe Chamberland
May 30, 2024

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 20, 2024 to May 26, 2024)

📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest. 

Last week, there were 141 vulnerabilities disclosed in 125 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 53 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 16,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 109
Unpatched 32

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 114
High Severity 20
Critical Severity 7

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 80
Missing Authorization 15
Cross-Site Request Forgery (CSRF) 9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 7
Improper Access Control 4
Improper Control of Generation of Code ('Code Injection') 4
Deserialization of Untrusted Data 3
Improper Neutralization of Alternate XSS Syntax 3
Unrestricted Upload of File with Dangerous Type 3
Authentication Bypass Using an Alternate Path or Channel 2
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 2
Server-Side Request Forgery (SSRF) 2
Exposure of Sensitive Data Through Data Queries 1
Improper Authorization 1
Improper Neutralization of Special Elements used in a Command ('Command Injection') 1
Improper Protection of Alternate Path 1
Information Exposure Through Log Files 1
URL Redirection to Untrusted Site ('Open Redirect') 1
Use of Hard-coded Password 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
21
14
12
12
11
8
7
4
3
3
2
2
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
140+ Widgets | Xpro Addons For Elementor – FREE xpro-elementor-addons
AdFoxly – Ad Manager, AdSense Ads & Ads.txt adfoxly
Advanced iFrame advanced-iframe
AI ChatBot for WordPress – WPBot chatbot
Alemha watermarker alemha-watermark
Amen amen
ApplyOnline – Application Form Builder and Manager apply-online
Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress bookingpress-appointment-booking
ARI Fancy Lightbox – Popup for WordPress ari-fancy-lightbox
Automatic Translator with Google Translate auto-translate
Awesome Contact Form7 for Elementor awesome-contact-form7-for-elementor
AZAN Plugin azan
Brizy – Page Builder brizy
BSK PDF Manager bsk-pdf-manager
Business Directory Plugin – Easy Listing Directories for WordPress business-directory-plugin
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder fluentform
Country State City Dropdown CF7 country-state-city-auto-dropdown
Crafthemes Demo Import crafthemes-demo-import
Custom Fonts – Host Your Fonts Locally custom-fonts
Debug Log – Manger Tool debug-log-config-tool
Dextaz Ping dextaz-ping
Elegant Addons for elementor elegant-addons-for-elementor
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) bdthemes-element-pack-lite
Elementor Header & Footer Builder header-footer-elementor
Elementor Website Builder – More than Just a Page Builder elementor
ElementsKit Pro elementskit
Email Log email-log
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce email-subscribers
EmbedPress – Embed PDF, PDF 3D FlipBook, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor embedpress
Event post event-post
Fastly fastly
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty chaty
FooGallery Premium foogallery-premium
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel foogallery
Gutenberg Blocks, Page Builder – ComboBlocks post-grid
Hash Elements hash-elements
Hash Form – Drag & Drop Form Builder hash-form
HT Mega – Absolute Addons For Elementor ht-mega-for-elementor
iframe iframe
Inquiry cart inquiry-cart
jQuery T(-) Countdown Widget jquery-t-countdown-widget
LA-Studio Element Kit for Elementor lastudio-element-kit
LayerSlider LayerSlider
LearnPress – WordPress LMS Plugin learnpress
LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor include-lottie-animation-for-elementor
LuckyWP Table of Contents luckywp-table-of-contents
Master Slider – Responsive Touch Slider master-slider
Media Library Assistant media-library-assistant
Memberpress memberpress
Move Addons for Elementor move-addons
ND Shortcodes nd-shortcodes
NextScripts: Social Networks Auto-Poster social-networks-auto-poster-facebook-twitter-g
Ninja Beaver Add-ons for Beaver Builder ninja-beaver-lite-addons-for-beaver-builder
Opal Estate Pro – Property Management and Submission opal-estate-pro
Oxygen Builder oxygenbuilder
Page Builder by SiteOrigin siteorigin-panels
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress wp-user-avatar
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode paypal-pay-buy-donation-and-cart-buttons-shortcode
PDF Embedder pdf-embedder
PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip 3d-flipbook-dflip-lite
PDF Poster – PDF Embedder Plugin pdf-poster
PDF Viewer for Elementor pdf-viewer-for-elementor
PDF.js Viewer pdfjs-viewer-shortcode
Pie Register - Social Sites Login (Add on) pie-register-social-site
Piotnet Addons For Elementor piotnet-addons-for-elementor
Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation optinmonster
PopupAlly popupally
Post SMTP – WordPress SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more post-smtp
Praison SEO WordPress seo-wordpress
Pray For Me pray-for-me
Prayer wp-prayers-request
Premium Addons for Elementor premium-addons-for-elementor
Primary Addon for Elementor primary-addon-for-elementor
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) bdthemes-prime-slider-lite
Print-O-Matic print-o-matic
Responsive Contact Form Builder & Lead Generation Plugin lead-form-builder
Reviews and Rating – Google Reviews g-business-reviews-rating
RomethemeForm For Elementor romethemeform
Schema App Structured Data schema-app-structured-data-for-schemaorg
Search & Replace search-and-replace
SEOPress – On-site SEO wp-seopress
ShareThis Share Buttons sharethis-share-buttons
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) woolentor-addons
Similarity similarity
Simple Popup Manager simple-popup-manager
SiteOrigin Widgets Bundle so-widgets-bundle
Social Pixel social-pixel
Social Sharing Plugin – Sassy Social Share sassy-social-share
Spectra – WordPress Gutenberg Blocks ultimate-addons-for-gutenberg
SVGator – Add Animated SVG Easily svgator
SVGMagic svgmagic
Tainacan tainacan
Testimonial Carousel For Elementor testimonials-carousel-elementor
The Events Calendar the-events-calendar
The Events Calendar Pro the-events-calendar-pro
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce the-plus-addons-for-elementor-page-builder
Themify Builder themify-builder
Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced toolbar-extras
UberMenu ubermenu
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor
UserPro - Community and User Profile WordPress Plugin userpro
Videojs HTML5 Player videojs-html5-player
Visual Website Collaboration, Feedback & Project Management – Atarim atarim-visual-collaboration
Web Directory Free web-directory-free
Wonder PDF Embed wonderplugin-pdf-embed
WordPress + Microsoft Office 365 / Azure AD | LOGIN wpo365-login
WordPress Jitsi Shortcode wp-jitsi-shortcodes
WP Booking wp-easy-booking
WP DSGVO Tools (GDPR) shapepress-dsgvo
WP Font Awesome Share Icons wp-font-awesome-share-icons
WP Go Maps (formerly WP Google Maps) wp-google-maps
WP Next Post Navi wp-next-post-navi
WP Photo Album Plus wp-photo-album-plus
WP Scraper wp-scraper
WP Shortcodes Plugin — Shortcodes Ultimate shortcodes-ultimate
WP Table Builder – WordPress Table Plugin wp-table-builder
WP Ultimate Post Grid wp-ultimate-post-grid
WP-ViperGB wp-vipergb
WPB Elementor Addons wpb-elementor-addons
WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce wp-cafe
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin wpdatatables
WPKoi Templates for Elementor wpkoi-templates-for-elementor
WPZOOM Addons for Elementor (Templates, Widgets) wpzoom-elementor-addons
YITH WooCommerce Ajax Search yith-woocommerce-ajax-search
YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress youtube-showcase

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Blocksy blocksy

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-4443
Patch Status
Patched
Published
May 21, 2024
Affected Software
Business Directory Plugin – Easy Listing Directories for WordPress
Researcher
More Details >

Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-3495
Patch Status
Patched
Published
May 21, 2024
Affected Software
Country State City Dropdown CF7
Researcher
More Details >

Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-5084
Patch Status
Patched
Published
May 22, 2024
Affected Software
Hash Form – Drag & Drop Form Builder
Researcher
More Details >

Pie Register - Social Sites Login (Add on) <= 1.7.7 - Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-4544
Patch Status
Patched
Published
May 23, 2024
Affected Software
Pie Register - Social Sites Login (Add on)
Researcher
More Details >

UserPro <= 5.1.8 - Unauthenticated Account Takeover to Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-35700
Patch Status
Patched
Published
May 21, 2024
Affected Software
UserPro - Community and User Profile WordPress Plugin
Researcher
More Details >

Web Directory Free <= 1.6.9 - Unauthenticated SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-3552
Patch Status
Patched
Published
May 23, 2024
Affected Software
Web Directory Free
Researchers
More Details >

WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-5147
Patch Status
Patched
Published
May 21, 2024
Affected Software
WPZOOM Addons for Elementor (Templates, Widgets)
Researcher
More Details >

Crafthemes Demo Import <= 3.3 - Missing Authorization to Arbitrary Plugin Installation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-34800
Patch Status
Unpatched
Published
May 20, 2024
Affected Software
Crafthemes Demo Import
Researcher
More Details >

HT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1974
Patch Status
Patched
Published
May 23, 2024
Affected Software
HT Mega – Absolute Addons For Elementor
Researcher
More Details >

Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-3518
Patch Status
Patched
Published
May 21, 2024
Affected Software
Media Library Assistant
Researcher
More Details >

Oxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code Execution

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-4662
Patch Status
Patched
Published
May 22, 2024
Affected Software
Oxygen Builder
Researcher
More Details >

Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-4779
Patch Status
Patched
Published
May 22, 2024
Affected Software
Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Researcher
More Details >

MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode

8.5
CVSS Rating
High (8.5)
CVE-ID
CVE-2024-5031
Patch Status
Patched
Published
May 21, 2024
Affected Software
Memberpress
Researcher
More Details >

NextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposure

8.5
CVSS Rating
High (8.5)
CVE-ID
CVE-2024-2088
Patch Status
Patched
Published
May 21, 2024
Affected Software
NextScripts: Social Networks Auto-Poster
Researcher
More Details >

Email Log <= 2.4.8 - Unauthenticated Hook Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-0867
Patch Status
Patched
Published
May 23, 2024
Affected Software
Email Log
Researcher
More Details >

Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-5085
Patch Status
Patched
Published
May 22, 2024
Affected Software
Hash Form – Drag & Drop Form Builder
Researcher
More Details >

140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection

8.0
CVSS Rating
High (8.0)
CVE-ID
CVE-2024-4471
Patch Status
Patched
Published
May 22, 2024
Affected Software
140+ Widgets | Xpro Addons For Elementor – FREE
Researcher
More Details >

Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-4157
Patch Status
Patched
Published
May 21, 2024
Affected Software
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder
Researcher
More Details >

Visual Website Collaboration, Feedback & Project Management – Atarim <= 3.22.6 - Hardcoded Credentials

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-2038
Patch Status
Patched
Published
May 22, 2024
Affected Software
Visual Website Collaboration, Feedback & Project Management – Atarim
Researcher
More Details >

Dextaz Ping <= 0.65 - Authenticated (Admin+) Remote Code Execution

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-34792
Patch Status
Unpatched
Published
May 20, 2024
Affected Software
Dextaz Ping
Researchers
More Details >

Piotnet Addons For Elementor <= 2.4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Attributes

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-4262
Patch Status
Patched
Published
May 21, 2024
Affected Software
Piotnet Addons For Elementor
Researcher
More Details >

POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-5207
Patch Status
Patched
Published
May 22, 2024
Affected Software
Post SMTP – WordPress SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more
Researcher
More Details >

Pray For Me <= 1.0.4 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-3966
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
Pray For Me
Researcher
More Details >

Search & Replace <= 3.2.1 - Authenticated (Administrator+) SQL injection

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-4145
Patch Status
Patched
Published
May 23, 2024
Affected Software
Search & Replace
Researcher
More Details >

Tainacan <= 0.21.3 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-34794
Patch Status
Patched
Published
May 20, 2024
Affected Software
Tainacan
Researcher
More Details >

YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-4455
Patch Status
Patched
Published
May 23, 2024
Affected Software
YITH WooCommerce Ajax Search
Researcher
More Details >

ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification

7.1
CVSS Rating
High (7.1)
CVE-ID
CVE-2024-4566
Patch Status
Patched
Published
May 20, 2024
Affected Software
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)
Researcher
More Details >

WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-4037
Patch Status
Patched
Published
May 23, 2024
Affected Software
WP Photo Album Plus
Researcher
More Details >

Advanced iFrame <= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4365
Patch Status
Patched
Published
May 22, 2024
Affected Software
Advanced iFrame
Researcher
More Details >

Alemha Watermarker <= 1.3.1 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3754
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
Alemha watermarker
Researcher
More Details >

Awesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4486
Patch Status
Patched
Published
May 22, 2024
Affected Software
Awesome Contact Form7 for Elementor
Researcher
More Details >

Blocksy <= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4943
Patch Status
Patched
Published
May 20, 2024
Affected Software
Blocksy
Researcher
More Details >

Custom Fonts – Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1332
Patch Status
Patched
Published
May 23, 2024
Affected Software
Custom Fonts – Host Your Fonts Locally
Researcher
More Details >

Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3066
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
Elegant Addons for elementor
Researcher
More Details >

Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Switcher, Slider, and Iconbox Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5092
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
Elegant Addons for elementor
Researcher
More Details >

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3926
Patch Status
Patched
Published
May 21, 2024
Affected Software
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Researcher
More Details >

Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2618
Patch Status
Patched
Published
May 23, 2024
Affected Software
Elementor Header & Footer Builder
Researcher
More Details >

Elementor Website Builder – More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4619
Patch Status
Patched
Published
May 20, 2024
Affected Software
Elementor Website Builder – More than Just a Page Builder
Researcher
More Details >

ElementsKit Pro <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4452
Patch Status
Patched
Published
May 20, 2024
Affected Software
ElementsKit Pro
Researcher
More Details >

FooGallery (Free and Premium) < 2.4.15 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2762
Patch Status
Patched
Published
May 23, 2024
Affected Software
FooGallery Premium
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
Researcher
More Details >

Hash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5177
Patch Status
Patched
Published
May 22, 2024
Affected Software
Hash Elements
Researcher
More Details >

HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4876
Patch Status
Patched
Published
May 20, 2024
Affected Software
HT Mega – Absolute Addons For Elementor
Researcher
More Details >

jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4783
Patch Status
Unpatched
Published
May 22, 2024
Affected Software
jQuery T(-) Countdown Widget
Researcher
More Details >

LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4431
Patch Status
Patched
Published
May 22, 2024
Affected Software
LA-Studio Element Kit for Elementor
Researcher
More Details >

LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4575
Patch Status
Patched
Published
May 22, 2024
Affected Software
LayerSlider
Researcher
More Details >

LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4971
Patch Status
Patched
Published
May 21, 2024
Affected Software
LearnPress – WordPress LMS Plugin
Researcher
More Details >

LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor <= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5060
Patch Status
Patched
Published
May 23, 2024
Affected Software
LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor
Researcher
More Details >

Master Slider – Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4470
Patch Status
Patched
Published
May 20, 2024
Affected Software
Master Slider – Responsive Touch Slider
Researcher
More Details >

MemberPress <= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5025
Patch Status
Patched
Published
May 21, 2024
Affected Software
Memberpress
Researcher
More Details >

Move Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4695
Patch Status
Patched
Published
May 20, 2024
Affected Software
Move Addons for Elementor
Researcher
More Details >

ND Shortcodes <= 7.5 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5220
Patch Status
Patched
Published
May 24, 2024
Affected Software
ND Shortcodes
Researcher
More Details >

Ninja Beaver Add-ons for Beaver Builder <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2163
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
Ninja Beaver Add-ons for Beaver Builder
Researcher
More Details >

Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3666
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
Opal Estate Pro – Property Management and Submission
Researcher
More Details >

Page Builder by SiteOrigin <= 2.29.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4361
Patch Status
Patched
Published
May 20, 2024
Affected Software
Page Builder by SiteOrigin
Researcher
More Details >

PDF.js < 4.2.67 - Arbitrary JavaScript Execution

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4367
Patch Status
Patched
Published
May 20, 2024
Affected Software
PDF.js Viewer
PDF Viewer for Elementor
PDF Embedder
PDF Poster – PDF Embedder Plugin
EmbedPress – Embed PDF, PDF 3D FlipBook, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor
BSK PDF Manager
ARI Fancy Lightbox – Popup for WordPress
PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip
Tainacan
Wonder PDF Embed
and 0 more...
Researchers
More Details >

Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4045
Patch Status
Patched
Published
May 24, 2024
Affected Software
Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation
Researcher
More Details >

Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3155
Patch Status
Patched
Published
May 20, 2024
Affected Software
Gutenberg Blocks, Page Builder – ComboBlocks
Researcher
More Details >

Praison SEO WordPress <= 4.0.15 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-34801
Patch Status
Unpatched
Published
May 20, 2024
Affected Software
Praison SEO WordPress
Researcher
More Details >

Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4378
Patch Status
Patched
Published
May 22, 2024
Affected Software
Premium Addons for Elementor
Researcher
More Details >

Primary Addon for Elementor <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5229
Patch Status
Patched
Published
May 24, 2024
Affected Software
Primary Addon for Elementor
Researcher
More Details >

Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3997
Patch Status
Patched
Published
May 22, 2024
Affected Software
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)
Researcher
More Details >

Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3671
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
Print-O-Matic
Researcher
More Details >

ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2861
Patch Status
Patched
Published
May 22, 2024
Affected Software
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Researcher
More Details >

Reviews and Rating – Google Reviews <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5218
Patch Status
Patched
Published
May 24, 2024
Affected Software
Reviews and Rating – Google Reviews
Researcher
More Details >

SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1134
Patch Status
Patched
Published
May 23, 2024
Affected Software
SEOPress – On-site SEO
Researcher
More Details >

ShareThis Share Buttons <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3648
Patch Status
Patched
Published
May 22, 2024
Affected Software
ShareThis Share Buttons
Researcher
More Details >

ShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3345
Patch Status
Patched
Published
May 20, 2024
Affected Software
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor)
Researcher
More Details >

SiteOrigin Widgets Bundle <= 1.60.0 - - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4362
Patch Status
Patched
Published
May 21, 2024
Affected Software
SiteOrigin Widgets Bundle
Researcher
More Details >

Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1815
Patch Status
Patched
Published
May 22, 2024
Affected Software
Spectra – WordPress Gutenberg Blocks
Researcher
More Details >

Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1814
Patch Status
Patched
Published
May 22, 2024
Affected Software
Spectra – WordPress Gutenberg Blocks
Researcher
More Details >

Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4366
Patch Status
Patched
Published
May 23, 2024
Affected Software
Spectra – WordPress Gutenberg Blocks
Researcher
More Details >

SVGator – Add Animated SVG Easily <= 1.2.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4271
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
SVGator – Add Animated SVG Easily
Researcher
More Details >

SVGMagic <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4270
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
SVGMagic
Researcher
More Details >

Tainacan <= 0.21.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-34795
Patch Status
Patched
Published
May 20, 2024
Affected Software
Tainacan
Researcher
More Details >

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4484
Patch Status
Patched
Published
May 23, 2024
Affected Software
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Researcher
More Details >

The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4485
Patch Status
Patched
Published
May 23, 2024
Affected Software
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Researcher
More Details >

The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-2784
Patch Status
Patched
Published
May 23, 2024
Affected Software
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Researcher
More Details >

The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3718
Patch Status
Patched
Published
May 23, 2024
Affected Software
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce
Researcher
More Details >

Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3611
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced
Researcher
More Details >

Uber Menu <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4710
Patch Status
Patched
Published
May 20, 2024
Affected Software
UberMenu
Researcher
More Details >

Videojs HTML5 Player <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via videojs_video Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-5205
Patch Status
Patched
Published
May 23, 2024
Affected Software
Videojs HTML5 Player
Researcher
More Details >

WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4706
Patch Status
Patched
Published
May 22, 2024
Affected Software
WordPress + Microsoft Office 365 / Azure AD | LOGIN
Researcher
More Details >

WordPress Jitsi Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3978
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
WordPress Jitsi Shortcode
Researcher
More Details >

WP Booking <= 2.4.4 - Authenticated Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-35297
Patch Status
Patched
Published
May 24, 2024
Affected Software
WP Booking
Researcher
More Details >

WP DSGVO Tools (GDPR) <= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3201
Patch Status
Patched
Published
May 22, 2024
Affected Software
WP DSGVO Tools (GDPR)
Researcher
More Details >

WP Font Awesome Share Icons <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3198
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
WP Font Awesome Share Icons
Researcher
More Details >

WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-3557
Patch Status
Patched
Published
May 23, 2024
Affected Software
WP Go Maps (formerly WP Google Maps)
Researcher
More Details >

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4553
Patch Status
Patched
Published
May 20, 2024
Affected Software
WP Shortcodes Plugin — Shortcodes Ultimate
Researcher
More Details >

WP Table Builder – WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4700
Patch Status
Patched
Published
May 20, 2024
Affected Software
WP Table Builder – WordPress Table Plugin
Researcher
More Details >

WP Ultimate Post Grid <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4043
Patch Status
Patched
Published
May 22, 2024
Affected Software
WP Ultimate Post Grid
Researcher
More Details >

WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4896
Patch Status
Patched
Published
May 21, 2024
Affected Software
WPB Elementor Addons
Researcher
More Details >

WPKoi Templates for Elementor <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-4980
Patch Status
Patched
Published
May 21, 2024
Affected Software
WPKoi Templates for Elementor
Researcher
More Details >

AZAN Plugin <= 0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-3993
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
AZAN Plugin
Researcher
More Details >

LuckyWP Table of Contents <= 2.1.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-2119
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
LuckyWP Table of Contents
Researcher
More Details >

Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-3519
Patch Status
Patched
Published
May 21, 2024
Affected Software
Media Library Assistant
Researcher
More Details >

NextScripts: Social Networks Auto-Poster <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User Agent

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-1762
Patch Status
Patched
Published
May 21, 2024
Affected Software
NextScripts: Social Networks Auto-Poster
Researcher
More Details >

Themify Builder <= 7.5.7 - Open Redirect via 'tb_redirect_fail'

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-3032
Patch Status
Patched
Published
May 23, 2024
Affected Software
Themify Builder
Researcher
More Details >

LuckyWP Table of Contents <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-2953
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
LuckyWP Table of Contents
Researcher
More Details >

WP Next Post Navi <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-34793
Patch Status
Unpatched
Published
May 20, 2024
Affected Software
WP Next Post Navi
Researcher
More Details >

NextScripts: Social Networks Auto-Poster <= 4.4.3 - Cross-Site Request Forgery to Arbitrary Post Deletion

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1446
Patch Status
Patched
Published
May 21, 2024
Affected Software
NextScripts: Social Networks Auto-Poster
Researcher
More Details >

Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-4261
Patch Status
Patched
Published
May 21, 2024
Affected Software
Responsive Contact Form Builder & Lead Generation Plugin
Researcher
More Details >

AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-34802
Patch Status
Unpatched
Published
May 20, 2024
Affected Software
AdFoxly – Ad Manager, AdSense Ads & Ads.txt
Researcher
More Details >

BookingPress <= 1.0.82 - Missing Authorization to Appointment Time Alteration

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-34799
Patch Status
Patched
Published
May 20, 2024
Affected Software
Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress
Researcher
More Details >

Debug Log – Manger Tool <= 1.4.5 - Unauthenticated Information Exposure via Logs

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-34798
Patch Status
Patched
Published
May 20, 2024
Affected Software
Debug Log – Manger Tool
Researcher
More Details >

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3927
Patch Status
Patched
Published
May 21, 2024
Affected Software
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
Researcher
More Details >

RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdate

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2023-6325
Patch Status
Patched
Published
May 22, 2024
Affected Software
RomethemeForm For Elementor
Researcher
More Details >

Testimonial Carousel For Elementor <= 10.2.0 - Missing Authorization to Limited Setting Update

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-4858
Patch Status
Patched
Published
May 24, 2024
Affected Software
Testimonial Carousel For Elementor
Researcher
More Details >

WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1855
Patch Status
Patched
Published
May 22, 2024
Affected Software
WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce
Researcher
More Details >

YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-3268
Patch Status
Patched
Published
May 20, 2024
Affected Software
YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress
Researcher
More Details >

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback

5.0
CVSS Rating
Medium (5.0)
CVE-ID
CVE-2024-0453
Patch Status
Patched
Published
May 21, 2024
Affected Software
AI ChatBot for WordPress – WPBot
Researcher
More Details >

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback

5.0
CVSS Rating
Medium (5.0)
CVE-ID
CVE-2024-0451
Patch Status
Patched
Published
May 21, 2024
Affected Software
AI ChatBot for WordPress – WPBot
Researcher
More Details >

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback

5.0
CVSS Rating
Medium (5.0)
CVE-ID
CVE-2024-0452
Patch Status
Patched
Published
May 21, 2024
Affected Software
AI ChatBot for WordPress – WPBot
Researcher
More Details >

iframe <= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

5.0
CVSS Rating
Medium (5.0)
CVE-ID
CVE-2023-6844
Patch Status
Patched
Published
May 22, 2024
Affected Software
iframe
Researcher
More Details >

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.12 - Unauthenticated Stored Cross-Site Scripting via CSV Import

4.7
CVSS Rating
Medium (4.7)
CVE-ID
CVE-2024-4895
Patch Status
Patched
Published
May 22, 2024
Affected Software
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin
Researcher
More Details >

Amen <= 3.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3992
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
Amen
Researcher
More Details >

Automatic Translator with Google Translate <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Font

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-0632
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
Automatic Translator with Google Translate
Researcher
More Details >

Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4149
Patch Status
Patched
Published
May 23, 2024
Affected Software
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
Researcher
More Details >

LuckyWP Table of Contents <= 2.1.4 - Authenticated(Administrator+) Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2023-6487
Patch Status
Unpatched
Published
May 21, 2024
Affected Software
LuckyWP Table of Contents
Researcher
More Details >

PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3065
Patch Status
Unpatched
Published
May 22, 2024
Affected Software
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
Researcher
More Details >

PopupAlly <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-34796
Patch Status
Patched
Published
May 20, 2024
Affected Software
PopupAlly
Researcher
More Details >

Sassy Social Share <= 3.3.62 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4924
Patch Status
Patched
Published
May 22, 2024
Affected Software
Social Sharing Plugin – Sassy Social Share
Researcher
More Details >

Simple Popup Manager <= 1.3.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-34797
Patch Status
Unpatched
Published
May 20, 2024
Affected Software
Simple Popup Manager
Researcher
More Details >

Social Pixel <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-4005
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
Social Pixel
Researcher
More Details >

WordPress Jitsi Shortcode <= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-3977
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
WordPress Jitsi Shortcode
Researcher
More Details >

ApplyOnline – Application Form Builder and Manager <= 2.6.2 - Missing Authorization to Sensitive Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-2036
Patch Status
Patched
Published
May 21, 2024
Affected Software
ApplyOnline – Application Form Builder and Manager
Researcher
More Details >

Brizy – Page Builder <= 2.4.43 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3711
Patch Status
Patched
Published
May 22, 2024
Affected Software
Brizy – Page Builder
Researcher
More Details >

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3626
Patch Status
Patched
Published
May 22, 2024
Affected Software
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Researcher
More Details >

EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1803
Patch Status
Patched
Published
May 22, 2024
Affected Software
EmbedPress – Embed PDF, PDF 3D FlipBook, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor
Researchers
More Details >

Event post <= 5.9.4 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1376
Patch Status
Patched
Published
May 23, 2024
Affected Software
Event post
Researcher
More Details >

Fastly <= 1.2.25 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-34803
Patch Status
Patched
Published
May 20, 2024
Affected Software
Fastly
Researcher
More Details >

HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4875
Patch Status
Patched
Published
May 20, 2024
Affected Software
HT Mega – Absolute Addons For Elementor
Researcher
More Details >

Inquiry Cart <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-5155
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
Inquiry cart
Researcher
More Details >

Pray For Me <= 1.0.4 - Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3965
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
Pray For Me
Researcher
More Details >

Schema App Structured Data <= 2.2.0 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-0893
Patch Status
Patched
Published
May 23, 2024
Affected Software
Schema App Structured Data
Researcher
More Details >

Similarity <= 3.0 - Cross-Site Request Forgery to Plugin Reset

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3971
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
Similarity
Researcher
More Details >

Similarity <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3972
Patch Status
Unpatched
Published
May 24, 2024
Affected Software
Similarity
Researcher
More Details >

The Events Calendar Free & Pro <= 6.4.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Events Access

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1295
Patch Status
Patched
Published
May 24, 2024
Affected Software
The Events Calendar
The Events Calendar Pro
Researcher
More Details >

WP Prayer II <= 2.4.7 - Cross-Site Request Forgery to Email Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4480
Patch Status
Patched
Published
May 24, 2024
Affected Software
Prayer
Researcher
More Details >

WP Prayer II <= 2.4.7 - Cross-Site Request Forgery to Settings Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4751
Patch Status
Patched
Published
May 24, 2024
Affected Software
Prayer
Researcher
More Details >

WP Scraper <= 5.7 - Missing Authorization to Arbitrary Page/Post Creation

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-3663
Patch Status
Patched
Published
May 21, 2024
Affected Software
WP Scraper
Researcher
More Details >

WP-ViperGB <= 1.6.1 - Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-4409
Patch Status
Patched
Published
May 23, 2024
Affected Software
WP-ViperGB
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Trust Your Site
to the Leader in WordPress Security

Wordfence Security includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.

Protect Your Site

Did you enjoy this post? Share it!

LinkedIn 

Comments

2 Comments
  • Daniel
    June 4, 2024
    5:21 am

    I saw your posting about PDF.js < 4.2.67 - Arbitrary JavaScript Execution and realize that this may be a difficult problem for the pdf.js plugins to fix. Altogether there are tens of thousands of sites using these plugins.

    I use pdf.js in my own custom plugin and spent the last several weeks updating it to use the latest release 4.3.136. The big issue is that since release 4 which came out in November 2023, pdf.js has moved to using modular javascript so instead of .js files, the files are now .mjs files.

    In order to get it to work I had to update the mime.types file on my development nginx server to set the content type header for .mjs files to javascript/application. I had to have our host update our nginx configuration too. There may be many hosts that don’t return the correct content type header for .mjs files and for those sites, pdf.js versions 4 or greater won’t work. Browsers will refuse to execute the .mjs files as their content type headers will be incorrect.

    I was using pdf.js 1.1.3 from August 2015. I do make a few changes to the build/pdf.js file in order to integrate it with my site. It took a bit of sleuthing and lots of help from ChatGPT to figure out where in the new build/pdf.mjs file to make my changes. And more ChatGPT help to run webpack/terser to uglify and minify my changed pdf.mjs file. But I have pdf.js 4.3.136 running on my site.

    I looked at the source code of a number of the plugins you listed, and all the ones I checked are using pdf.js versions from 2020 and 2019, in the version 2.something range. Modifying these plugins to use pdf.js > 4.2.67 will be a challenge. And possibly a headache for hosting companies to modify the content headers they send for .mjs files.

    I’m glad I slogged through the process. Now I know how to do it, and have GitHub set to notify me of new releases and security alerts for Mozilla pdf.js. It will be fairly easy for me to keep the pdf.js I run on my site up to date from now on out.

    I was surprised at how old the versions of pdf.js are in these pdf viewer plugins.

    • Chloe Chamberland
      June 5, 2024
      5:02 am

      Hi Daniel, thanks for sharing! Perhaps other developers utilizing PDF.js can learn from your experience when making the upgrade to support the patched version of the software.

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.