2208 matches found
CVE-2024-2504
CVE-2024-2504 affects Page Builder: Pagelayer (WordPress plugin) up to version 1.8.4. The vulnerability is a stored XSS via the attr parameter caused by insufficient input sanitization/output escaping. Impact: authenticated users with Contributor+ can inject scripts that execute when any user loa...
CVE-2024-1587
CVE-2024-1587 affects the WordPress Newsmatic theme up to version 1.3.0. It enables Sensitive Information Exposure via the newsmatic_filter_posts_load_tab_content, allowing unauthenticated users to view draft posts and post content. The CVSS v3.1 base score is 5.3 (Medium) with network attack vec...
CVE-2024-2222
CVE-2024-2222 (Advanced Classifieds & Directory Pro for WordPress) : Vulnerability due to a missing capability check in ajax_callback_delete_attachment across all versions up to 3.0.0. This allows authenticated users with subscriber+ access to delete arbitrary media uploads, i.e., unauthorized da...
CVE-2024-2287
CVE-2024-2287 — Knight Lab Timeline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in versions up to 3.9.3.3 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions (or higher) can inject sc...
CVE-2024-2348
Gum Elementor Addon for WordPress ≤ 1.3.2 is vulnerable to Stored Cross-Site Scripting via the Post Meta widget due to insufficient input sanitization/output escaping. Exploitation requires authenticated access (subscriber or higher). A fixed version, 1.3.3, is available; updating to >1.3.2 is...
CVE-2024-2289
PowerPack Lite for Beaver Builder (WordPress plugin) is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes. The issue affects all versions up to 1.3.0 and can allow authenticated attackers with contributor-level and abo...
CVE-2024-1934
CVE-2024-1934 affects WP Compress – Image Optimizer for WordPress (all versions up to and including 6.11.10). The vulnerability is due to a missing capability check in wps_local_compress::__construct, allowing unauthenticated attackers to modify data by resetting the CDN region and injecting a ma...
CVE-2024-2343
The CVE-2024-2343 entry concerns the Avada WordPress theme (Avada | Website Builder For WordPress & WooCommerce). It describes a Server-Side Request Forgery (SSRF) vulnerability in all versions up to 7.11.6, exploitable via the form_to_url_action function. The issue can be triggered by authentica...
CVE-2024-0899
CVE-2024-0899 affects s2Member – Best Membership Plugin for WordPress. It enables Information Exposure via the API in all versions up to 230815, allowing unauthenticated access to post/page contents. Patch/update to 240315 or later to remediate. This entry is corroborated by multiple sources in t...
CVE-2024-2536
CVE-2024-2536 affects the Rank Math SEO with AI Tools plugin for WordPress. The vulnerability is Stored Cross-Site Scripting via HowTo block attributes due to insufficient input sanitization and output escaping. It impacts all versions up through 1.0.214 and requires contributor-level or higher a...
CVE-2024-1991
CVE-2024-1991 affects the WordPress plugin RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. A missing capability check in update_users_role() exists in all versions up to 5.3.0.0, enabling authenticated users with subscriber-level access and above to elev...
CVE-2024-2738
CVE-2024-2738 affects Permalink Manager Lite and Permalink Manager Pro for WordPress. The vulnerability is a Reflected Cross-Site Scripting flaw via the URL parameter ‘s’ in multiple locations present up to version 2.4.3.1, caused by insufficient input sanitization and output escaping. Attackers ...
CVE-2024-0588
CVE-2024-0588 affects the WordPress plugin Paid Memberships Pro (all versions
CVE-2024-1948
CVE-2024-1948 affects Getwid – Gutenberg Blocks (WordPress) up to version 2.0.5. Root cause: insufficient input sanitization and output escaping in block content, enabling stored XSS. Exploitation requires Contributor+ privileges and user interaction on injected pages. Fix: upgrade to version 2.0...
CVE-2024-1990
CVE-2024-1990 concerns the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress. The connected sources confirm a blind SQL Injection via the id parameter in the RM_Form shortcode, exploitable in all versions up to 5.3.1.0 due to insufficie...
CVE-2024-2198
CVE-2024-2198 concerns the WordPress plugin Contact Form by BestWebSoft, with a Reflected XSS vulnerability via the cntctfrm_contact_address parameter in versions up to 4.2.8. The issue arises from insufficient input sanitization and output escaping, allowing an unauthenticated attacker to craft ...
CVE-2024-1850
The CVE CVE-2024-1850 concerns the WordPress plugin AI Post Generator | AutoWriter up to version 3.3. It lacks a capability check on AJAX-handled functions, enabling authenticated users with subscriber access or higher to view all generated posts (including non-published), create/publish new post...
CVE-2024-2336
CVE-2024-2336 affects the WordPress plugin Popup Maker – Popup for opt-ins, lead gen, & more. All versions up to 1.18.2 are vulnerable to Stored Cross‑Site Scripting via shortcode attributes due to insufficient input sanitization/output escaping. Exploitation requires contributor‑level privileges...
CVE-2024-1308
The CVE-2024-1308 entry covers the WooCommerce Cloak Affiliate Links plugin for WordPress up to version 1.0.33, where a missing authorization check in the permalink_settings_save function allows unauthenticated modification of the affiliate permalink base, enabling traffic redirection to maliciou...