CVE-2023-51409

Summary of CVE-2023-51409 : The WordPress plugin “AI Engine: ChatGPT Chatbot” (ai-engine) is affected by an Unrestricted Upload of File with Dangerous Type vulnerability. From the connected documents, vulnerable versions are up to 1.9.98, with unauthenticated attackers able to upload arbitrary fi...

CVE-2022-4965

The CVE-2022-4965 entry concerns the Invitation Code Content Restriction Plugin for WordPress by CreativeMinds. It describes a reflected Cross-Site Scripting (XSS) vulnerability via the target_id parameter present in all versions up to and including 1.5.4, caused by insufficient input sanitizatio...

CVE-2024-2866

CVE-2024-2866 is a placeholder entry that has been superseded by CVE-2024-2509 for the Kadence Blocks WordPress plugin. Connected data show that CVE-2024-2509 details a Stored Cross-Site Scripting (XSS) vulnerability in the Gutenberg Blocks by Kadence Blocks plugin prior to version 3.2.26 , where...

CVE-2024-1458

CVE-2024-1458 : Elementor Addons by Livemesh for WordPress is vulnerable to stored XSS via the Animated Text widget’s text_alignment attribute in all versions up to and including 8.3.4 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level acc...

CVE-2024-2117

CVE-2024-2117 affects Elementor Website Builder – More than Just a Page Builder (WordPress) via the Path Widget. All versions up to 3.20.2 are vulnerable due to insufficient output escaping on user-supplied attributes, enabling stored XSS. Exploitation requires an authenticated attacker with cont...

CVE-2024-1424

CVE-2024-1424 affects GiveWP – Donation Plugin and Fundraising Platform for WordPress. All versions up to 3.5.1 are vulnerable to Stored Cross-Site Scripting via shortcode attributes due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-l...

CVE-2024-1587

CVE-2024-1587 affects the WordPress Newsmatic theme up to version 1.3.0. It enables Sensitive Information Exposure via the newsmatic_filter_posts_load_tab_content, allowing unauthenticated users to view draft posts and post content. The CVSS v3.1 base score is 5.3 (Medium) with network attack vec...

CVE-2024-1999

The WordPress plugin Gutenberg Blocks by Kadence Blocks – Page Builder Features is affected by CVE-2024-1999: Stored XSS via the Testimonial Widget anchor style parameter in versions up to 3.2.25. Exploitation requires at least Contributor‑level access and can lead to stored scripts executing on ...

CVE-2024-1465

The CVE-2024-1465 entry concerns the Elementor Addons by Livemesh plugin for WordPress (versions up to and including 8.3.4). It describes a Stored Cross-Site Scripting vulnerability in the Posts Carousel widget via the carousel_skin attribute, arising from insufficient input sanitization and outp...

CVE-2024-1934

CVE-2024-1934 affects WP Compress – Image Optimizer for WordPress (all versions up to and including 6.11.10). The vulnerability is due to a missing capability check in wps_local_compress::__construct, allowing unauthenticated attackers to modify data by resetting the CDN region and injecting a ma...

CVE-2024-2343

The CVE-2024-2343 entry concerns the Avada WordPress theme (Avada | Website Builder For WordPress & WooCommerce). It describes a Server-Side Request Forgery (SSRF) vulnerability in all versions up to 7.11.6, exploitable via the form_to_url_action function. The issue can be triggered by authentica...

CVE-2024-2536

CVE-2024-2536 affects the Rank Math SEO with AI Tools plugin for WordPress. The vulnerability is Stored Cross-Site Scripting via HowTo block attributes due to insufficient input sanitization and output escaping. It impacts all versions up through 1.0.214 and requires contributor-level or higher a...

CVE-2024-0588

CVE-2024-0588 affects the WordPress plugin Paid Memberships Pro (all versions

CVE-2024-1571

CVE-2024-1571 : WP Recipe Maker for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to 9.2.1 due to insufficient input sanitization and output escaping. Authenticated users with access to the recipe dashboard (admin by default, but roles can...

CVE-2024-2112

The CVE-2024-2112 entry concerns the WordPress plugin Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder, affected up to version 1.15.22. The vulnerability, described across sources (NVD/NVD-related, Red Hat, PatchStack), is Sensitive Information Exposure via the plugin’s sign...

CVE-2024-2436

The CVE-2024-2436 entry concerns the Lightweight Accordion WordPress plugin. It describes a stored XSS in the plugin’s shortcodes caused by insufficient input sanitization and output escaping on user-supplied attributes, affecting all versions up to and including 1.5.16. The vulnerability require...

CVE-2024-2336

CVE-2024-2336 affects the WordPress plugin Popup Maker – Popup for opt-ins, lead gen, & more. All versions up to 1.18.2 are vulnerable to Stored Cross‑Site Scripting via shortcode attributes due to insufficient input sanitization/output escaping. Exploitation requires contributor‑level privileges...

CVE-2024-1974

CVE-2024-1974 : The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in render() in versions up to 2.4.6. Authenticated attackers with contributor+ access can read arbitrary server files. The issue is documented by Wordfence and Red Hat; a fix is a...

CVE-2024-2033

CVE-2024-2033 affects the Video Conferencing with Zoom plugin for WordPress (versions

CVE-2024-2185

CVE-2024-2185 concerns Beaver Builder Addons by WPZOOM for WordPress. Connected sources confirm a Stored XSS via the Image Box widget affecting versions up to 1.3.4 due to insufficient input sanitization/output escaping. Exploitation is reported to require at least Contributor+ authentication; th...