CVE-2024-2335

CVE-2024-2335 concerns the Elements Plus! WordPress plugin. Affected: Elements Plus! up to version 2.16.2. Issue: Stored Cross-Site Scripting via multiple widget link URLs caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers wi...

CVE-2024-2871

CVE-2024-2871 affects the Media Library Assistant plugin for WordPress. It enables SQL Injection via shortcode parameters in all versions up to 3.13 due to insufficient escaping and lack of proper query preparation, allowing authenticated attackers with contributor access or higher to append addi...

CVE-2024-1465

The CVE-2024-1465 entry concerns the Elementor Addons by Livemesh plugin for WordPress (versions up to and including 8.3.4). It describes a Stored Cross-Site Scripting vulnerability in the Posts Carousel widget via the carousel_skin attribute, arising from insufficient input sanitization and outp...

CVE-2024-1813

CVE-2024-1813 – Simple Job Board (WordPress) is a PHP Object Injection vulnerability in all versions up to 2.11.0, caused by deserialization of untrusted input in job_board_applicant_list_columns_value. It allows unauthenticated attackers to inject a PHP object; with a POP chain from another plug...

CVE-2024-2340

CVE-2024-2340 affects the WordPress Avada theme up to version 7.11.6. The vulnerability enables unauthenticated attackers to access sensitive files uploaded through Avada forms via the /wp-content/uploads/fusion-forms/ directory, causing sensitive information exposure. Root cause: directory listi...

CVE-2024-1790

The CVE CVE-2024-1790 affects WordPress Infinite Scroll – Ajax Load More plugin for WordPress (up to version 7.0.1). It enables Path Traversal via the type parameter, allowing authenticated attackers with administrator-level access and above to read arbitrary server files (Windows instances only)...

CVE-2024-0899

CVE-2024-0899 affects s2Member – Best Membership Plugin for WordPress. It enables Information Exposure via the API in all versions up to 230815, allowing unauthenticated access to post/page contents. Patch/update to 240315 or later to remediate. This entry is corroborated by multiple sources in t...

CVE-2024-2693

CVE-2024-2693 affects the Link Whisper Free WordPress plugin up to version 0.7.1. The vulnerability is a PHP Object Injection via deserialization of untrusted input in the mfn-page-items post meta value, exploitable by authenticated users with contributor-level access or higher to inject a PHP ob...

CVE-2024-1464

Elementor Addons by Livemesh (WordPress) has CVE-2024-1464: Stored XSS via the style attribute in the Posts Slider widget, affecting all versions up to 8.3.4 due to insufficient input sanitization/output escaping. Impact: authenticated users with contributor+ privileges can inject scripts that ru...

CVE-2024-2183

The issue is a stored XSS in Beaver Builder Addons by WPZOOM for WordPress, affecting all versions up to 1.3.4. The vulnerability arises from insufficient input sanitization and output escaping in the Heading widget, allowing authenticated attackers with contributor-level access+ to inject script...

CVE-2024-1991

CVE-2024-1991 affects the WordPress plugin RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. A missing capability check in update_users_role() exists in all versions up to 5.3.0.0, enabling authenticated users with subscriber-level access and above to elev...

CVE-2024-2186

CVE-2024-2186: Beaver Builder Addons by WPZOOM for WordPress is susceptible to Stored XSS via the Team Members widget in all versions

CVE-2024-2650

The CVE-2024-2650 issue affects the WordPress plugin Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders (Essential Addons for Elementor Lite). Root cause: Stored Cross-Site Scripting in the Woo Product Carousel widget due to insufficient input sanitiza...

CVE-2024-2738

CVE-2024-2738 affects Permalink Manager Lite and Permalink Manager Pro for WordPress. The vulnerability is a Reflected Cross-Site Scripting flaw via the URL parameter ‘s’ in multiple locations present up to version 2.4.3.1, caused by insufficient input sanitization and output escaping. Attackers ...

CVE-2024-0588

CVE-2024-0588 affects the WordPress plugin Paid Memberships Pro (all versions

CVE-2024-1571

CVE-2024-1571 : WP Recipe Maker for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to 9.2.1 due to insufficient input sanitization and output escaping. Authenticated users with access to the recipe dashboard (admin by default, but roles can...

CVE-2024-1948

CVE-2024-1948 affects Getwid – Gutenberg Blocks (WordPress) up to version 2.0.5. Root cause: insufficient input sanitization and output escaping in block content, enabling stored XSS. Exploitation requires Contributor+ privileges and user interaction on injected pages. Fix: upgrade to version 2.0...

CVE-2024-2181

The CVE refers to Beaver Builder Addons by WPZOOM (WordPress) with a Stored Cross-Site Scripting vulnerability in the Button widget, affecting all versions up to 1.3.4. Exploitation requires authenticated access at contributor level or higher, enabling an attacker to inject scripts that execute w...

CVE-2023-6799

CVE-2023-6799 affects the WP Reset plugin for WordPress (versions up to 2.0). The root cause is insufficiently random snapshot names, enabling unauthenticated attackers to brute-force and extract sensitive data such as backups. The risk is tied to Information Exposure (C), with no vendor hardenin...

CVE-2024-2027

CVE-2024-2027 affects Real Media Library: Media Library Folder & File Manager (WordPress). Root cause: insufficient input sanitization and output escaping in style attributes, enabling Stored XSS. Affected versions: all up to and including 4.22.7. Impact: authenticated attackers with contributor+...