CVE-2024-2343

The CVE-2024-2343 entry concerns the Avada WordPress theme (Avada | Website Builder For WordPress & WooCommerce). It describes a Server-Side Request Forgery (SSRF) vulnerability in all versions up to 7.11.6, exploitable via the form_to_url_action function. The issue can be triggered by authentica...

CVE-2024-0899

CVE-2024-0899 affects s2Member – Best Membership Plugin for WordPress. It enables Information Exposure via the API in all versions up to 230815, allowing unauthenticated access to post/page contents. Patch/update to 240315 or later to remediate. This entry is corroborated by multiple sources in t...

CVE-2024-2536

CVE-2024-2536 affects the Rank Math SEO with AI Tools plugin for WordPress. The vulnerability is Stored Cross-Site Scripting via HowTo block attributes due to insufficient input sanitization and output escaping. It impacts all versions up through 1.0.214 and requires contributor-level or higher a...

CVE-2024-1991

CVE-2024-1991 affects the WordPress plugin RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. A missing capability check in update_users_role() exists in all versions up to 5.3.0.0, enabling authenticated users with subscriber-level access and above to elev...

CVE-2024-2738

CVE-2024-2738 affects Permalink Manager Lite and Permalink Manager Pro for WordPress. The vulnerability is a Reflected Cross-Site Scripting flaw via the URL parameter ‘s’ in multiple locations present up to version 2.4.3.1, caused by insufficient input sanitization and output escaping. Attackers ...

CVE-2024-1948

CVE-2024-1948 affects Getwid – Gutenberg Blocks (WordPress) up to version 2.0.5. Root cause: insufficient input sanitization and output escaping in block content, enabling stored XSS. Exploitation requires Contributor+ privileges and user interaction on injected pages. Fix: upgrade to version 2.0...

CVE-2024-0588

CVE-2024-0588 affects the WordPress plugin Paid Memberships Pro (all versions

CVE-2024-1990

CVE-2024-1990 concerns the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress. The connected sources confirm a blind SQL Injection via the id parameter in the RM_Form shortcode, exploitable in all versions up to 5.3.1.0 due to insufficie...

CVE-2024-2198

CVE-2024-2198 concerns the WordPress plugin Contact Form by BestWebSoft, with a Reflected XSS vulnerability via the cntctfrm_contact_address parameter in versions up to 4.2.8. The issue arises from insufficient input sanitization and output escaping, allowing an unauthenticated attacker to craft ...

CVE-2024-1850

The CVE CVE-2024-1850 concerns the WordPress plugin AI Post Generator | AutoWriter up to version 3.3. It lacks a capability check on AJAX-handled functions, enabling authenticated users with subscriber access or higher to view all generated posts (including non-published), create/publish new post...

CVE-2024-2336

CVE-2024-2336 affects the WordPress plugin Popup Maker – Popup for opt-ins, lead gen, & more. All versions up to 1.18.2 are vulnerable to Stored Cross‑Site Scripting via shortcode attributes due to insufficient input sanitization/output escaping. Exploitation requires contributor‑level privileges...

CVE-2024-1308

The CVE-2024-1308 entry covers the WooCommerce Cloak Affiliate Links plugin for WordPress up to version 1.0.33, where a missing authorization check in the permalink_settings_save function allows unauthenticated modification of the affiliate permalink base, enabling traffic redirection to maliciou...

CVE-2024-2804

CVE-2024-2804 — Network Summary WordPress plugin is affected. The vulnerability is an unauthenticated SQL Injection via the category parameter in Network Summary versions

CVE-2024-3093

CVE-2024-3093 is a duplicate of CVE-2024-1752 for the Font Farsi WordPress plugin. Connected sources indicate the issue affects Font Farsi

CVE-2024-2845

CVE-2024-2845 covers a Stored Cross-Site Scripting vulnerability in the WordPress plugin “BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg” up to and including version 3.4.2. The Red Hat and Wordfence entries describe the flaw...

CVE-2024-2200

The CVE CVE-2024-2200 concerns WordPress plugin Contact Form by BestWebSoft. Affected versions: all up to and including 4.2.8. Root cause: insufficient input sanitization and output escaping leads to Reflected Cross-Site Scripting via the cntctfrm_contact_subject parameter. Impact: unauthenticate...

CVE-2024-1904

CVE-2024-1904 affects the MasterStudy LMS WordPress plugin (up to and including 3.2.13). The issue is a missing capability check in the search_posts function, allowing authenticated users with subscriber-level access or higher to view draft post titles and excerpts. Impact is unauthorized data ex...

CVE-2024-1637

The CVE-2024-1637 entry concerns the 360 Javascript Viewer WordPress plugin. Affected versions are all versions up to and including 1.7.12, where an unauthorized modification of data is possible due to a missing capability check and nonce exposure on multiple AJAX actions. The vulnerability can b...

CVE-2024-1974

CVE-2024-1974 : The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in render() in versions up to 2.4.6. Authenticated attackers with contributor+ access can read arbitrary server files. The issue is documented by Wordfence and Red Hat; a fix is a...

CVE-2024-2185

CVE-2024-2185 concerns Beaver Builder Addons by WPZOOM for WordPress. Connected sources confirm a Stored XSS via the Image Box widget affecting versions up to 1.3.4 due to insufficient input sanitization/output escaping. Exploitation is reported to require at least Contributor+ authentication; th...