CVE-2024-9608 MyParcel <= 4.24.1 - Reflected Cross-Site Scripting

The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 4.24.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-12420

The The WPMobile.App — Android and iOS Mobile Application plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 11.52. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2024-12414

The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the settingpage function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2024-12417

The The Simple Link Directory plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.4.5. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible...

CVE-2024-12421

The The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.16.7.1. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2024-12417

CVE-2024-12417 concerns the Simple Link Directory plugin for WordPress. The issue is arbitrary shortcode execution in versions up to and including 8.4.0, caused by a lack of proper validation before executing do_shortcode, enabling unauthenticated attackers to run arbitrary shortcodes. The Red Ha...

CVE-2024-12414 Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery

The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the settingpage function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2024-12414 Themify Store Locator <= 1.1.9 - Cross-Site Request Forgery

The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the settingpage function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2024-12414

CVE-2024-12414 affects Themify Store Locator for WordPress (versions up to 1.1.9). Root cause: missing/incorrect nonce validation in setting_page(), enabling Cross‑Site Request Forgery. Attack: unauthenticated attacker can induce an admin to perform forged requests to modify plugin settings. Impa...

CVE-2024-12574

The SVG Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-11809

CVE-2024-11809 affects Primer MyData for Woocommerce (WordPress). It enables Reflected XSS via the img_src parameter in all versions up to 4.2.1 due to insufficient input sanitization and output escaping. Exploitation requires user interaction (tricking a user into clicking a link); unauthenticat...

CVE-2024-12579

The CVE-2024-12579 entry concerns the Minify HTML plugin for WordPress. According to Red Hat and Wordfence sources, the vulnerability is a Regular Expression Denial of Service (ReDoS) caused by processing user-supplied input as a regular expression. It affects all versions up to and including 2.1...

CVE-2024-12574

CVE-2024-12574 concerns the WordPress plugin SVG Shortcode. The description in the initial document states it is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to and including 1.0.1, caused by insufficient input sanitization and output escaping. Connected docum...

CVE-2024-12579 Minify HTML <= 2.1.10 - - Regular Expressions Denial of Service

The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service ReDoS in all versions up to, and including, 2.1.10. This is due to processing user-supplied input as a regular expression. This makes it possible for unauthenticated attackers to create comments that can...

CVE-2024-11809 Primer MyData for Woocommerce <= 4.2.1 - Reflected Cross-Site Scripting

The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'imgsrc' parameter in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2024-11809 Primer MyData for Woocommerce <= 4.2.1 - Reflected Cross-Site Scripting

The Primer MyData for Woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'imgsrc' parameter in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2019-25221

The Responsive Filterable Portfolio plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possib...

CVE-2019-25221

CVE-2019-25221 affects the WordPress plugin Responsive Filterable Portfolio (versions ≤ 1.0.8). Root cause: insufficient escaping and lack of prepared statements in the SQL query, via the id parameter, enabling unauthenticated SQL injection to extract DB data. Evidence indicates the vendor patche...

CVE-2024-12333

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the woodmartinstagramajaxquery AJ...

CVE-2024-12160

The Seraphinite Bulk Discounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.4.6. This makes it possible for unauthenticated attackers to inject...