CVE-2024-1567 Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'filevalidity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated attackers to upload dangerous file types...

CVE-2024-1567

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to limited file uploads due to missing file type validation in the 'filevalidity' function in all versions up to, and including, 1.3.94. This makes it possible for unauthenticated attackers to upload dangerous file types...

CVE-2024-1567

CVE-2024-1567 affects Royal Elementor Addons and Templates for WordPress. It arises from missing file type validation in file_validity, allowing unauthenticated users to upload unsafe file types (e.g., .svgz) on versions up to 1.3.94. This could enable cross-site scripting or remote code executio...

CVE-2024-2959 SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation

The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the savePricingTable function. This makes it possible for unauthenticated attackers to create and edit prici...

CVE-2024-3489

The CVE-2024-3489 entry concerns Exclusive Addons for Elementor (WordPress). It describes a Reflected Cross-Site Scripting vulnerability in the Countdown Expired Title, affecting all versions up to 2.6.9.4. The root cause is insufficient input sanitization and output escaping, enabling unauthenti...

CVE-2024-3649 Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation

The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including, 1.8.7.2. This is due to a lack of controls on several product parameters. This makes it possible for unauthenticated attackers to...

CVE-2024-1678 Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API

The Subway – Private Site Option plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's private site feature and view restricted page and post...

CVE-2024-1678 Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API

The Subway – Private Site Option plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's private site feature and view restricted page and post...

CVE-2024-1678

The connected sources confirm CVE-2024-1678 affects the Subway – Private Site Option WordPress plugin and enables Sensitive Information Exposure via the REST API in all versions up to 2.1.4. The vulnerability allows unauthenticated attackers to bypass the plugin’s private-site feature and access ...

CVE-2023-6214

CVE-2023-6214 (HT Mega – Absolute Addons For Elementor) affects the WordPress plugin HT Mega up to version 2.4.6. The root issue is a data exposure in the purchased_products function, allowing unauthenticated access to the previous 7 days of order data and customer PII. The vulnerability is categ...

CVE-2024-3045

Technical details about CVE-2024-3045 (affected plugin versions, root cause, exploitation, and remediation) are not present in the provided connected documents. Monitor official advisories (NVD/Red Hat/ENISA/Wordfence) for updates and fixes.

CVE-2024-3045 PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2024-0847

The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in class-sbmm-list-table.php. This makes it possible for unauthenticated attackers to bulk delete...

CVE-2024-0847

CVE-2024-0847 affects the 5280 Bootstrap Modal Contact Form plugin for WordPress. The root cause is missing/incorrect nonce validation in class-sbmm-list-table.php, enabling CSRF to bulk delete messages by unauthenticated attackers if they can trick an admin into performing an action (e.g., click...

CVE-2024-3047

Technical details (affected product/version, root cause, impact, remediation) are not provided in the Connected documents. Monitor for updates from vendors or official advisories to obtain concrete details and mitigation.

CVE-2024-0847 5280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages

The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in class-sbmm-list-table.php. This makes it possible for unauthenticated attackers to bulk delete...

CVE-2024-3047 PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgery

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via the transform function. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web...

CVE-2024-3717 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure

The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wpdndcf7uploads/wpcf7-files' directory. This makes it possible for unauthenticated attackers to...

CVE-2024-3717

CVE-2024-3717 affects the Drag and Drop Multiple File Upload – Contact Form 7 WordPress plugin, exposing sensitive uploaded form data via the /wp-content/uploads/wp_dndcf7_uploads/wpcf7-files directory. Publicly accessible data exposure applies to all versions up to 1.3.7.7. The Wordfence vulnera...

CVE-2024-4083

CVE-2024-4083 highlights a CSRF vulnerability in the WordPress plugin “Easy Restaurant Table Booking” up to version 1.0.0. The root cause is missing or incorrect nonce validation when saving settings, enabling unauthenticated attackers to trigger settings changes through forged requests if a site...