CVE-2024-2242

CVE-2024-2242 Contact Form 7 history.pushState'', '', '/'; document.forms0.submit; /scr...

CVE-2024-50498

CVE-2024-50498 WP Query Console body background-color: fff; color: 222; font-family: sans-serif; pre margin: 0; font-family: monospace; a:link color: 009; text-decoration: none; background-color: fff;...

CVE-2024-52380

CVE-2024-52380 Picsmize = 1.0.0 - Unauthenticated Arbitrary File Upload Description The Picsmize plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.0. This makes it possible for unauthenticated attackers to...

CVE-2024-50488

CVE-2024-50488 Token Login history.pushState'', '', '/'; document.forms0.submit;...

CVE-2024-13489

CVE-2024-13489 LTL Freight Quotes – Old Dominion Edition = 4.2.10 - Unauthenticated SQL Injection Description The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including,...

CVE-2024-13485

CVE-2024-13485 LTL Freight Quotes – ABF Freight Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3.7...

CVE-2024-50491

CVE-2024-50491 RSVP ME = 1.9.9 - Unauthenticated SQL Injection Description The RSVP ME plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2024-50483

CVE-2024-50483 Meetup = 0.1 - Authentication Bypass via Account Takeover Description: The Meetup plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 0.1. This is due to the plugin not properly verifying a user's identity prior to authenticating them v...

CVE-2024-13478

CVE-2024-13478 LTL Freight Quotes – TForce Edition = 3.6.4 - Unauthenticated SQL Injection Description The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.6.4 due to...

CVE-2024-49607

CVE-2024-49607 WP Dropbox Dropins = 1.0 - Unauthenticated Arbitrary File Upload Description: The WP Dropbox Dropins plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload arbitrary file...

CVE-2024-50427

CVE-2024-50427 SurveyJS: Drag & Drop WordPress Form Builder = 1.9.136 - Authenticated Subscriber+ Arbitrary File Upload Description: The SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity plugin for WordPress is vulnerable to arbitrary file...

CVE-2024-12172

CVE-2024-12172 WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses = 3.2.21 - Missing Authorization to Authenticated Subscriber+ Arbitrary User Meta Update Description The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution,...

CVE-2024-11848

CVE-2024-11848 NitroPack = 1.17.0 - Missing Authorization to Authenticated Subscriber+ Limited Options Update Description The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropackdismissnoticeforever' AJAX action in a...

CVE-2024-11396

CVE-2024-11396 Event monster = 1.4.3 - Information Exposure Via Visitors List Export Description The Event Monster – Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Expor...

CVE-2024-50478

CVE-2024-50478 1-Click Login: Passwordless Authentication 1.4.5 - Authentication Bypass via Account Takeover Description: The 1-Click Login: Passwordless Authentication plugin for WordPress is vulnerable to authentication bypass in version 1.4.5. This is due to the plugin not properly verifying a...

CVE-2024-10516

CVE-2024-10516 Swift Performance Lite = 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify' Description The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function. This makes it...

CVE-2024-13800

CVE-2024-13800 Popup Plugin For WordPress - ConvertPlus = 3.5.30 - Missing Authorization to Authenticated Subscriber+ Limited Options Update Description The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing...

CVE-2024-10245

CVE-2024-10245 Relais 2FA = 1.0 - Authentication Bypass Description The Relais 2FA plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.0. This is due to incorrect authentication and capability checking in the 'rldoajax' function. This makes it possible...

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...

CVE-2023-47840

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The Qode Essential Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...