WordPress Funnel Builder by CartFlows plugin <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin CartFlows versions = 2.0.7...

WordPress Robo Gallery plugin <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Image Title vulnerability discovered by Tim Coen in WordPress Plugin Robo Gallery versions = 3.2.19...

WordPress MIMO Woocommerce Order Tracking plugin <= 1.0.2 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin MIMO Woocommerce Order Tracking versions = 1.0.2...

WordPress Universal Slider plugin <= 1.6.5 - Authenticated PHP Object Injection vulnerability

Authenticated PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Universal Slider versions = 1.6.5...

WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Lucio Sá in WordPress Plugin AliNext versions = 3.3.5...

WordPress PDF Viewer for Elementor plugin <= 2.9.3 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by WordFence in WordPress Plugin PDF Viewer for Elementor versions = 2.9.3...

WordPress Stratum – Elementor Widgets plugin <= 1.4.1 - Authenticated Stored Cross-Site Scripting via Countdown Widget vulnerability

Authenticated Stored Cross-Site Scripting via Countdown Widget vulnerability discovered by wesley wcraft in WordPress Plugin Stratum versions = 1.4.1...

WordPress Woody code snippets plugin <= 2.5.0 - Authenticated Remote Code Execution vulnerability

Authenticated Remote Code Execution vulnerability discovered by Webbernaut in WordPress Plugin Woody ad snippets versions = 2.5.0...

WordPress Shariff Wrapper plugin <= 4.6.13 - Authenticated Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Stored Cross-Site Scripting via Shortcode vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Shariff versions = 4.6.13...

Wordpress ElementsKit Pro plugin <= 3.6.2 - Authenticated (Contributor+) Server-Side Request Forgery vulnerability

Authenticated Contributor+ Server-Side Request Forgery vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin ElementsKit Pro versions = 3.6.2...

Comments – wpDiscuz < 7.6.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.6.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

WordPress Icegram Express plugin <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] vulnerability

Authenticated Subscriber+ SQL Injection Vulnerability via optionslistid vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Email Subscribers & Newsletters versions = 5.7.22...

WordPress Custom Field Suite plugin <= 2.6.7 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Jack Taylor in WordPress Plugin Custom Field Suite versions = 2.6.7...

Wordpress Essential Addons for Elementor plugin <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Essential Addons for Elementor versions = 5.9.23...

Wordpress Blog2Social: Social Media Auto Post & Scheduler plugin <= 7.4.1 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by 1337Wannabe in WordPress Plugin Blog2Social versions = 7.4.1...

WordPress Custom Field Template plugin <= 2.6.1 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Sh in WordPress Plugin Custom Field Template versions = 2.6.1...

CVE-2024-35682 WordPress Otter Blocks PRO plugin <= 2.6.11 - Authenticated Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Themeisle Otter Blocks PRO.This issue affects Otter Blocks PRO: from n/a through 2.6.11...

WordPress Cards for Beaver Builder plugin <= 1.1.3 - Authenticated Stored Cross-Site Scripting via Cards Widget vulnerability

Authenticated Stored Cross-Site Scripting via Cards Widget vulnerability discovered by Francesco Carlucci in WordPress Plugin Cards for Beaver Builder versions = 1.1.3...

WordPress Prime Slider plugin <= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Pacific Widget vulnerability discovered by wesley wcraft in WordPress Plugin Prime Slider – Addons For Elementor versions = 3.14.7...

WordPress ElementsReady Addons for Elementor plugin <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin ElementsReady Addons for Elementor versions = 6.1.0...