CVE-2023-44227

CVE-2023-44227 affects WordPress plugin Simple File List (Mitchell Bennis) up to version 6.1.9. Root cause: Missing/insufficient authorization controls allow unauthenticated users to delete arbitrary files via the plugin’s deletion functionality, enabling potential denial of service or data loss....

CVE-2023-45000

CVE-2023-45000 is a Missing Authorization vulnerability affecting LiteSpeed Cache (WordPress) up to version 5.7, allowing unauthorized access via the API. The available documents confirm the issue and affected range but do not provide concrete exploitation details, affected sub-components, or a c...

CVE-2023-40000

LiteSpeed Cache (WordPress plugin)

CVE-2024-1846

CVE-2024-1846 affects the WordPress plugin “Responsive Tabs” (versions before 4.0.7). The issue is a lack of validation/escaping of shortcode attributes, leading to Stored XSS when the shortcode is rendered in a post/page. The root cause is improper handling of attributes in the plugin’s output. ...

CVE-2024-2857

The CVE refers to WordPress plugin Simple Buttons Creator (

CVE-2024-2836

The CVE-2024-2836 entry refers to the WordPress plugin “Social Share, Social Login and Social Comments Plugin” (Super Socializer). Version range affected: before 7.13.64. Root cause: the plugin does not sufficiently sanitize/escape certain settings, enabling Cross-Site Scripting (XSS) for high-pr...

CVE-2024-1660

CVE-2024-1660 affects the WordPress Top Bar plugin prior to 3.0.5, where certain settings were not properly sanitised/escaped in the UI, enabling Stored XSS by high-privilege users (e.g., Administrators) even if unfiltered_html is disabled (including multisite setups). The Red Hat advisory mirror...

CVE-2024-1754

The CVE-2024-1754 entry concerns the NPS computy WordPress plugin (versions up to 2.7.5) where some settings are not sanitised/escaped, enabling Stored XSS by high-privilege users (e.g., Administrators) even if unfiltered_html is disallowed (e.g., multisite). Red Hat and Patchstack corroborate th...

CVE-2024-1712

The Carousel Slider WordPress plugin prior to version 2.2.7 does not sanitize/escape certain settings, allowing Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Affected versions:

CVE-2024-1746

CVE-2024-1746 affects the WordPress plugin Testimonial Slider (versions prior to 2.3.8). The vulnerability stems from insufficient sanitization/escaping of certain plugin settings, allowing Stored XSS by high-privilege users (e.g., administrators) even when the unfiltered_html capability is disal...

CVE-2024-1306

CVE-2024-1306 affects the Smart Forms WordPress plugin prior to version 2.6.94. The Red Hat advisory and NVD entry describe a CSRF vulnerability where missing CSRF protections in certain actions allow logged-in users to be tricked into performing unintended actions (e.g., editing entries). Root c...

CVE-2024-1204

The CVE-2024-1204 issue affects the Meta Box WordPress Custom Fields Framework (versions prior to 5.9.4). It allows users with at least the Contributor role to access arbitrary custom fields assigned to other users’ posts, indicating a broken access control vulnerability. Remediation, per multipl...

CVE-2024-0902

CVE-2024-0902 affects the Fancy Product Designer WordPress plugin prior to 6.1.81. Root cause: the plugin does not sanitize and escape certain settings, allowing high-privilege users (e.g., admins) to perform Stored Cross-Site Scripting even when unfiltered_html is disallowed (e.g., multisite). I...

CVE-2024-0399

CVE-2024-0399 concerns the WordPress plugin WooCommerce Customers Manager prior to version 29.7. The issue is an SQL injection caused by improper sanitisation/escaping of a parameter used in a SQL statement, exploitable by a Subscriber+ role through the affected admin-ajax endpoint. Public source...

CVE-2023-6067

The CVE-2023-6067 entry concerns WP User Profile Avatar for WordPress, where versions ≤ 1.0.1 fail to validate/escape shortcode attributes, enabling Stored XSS for users with Contributor+ privileges. Red Hat and NVD entries confirm the vulnerability; the provided documents do not specify a fixed ...

CVE-2023-51515

CVE-2023-51515 affects Uncode Core (WordPress plugin) up to version 2.8.8, with a Missing Authorization vulnerability enabling Privilege Escalation. Multiple sources confirm the issue and that a fix exists; remediation is to upgrade to a non-vulnerable version (patched). If upgrading is not immed...

CVE-2023-51499

CVE-2023-51499 affects the WordPress WooCommerce Shipping Per Product plugin. Connected sources describe a Missing Authorization/Broken Access Control flaw in versions up to 2.5.4, enabling unauthorized access to affected resources. Remediation per sources is to upgrade to a fixed version (2.5.5+...

CVE-2022-40211

CVE-2022-40211 affects the WordPress GiveWP plugin

CVE-2024-0881

The CVE-2024-0881 entry concerns the WordPress Combo Blocks ecosystem (Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel) prior to version 2.2.76. Root cause: improper access control allows unauthenticated AJAX actions to reveal password-protected posts, enabling ...

CVE-2023-29483

CVE-2023-29483 affects dnspython (used with eventlet) and enables a remote attacker to interfere with DNS name resolution by sending an invalid UDP packet before a valid one (a TuDoor attack). Affected combo: eventlet before 0.35.2 used in dnspython before 2.6.0. The note indicates 2.6.0 is unusa...