CVE-2024-12304

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2024-12304

CVE-2024-12304 affects Gutenberg Blocks with AI by Kadence WP – Page Builder Features (WordPress). The vulnerability is a Stored Cross-Site Scripting flaw via a button block link in all versions up to 3.4.2, caused by insufficient input sanitization and output escaping. Exploitation requires an a...

CVE-2024-13183 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titletag’ parameter in all versions up to, and including, 2.10.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-12473 AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) <= 2.5 - Authenticated (Contributor+) SQL Injection

The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT GPT-4o 128K plugin for WordPress is vulnerable to SQL Injection via the 'templateid' parameter of the 'articlebuildergeneratedata' shortcode in all versions up to, and...

PT-2025-2771

Name of the Vulnerable Software and Affected Versions: Report application affected versions not specified Description: A user with advanced report application access rights can perform actions for which they are not authorized. This issue allows unauthorized actions to be carried out by users wit...

CVE-2024-12616

The Bitlys WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2024-12491

The SimplyRETS Real Estate IDX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'srsearchform' shortcode in all versions up to, and including, 2.11.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-12514

CVE-2024-12514 refers to the WordPress plugin 3D Viewer Online : a stored cross-site scripting flaw in the plugin’s '3Dvo-model' shortcode affecting all versions up to and including 2.2.2 . The vulnerability enables authenticated attackers with contributor-level access or higher to inject scripts...

CVE-2024-12515

The CVE CVE-2024-12515 affects the WordPress plugin Muslim Prayer Time-Salah/Iqamah (masjidal) up to version 1.8.8. It is a Stored Cross-Site Scripting flaw exploitable by authenticated attackers with Contributor-level access or higher via the Masjid ID parameter, due to insufficient input saniti...

CVE-2024-12819

CVE-2024-12819 affects the WordPress Searchie plugin up to version 1.17.0. The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin shortcode sio_embed_media, caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers ...

CVE-2024-11929 Responsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Responsive FlipBook Plugin Wordpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the rfbwpsavesettings functionin all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2024-5769 MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Limited Settings Update

The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

CVE-2024-12496

CVE-2024-12496 involves the WordPress Linear plugin (versions

CVE-2024-13153

CVE-2024-13153 affects the Unlimited Elements For Elementor plugin for WordPress. It enables Stored XSS via multiple widgets (Image Tooltip, Notification, Simple Popup, Video Play Button, Card Carousel) in all versions up to 1.5.135 due to insufficient input sanitization/escaped output on user at...

PT-2025-1386 · Opsview · Opsview Monitor Agent

Name of the Vulnerable Software and Affected Versions: Opsview Monitor Agent version 6.8 Description: A problem was discovered in Opsview Monitor Agent where an unauthenticated remote attacker can call check nrpe against affected targets, specifying known NRPE plugins. In default installations,...

CVE-2024-12030

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute of the 'mdfvalue' shortcode in all versions up to, and including, 1.3.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2024-12205

The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slider Widget in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-12030

MDTF – Meta Data and Taxonomies Filter (WordPress) is vulnerable to SQL Injection via the key parameter in the mdf_value shortcode in all versions up to and including 1.3.3.5. The vulnerability requires authentication (Contributor level or higher) and can be leveraged to append additional SQL to ...

CVE-2024-12532

CVE-2024-12532 affects the WordPress plugin BWD Elementor Addons (WordPress) up to version 4.3.18 . The vulnerability is a Sensitive Information Exposure in the file widgets/bwdeb-content-switcher.php, enabling authenticated attackers with at least Contributor privileges to extract sensitive data...

CVE-2024-12495

The Bootstrap Blocks for WP Editor v2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gtb-bootstrap/column' block in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...