CVE-2023-46205

CVE-2023-46205 : Local File Inclusion in the WordPress plugin Ultimate Addons for WPBakery Page Builder. Affected versions: up to 3.19.14. Root cause: improper limitation of a pathname to restricted directories (path traversal) leading to PHP Local File Inclusion. Impact (per CVE metrics): potent...

CVE-2023-46197

CVE-2023-46197: Path traversal vulnerability in Popup by Supsystic (WordPress plugin) allowing relative path traversal in versions up to 1.10.19. Exploitation path observed via getWpCsvList; unauthenticated access possible per Patchstack documenting arbitrary file download risk. Affected: Popup b...

CVE-2023-46145

CVE-2023-46145 is an authenticated privilege escalation in the WordPress theme Themify Ultra. The vulnerability arises from improper privilege management in Themify Ultra versions up to and including 7.3.5, enabling a subscriber-level attacker to escalate privileges. The issue is actively documen...

CVE-2023-45652

CVE-2023-45652: WordPress Remote Content Shortcode

CVE-2024-4789

CVE-2024-4789 : Cost Calculator Builder Pro for WordPress vulnerable to Server-Side Request Forgery (SSRF) via send_demo_webhook() in all versions up to 3.1.72. Exploitation requires authenticated access at subscriber level or higher, enabling the attacker to make outbound requests from the web a...

CVE-2023-44478

CVE-2023-44478 is a CSRF flaw in the WordPress plugin Events Rich Snippets for Google (

CVE-2024-24874

CVE-2024-24874 affects WordPress plugin CP Polls up to version 1.0.71, where unauthenticated content injection is possible due to insufficient validation of poll answers. The vulnerability is categorized as Content Injection with a low CVSS (5.3) and is mitigated by upgrading to version 1.0.72, w...

CVE-2024-25595

CVE-2024-25595 describes an Authentication Bypass by Spoofing in the Defender Security plugin for WordPress by WPMU DEV. Affected versions are Defender Security up to 4.4.1, with the underlying issue allowing an unauthenticated bypass of IP-based or functional protections, effectively enabling a ...

CVE-2024-25906

CVE-2024-25906 affects the WordPress plugin Comments Like Dislike (WP Happy Coders) up to version 1.2.2 . The issue is an authentication bypass via spoofing, specifically an IP restriction bypass that can allow functionality bypass/escalation of access as described in Patchstack and Red Hat/NVD r...

CVE-2024-30522

Technical details for CVE-2024-30522 are not provided in the connected documents. The public sources included here confirm basic description but no affected versions beyond 8.2.0; monitor for updates.

CVE-2024-30527

CVE-2024-30527 affects WordPress WP Express Checkout (Accept PayPal Payments) plugin up to version 2.3.7. An improper validation of the specified quantity in input allows manipulating hidden fields during checkout, enabling price manipulation. Mitigation: upgrade to a version later than 2.3.7 (pa...

CVE-2024-31341

CVE-2024-31341 affects Cozmoslabs Profile Builder for WordPress (

CVE-2024-32131

CVE-2024-32131 describes an information disclosure in WordPress Download Manager (plugin). The vulnerability, titled Exposure of Sensitive Information to an Unauthorized Actor, allows a password-protected file lock bypass in versions up to 3.2.82 (includes 3.2.82). The CVSS v3.1 score is 7.5 (HIG...

CVE-2024-32790

CVE-2024-32790 describes an Improper Neutralization of Script-Related HTML Tags (XSS) in the WordPress plugin Pricing Table by Supsystic. Affected are Pricing Table by Supsystic versions up to 1.9.12. Root cause per description is improper neutralization of script-related HTML tags in a web page,...

CVE-2024-33549

CVE-2024-33549 is an Improper Privilege Management vulnerability in the WordPress plugin AA-Team WZone, enabling Privilege Escalation. Affected range includes WZone versions up to 14.0.10. Public sources in connected documents confirm the vulnerability exists and describes the impact as privilege...

CVE-2024-33550

CVE-2024-33550 affects the WordPress WP Masquerade plugin (versions n/a–1.1.0). The issue is an Improper Privilege Management vulnerability enabling Privilege Escalation by authenticated users (Subscriber+). Public exploit details are not provided in the documents beyond the authenticated account...

CVE-2024-33644

CVE-2024-33644 is an unauthenticated remote code execution vulnerability in the WPCustomify Customify Site Library (WordPress plugin). Technical details across sources show code-injection via improper control of generated code, affecting Customify Site Library versions from 0.0.0 up to and includ...

CVE-2024-33917

CVE-2024-33917 is an Authentication Bypass by Spoofing vulnerability in the WordPress plugin WTI Like Post by Webtechideas, affecting versions up to 1.4.6 . Public detail across sources identifies the issue as an IP spoofing-based authentication bypass that could allow bypassing normal access con...

CVE-2024-34370

CVE-2024-34370 refers to an Improper Privilege Management vulnerability in the WPFactory EAN for WooCommerce plugin, affecting EAN for WooCommerce versions up to 4.8.9. The issue enables Privilege Escalation via Arbitrary Updates to options, with CVSSv3.1 metrics indicating Network attack vector,...

CVE-2024-34434

CVE-2024-34434 is an Incorrect Authorization vulnerability in the WordPress MDTF (Meta Data and Taxonomies Filter) plugin. The issue affects MDTF versions from some unknown start until 1.3.3.2 and enables Code Inclusion/Arbitrary Shortcode Execution through a flawed authorization check. Red Hat’s...