CVE-2023-25701

CVE-2023-25701 is a WordPress WatchTowerHQ plugin vulnerability (WatchTowerHQ

CVE-2023-25444

CVE-2023-25444 affects the WordPress plugin JS Help Desk – Best Help Desk & Support Plugin (versions

CVE-2023-25050

CVE-2023-25050 affects WordPress Shortcodes Ultimate (versions n/a through 5.12.6). The vulnerability is an Improper Limitation of a Pathname to a Restricted Directory (path traversal) that enables Absolute Path Traversal. Public sources (Patchstack; CVE records; Red Hat advisory) confirm the iss...

CVE-2023-24379

CVE-2023-24379: Path traversal (Local File Inclusion) in WordPress plugin Landing Page Builder – Free Landing Page Templates (Web-Settler) up to version 3.1.9.9. Root cause is improper pathname limitation, enabling retrieval of restricted files via crafted input. Affected product/version details ...

CVE-2023-23990

CVE-2023-23990 : WordPress plugin “Redirection for Contact Form 7” (wpcf7-redirect) has an improper Privilege Management vulnerability that enables Privilege Escalation. Affected versions are

CVE-2023-23988

CVE-2023-23988 affects the WordPress My Tickets plugin (versions <= 1.9.11). The issue is a Missing Authorization vulnerability, allowing unauthenticated users to bypass payment-related checks, potentially impacting the payment flow. The official Patchstack entry confirms the vulnerable softwa...

CVE-2023-23888

The CVE-2023-23888 entry concerns the WordPress Rank Math SEO plugin (

CVE-2023-23872

CVE-2023-23872 affects the WordPress plugin GMace (

CVE-2023-23700

CVE-2023-23700 affects the OceanWP WordPress theme (versions

CVE-2023-23645

CVE-2023-23645 affects the WordPress plugin MainWP Code Snippets Extension (versions

CVE-2022-45374

CVE-2022-45374 (YARPP for WordPress) : Local File Inclusion due to improper path handling in YARPP

CVE-2022-45368

CVE-2022-45368 affects WordPress plugin 1003 Mortgage Application (

CVE-2022-45070

CVE-2022-45070 affects the WordPress plugin Conditional Checkout Fields for WooCommerce (

CVE-2022-44581

CVE-2022-44581 affects the WordPress Defender Security plugin (WPMU DEV Defender Security) with versions up to 3.3.2. Multiple connected sources describe insecure storage of sensitive information and note that screen temporary files may expose sensitive data. Patchstack frames the issue as Broken...

CVE-2024-33556

CVE-2024-33556 involves the WordPress plugin XStore Core (8theme) with an Unrestricted Upload of File with Dangerous Type vulnerability. Affected versions are XStore Core up to 5.3.8 (root note uses “from n/a through 5.3.8”). Connected sources confirm the issue is a file upload vulnerability, ena...

CVE-2024-34567

CVE-2024-34567 describes a Stored Cross-Site Scripting (XSS) vulnerability in Popup Builder for WordPress, affecting the Popup Builder plugin up to version 1.1.29. The issue is caused by improper input neutralization during web page generation, enabling storedXSS by authenticated actors. Connecte...

CVE-2024-34575

CVE-2024-34575 is a stored XSS vulnerability in DethemeKit For Elementor. Affected: DethemeKit For Elementor versions up to 2.1.2. The issue is an Improper Neutralization of Input During Web Page Generation that allows stored cross-site scripting. Remediation status in connected data indicates pa...

CVE-2024-2744

The CVE refers to NextGEN Gallery WordPress plugin prior to 3.59.1. It allows stored XSS because some settings aren’t sanitized/escaped, enabling high-privilege users (e.g., admins) to execute scripts after interaction. CVSSv3.1 base score 4.3 (Medium) with AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L. Re...

CVE-2024-34757

CVE-2024-34757 is a Stored XSS vulnerability (Improper Neutralization of Input During Web Page Generation) in Visualmodo Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg. The issue affects Borderless from version before 1.5.3, causing stored cross-site scripting thr...

CVE-2024-3551

CVE-2024-3551 affects the Penci Soledad Data Migrator plugin for WordPress. It allows Local File Inclusion via the data parameter in all versions up to 1.3.0, enabling unauthenticated attackers to include and execute PHP files on the server, bypassing access controls and potentially leading to co...