CVE-2024-24874

CVE-2024-24874 affects WordPress plugin CP Polls up to version 1.0.71, where unauthenticated content injection is possible due to insufficient validation of poll answers. The vulnerability is categorized as Content Injection with a low CVSS (5.3) and is mitigated by upgrading to version 1.0.72, w...

CVE-2024-25595

CVE-2024-25595 describes an Authentication Bypass by Spoofing in the Defender Security plugin for WordPress by WPMU DEV. Affected versions are Defender Security up to 4.4.1, with the underlying issue allowing an unauthenticated bypass of IP-based or functional protections, effectively enabling a ...

CVE-2024-25906

CVE-2024-25906 affects the WordPress plugin Comments Like Dislike (WP Happy Coders) up to version 1.2.2 . The issue is an authentication bypass via spoofing, specifically an IP restriction bypass that can allow functionality bypass/escalation of access as described in Patchstack and Red Hat/NVD r...

CVE-2024-30522

Technical details for CVE-2024-30522 are not provided in the connected documents. The public sources included here confirm basic description but no affected versions beyond 8.2.0; monitor for updates.

CVE-2024-30527

CVE-2024-30527 affects WordPress WP Express Checkout (Accept PayPal Payments) plugin up to version 2.3.7. An improper validation of the specified quantity in input allows manipulating hidden fields during checkout, enabling price manipulation. Mitigation: upgrade to a version later than 2.3.7 (pa...

CVE-2024-31341

CVE-2024-31341 affects Cozmoslabs Profile Builder for WordPress (

CVE-2024-32131

CVE-2024-32131 describes an information disclosure in WordPress Download Manager (plugin). The vulnerability, titled Exposure of Sensitive Information to an Unauthorized Actor, allows a password-protected file lock bypass in versions up to 3.2.82 (includes 3.2.82). The CVSS v3.1 score is 7.5 (HIG...

CVE-2024-32790

CVE-2024-32790 describes an Improper Neutralization of Script-Related HTML Tags (XSS) in the WordPress plugin Pricing Table by Supsystic. Affected are Pricing Table by Supsystic versions up to 1.9.12. Root cause per description is improper neutralization of script-related HTML tags in a web page,...

CVE-2024-33549

CVE-2024-33549 is an Improper Privilege Management vulnerability in the WordPress plugin AA-Team WZone, enabling Privilege Escalation. Affected range includes WZone versions up to 14.0.10. Public sources in connected documents confirm the vulnerability exists and describes the impact as privilege...

CVE-2024-33550

CVE-2024-33550 affects the WordPress WP Masquerade plugin (versions n/a–1.1.0). The issue is an Improper Privilege Management vulnerability enabling Privilege Escalation by authenticated users (Subscriber+). Public exploit details are not provided in the documents beyond the authenticated account...

CVE-2024-33644

CVE-2024-33644 is an unauthenticated remote code execution vulnerability in the WPCustomify Customify Site Library (WordPress plugin). Technical details across sources show code-injection via improper control of generated code, affecting Customify Site Library versions from 0.0.0 up to and includ...

CVE-2024-33917

CVE-2024-33917 is an Authentication Bypass by Spoofing vulnerability in the WordPress plugin WTI Like Post by Webtechideas, affecting versions up to 1.4.6 . Public detail across sources identifies the issue as an IP spoofing-based authentication bypass that could allow bypassing normal access con...

CVE-2024-34370

CVE-2024-34370 refers to an Improper Privilege Management vulnerability in the WPFactory EAN for WooCommerce plugin, affecting EAN for WooCommerce versions up to 4.8.9. The issue enables Privilege Escalation via Arbitrary Updates to options, with CVSSv3.1 metrics indicating Network attack vector,...

CVE-2024-34434

CVE-2024-34434 is an Incorrect Authorization vulnerability in the WordPress MDTF (Meta Data and Taxonomies Filter) plugin. The issue affects MDTF versions from some unknown start until 1.3.3.2 and enables Code Inclusion/Arbitrary Shortcode Execution through a flawed authorization check. Red Hat’s...

CVE-2023-41957

CVE-2023-41957 affects WordPress Simple Membership Plugin (

CVE-2023-41956

The CVE-2023-41956 entry concerns WordPress Simple Membership (smp7) with an Improper Authentication flaw that allowed an authenticated user to takeover accounts via the password reset flow. Affected versions are Simple Membership up to 4.3.4; patched in 4.3.5. Reports from NVD/Red Hat/Wordfence ...

CVE-2023-41955

CVE-2023-41955 is an Improper Privilege Management vulnerability in the WordPress plugin Essential Addons for Elementor (WPDeveloper). The flaw enables Privilege Escalation for authenticated users (Contributor/above) across versions up to 5.8.8 . The NVD entry lists a CVSS v3.1 base score of 8.8 ...

CVE-2023-41665

CVE-2023-41665 is a WordPress GiveWP plugin vulnerability: Privilege Escalation due to improper/insufficient privilege checks for updating default roles, enabling an authenticated Give Manager to elevate privileges up to administrator. Affected versions: GiveWP

CVE-2023-41243

The WPvivid Backup and Migration WordPress plugin (versions 0.9.90 and earlier ) is affected by an Improper Privilege Management vulnerability. This flaw allows for Privilege Escalation , where an attacker with Subscriber privileges can potentially gain unauthorized access or control over the sys...

CVE-2023-39163

CVE-2023-39163 (Phlox Shop) is an Unauthenticated Local File Inclusion in Averta Phlox Shop WordPress plugin, affecting versions up to 2.0.0. The issue arises from a path traversal vulnerability that allows local file inclusion. CVSS v3.1 score is 8.6 (High) with Network attack vector and no user...