CVE-2024-32087

CVE-2024-32087 affects the Product Feed on WooCommerce for Google plugin (Purple XMLs Google Product Feed for WooCommerce). The vulnerability is an SQL Injection in the ExportFeed.Com Product Feed for WooCommerce for Google, with impact as described in the CVE as of the report: affected versions ...

CVE-2024-32125

CVE-2024-32125 (BA Book Everything) is an authenticated SQL Injection vulnerability in the BA Book Everything plugin (

CVE-2024-32128

CVE-2024-32128 is an unauthenticated SQL Injection in Realtyna Organic IDX plugin for WordPress (Realtyna Organic IDX plugin + WPL Real Estate). The issue is caused by improper neutralization of input in the plugin, enabling an attacker to manipulate SQL queries. Affected versions are from n/a up...

CVE-2024-32134

CVE-2024-32134 is an Authenticated (Administrator+) SQL Injection in the WordPress plugin Forms to Zapier/Integromat/IFTTT/Workato/Automate.io/elastic.io/Built.io/APIANT/Webhook, affecting versions up to 1.1.12. Root cause is improper neutralization of input used in SQL commands. Public exploitat...

CVE-2024-32137

CVE-2024-32137 is an authenticated SQL Injection in Solwin User Activity Log Pro (WordPress plugin) affecting versions up to 2.3.4. The vulnerability stems from improper neutralization of SQL elements, enabling an attacker with LOW privileges and no UI interaction to exploit over the network. The...

CVE-2024-32431

CVE-2024-32431 concerns WP All Import Import Users from CSV with a Deserialization of Untrusted Data flaw affecting the Import Users from CSV plugin (affected versions: n/a–1.2). The CVE entry notes a patched remediation; systems should update to a patched/secure version. The description provides...

CVE-2024-32430

CVE-2024-32430 is a Server-Side Request Forgery (SSRF) vulnerability in the ActiveCampaign WordPress plugin (ActiveCampaign – Forms, Site Tracking, Live Chat) affecting versions up to 8.1.14. The CVSS metrics indicate a critical impact (CVSS 3.1: 9.8) with network access, no user interaction, and...

CVE-2023-52144

CVE-2023-52144 is a Path Traversal in the RexTheme Product Feed Manager (WordPress plugin). Connected Red Hat/ENISA/NVD entries confirm this as an Improper Limitation of a Pathname to a Restricted Directory affecting RexTheme Product Feed Manager up to version 7.3.15. The Red Hat entry notes the ...

CVE-2024-32133

CVE-2024-32133 is a reflected XSS in the EZ Form Calculator WordPress plugin (EZ Form Calculator) affecting versions up to 2.14.0.3. The vulnerability is documented as not patched in the connected material; no mitigation or patches are described within the provided documents.

CVE-2024-32140

CVE-2024-32140 : Stored Cross-Site Scripting in Libsyn Publisher Hub (improper neutralization of input during web page generation). Affected: Libsyn Publisher Hub up to version 1.4.4. The provided documents do not specify an available patch/mitigation or explicit exploitation details.

CVE-2024-32145

CVE-2024-32145 affects the WP Google Analytics Events WordPress plugin (vulnerable up to 2.8.0). Root cause: Improper input neutralization during web page generation leading to Reflected XSS. Impact is reflected XSS as stated; CVSS scores in public metrics show base scores around 6.1 (NVD) and 7....

CVE-2024-32149

CVE-2024-32149: Affected software is the Jobs for WordPress plugin (WordPress), version n/a up to 2.7.5. Root cause is improper neutralization of input during web page generation, enabling a Reflected XSS. Impact per CVSS: Confidentiality and Integrity are Low; Availability unaffected; user inter...

CVE-2024-32453

CVE-2024-32453 : Stored XSS in the POEditor WordPress plugin (

CVE-2024-3771

Affected product: PHPGurukul Student Record System 3.20. Vulnerability: SQL injection in /edit-subject.php caused by unsafely handling parameters sub1, sub2, sub3, sub4, and udate (remote exploitable). Several sources corroborate the issue and public disclosure. Impact: potential unauthorized dat...

CVE-2024-3770

The CVE-2024-3770 issue affects PHPGurukul Student Record System version 3.20, specifically the file /manage-courses.php?del=1. The root cause is improper validation of the del parameter, enabling SQL injection that can be triggered remotely. Public exploit guidance exists. Affected impact is hig...

CVE-2024-2739

The CVE-2024-2739 entry concerns the WordPress plugin Advanced Search (older than or equal to 1.1.6), which lacks CSRF protections in certain areas. This absence could allow an attacker to coerce logged-in users into performing unintended actions via CSRF. The available connected documents reiter...

CVE-2024-1846

CVE-2024-1846 affects the WordPress plugin “Responsive Tabs” (versions before 4.0.7). The issue is a lack of validation/escaping of shortcode attributes, leading to Stored XSS when the shortcode is rendered in a post/page. The root cause is improper handling of attributes in the plugin’s output. ...

CVE-2024-1849

The CVE-2024-1849 entry concerns WP Customer Reviews for WordPress: versions prior to 3.7.1 expose an unvalidated parameter that allows contributors+ to redirect pages to a malicious URL. This is an Unvalidated Redirects and Forwards issue with a reported CVSS v3.1 base score of 5.4 (Medium). The...

CVE-2024-2857

The CVE refers to WordPress plugin Simple Buttons Creator (

CVE-2024-2836

The CVE-2024-2836 entry refers to the WordPress plugin “Social Share, Social Login and Social Comments Plugin” (Super Socializer). Version range affected: before 7.13.64. Root cause: the plugin does not sufficiently sanitize/escape certain settings, enabling Cross-Site Scripting (XSS) for high-pr...