CVE-2024-0872

CVE-2024-0872 affects the Watu Quiz WordPress plugin. All versions up to 3.4.1 are vulnerable via the watu-userinfo shortcode, allowing authenticated attackers with contributor-level access and above to access sensitive user metadata (including session tokens and emails). The provided documents d...

CVE-2024-2305

CVE-2024-2305 concerns the WordPress plugin Cards for Beaver Builder. The vulnerability is described as a Stored Cross-Site Scripting (XSS) via the BootstrapCard link in versions up to and including 1.1.2, caused by insufficient input sanitization and output escaping on user-supplied attributes. ...

CVE-2024-1893

CVE-2024-1893 affects the Easy Property Listings WordPress plugin. Time-based SQL Injection is possible in all versions up to 3.5.2 due to insufficient escaping of the property_status shortcode parameter and inadequate query preparation. Authenticated attackers with Contributor+ privileges can in...

CVE-2024-2507

CVE-2024-2507 affects JetWidgets For Elementor plugin for WordPress. All versions up to and including 1.0.16 are vulnerable to Stored Cross-Site Scripting via the widget button URL due to insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authen...

CVE-2024-2335

CVE-2024-2335 concerns the Elements Plus! WordPress plugin. Affected: Elements Plus! up to version 2.16.2. Issue: Stored Cross-Site Scripting via multiple widget link URLs caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: authenticated attackers wi...

CVE-2024-2871

CVE-2024-2871 affects the Media Library Assistant plugin for WordPress. It enables SQL Injection via shortcode parameters in all versions up to 3.13 due to insufficient escaping and lack of proper query preparation, allowing authenticated attackers with contributor access or higher to append addi...

CVE-2024-3136

CVE-2024-3136 : MasterStudy LMS WordPress plugin (

CVE-2024-3214

CVE-2024-3214 affects Relevanssi – A Better Search (WordPress) up to version 4.22.1. It allows unauthenticated CSV injection by embedding untrusted input in exported CSV files, with potential code execution when the CSV is opened in a vulnerable environment. The vulnerability is classified as una...

CVE-2024-1465

The CVE-2024-1465 entry concerns the Elementor Addons by Livemesh plugin for WordPress (versions up to and including 8.3.4). It describes a Stored Cross-Site Scripting vulnerability in the Posts Carousel widget via the carousel_skin attribute, arising from insufficient input sanitization and outp...

CVE-2024-1813

CVE-2024-1813 – Simple Job Board (WordPress) is a PHP Object Injection vulnerability in all versions up to 2.11.0, caused by deserialization of untrusted input in job_board_applicant_list_columns_value. It allows unauthenticated attackers to inject a PHP object; with a POP chain from another plug...

CVE-2024-2340

CVE-2024-2340 affects the WordPress Avada theme up to version 7.11.6. The vulnerability enables unauthenticated attackers to access sensitive files uploaded through Avada forms via the /wp-content/uploads/fusion-forms/ directory, causing sensitive information exposure. Root cause: directory listi...

CVE-2024-1934

CVE-2024-1934 affects WP Compress – Image Optimizer for WordPress (all versions up to and including 6.11.10). The vulnerability is due to a missing capability check in wps_local_compress::__construct, allowing unauthenticated attackers to modify data by resetting the CDN region and injecting a ma...

CVE-2024-1790

The CVE CVE-2024-1790 affects WordPress Infinite Scroll – Ajax Load More plugin for WordPress (up to version 7.0.1). It enables Path Traversal via the type parameter, allowing authenticated attackers with administrator-level access and above to read arbitrary server files (Windows instances only)...

CVE-2024-0899

CVE-2024-0899 affects s2Member – Best Membership Plugin for WordPress. It enables Information Exposure via the API in all versions up to 230815, allowing unauthenticated access to post/page contents. Patch/update to 240315 or later to remediate. This entry is corroborated by multiple sources in t...

CVE-2024-2536

CVE-2024-2536 affects the Rank Math SEO with AI Tools plugin for WordPress. The vulnerability is Stored Cross-Site Scripting via HowTo block attributes due to insufficient input sanitization and output escaping. It impacts all versions up through 1.0.214 and requires contributor-level or higher a...

CVE-2024-2693

CVE-2024-2693 affects the Link Whisper Free WordPress plugin up to version 0.7.1. The vulnerability is a PHP Object Injection via deserialization of untrusted input in the mfn-page-items post meta value, exploitable by authenticated users with contributor-level access or higher to inject a PHP ob...

CVE-2024-1464

Elementor Addons by Livemesh (WordPress) has CVE-2024-1464: Stored XSS via the style attribute in the Posts Slider widget, affecting all versions up to 8.3.4 due to insufficient input sanitization/output escaping. Impact: authenticated users with contributor+ privileges can inject scripts that ru...

CVE-2024-2183

The issue is a stored XSS in Beaver Builder Addons by WPZOOM for WordPress, affecting all versions up to 1.3.4. The vulnerability arises from insufficient input sanitization and output escaping in the Heading widget, allowing authenticated attackers with contributor-level access+ to inject script...

CVE-2024-1991

CVE-2024-1991 affects the WordPress plugin RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. A missing capability check in update_users_role() exists in all versions up to 5.3.0.0, enabling authenticated users with subscriber-level access and above to elev...

CVE-2024-2543

The CVE-2024-2543 entry concerns the Permalink Manager Lite WordPress plugin. A missing capability check in get_uri_editor affects all versions up to 2.4.3.1, enabling unauthenticated attackers to view permalinks for all posts. Remediation: upgrade to 2.4.3.2 or later (patched in that version).