CVE-2024-3097

CVE-2024-3097 — NextGEN Gallery (WordPress)

CVE-2024-2186

CVE-2024-2186: Beaver Builder Addons by WPZOOM for WordPress is susceptible to Stored XSS via the Team Members widget in all versions

CVE-2024-2457

CVE-2024-2457 describes a Stored Cross-Site Scripting vulnerability in the WordPress plugin Modal Window – create popup modal window affecting all versions up to and including 5.3.8 . The root cause is insufficient input sanitization and output escaping on user-supplied shortcode attributes, enab...

CVE-2024-2650

The CVE-2024-2650 issue affects the WordPress plugin Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders (Essential Addons for Elementor Lite). Root cause: Stored Cross-Site Scripting in the Woo Product Carousel widget due to insufficient input sanitiza...

CVE-2024-1571

CVE-2024-1571 : WP Recipe Maker for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to 9.2.1 due to insufficient input sanitization and output escaping. Authenticated users with access to the recipe dashboard (admin by default, but roles can...

CVE-2024-1948

CVE-2024-1948 affects Getwid – Gutenberg Blocks (WordPress) up to version 2.0.5. Root cause: insufficient input sanitization and output escaping in block content, enabling stored XSS. Exploitation requires Contributor+ privileges and user interaction on injected pages. Fix: upgrade to version 2.0...

CVE-2023-6799

CVE-2023-6799 affects the WP Reset plugin for WordPress (versions up to 2.0). The root cause is insufficiently random snapshot names, enabling unauthenticated attackers to brute-force and extract sensitive data such as backups. The risk is tied to Information Exposure (C), with no vendor hardenin...

CVE-2024-1990

CVE-2024-1990 concerns the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress. The connected sources confirm a blind SQL Injection via the id parameter in the RM_Form shortcode, exploitable in all versions up to 5.3.1.0 due to insufficie...

CVE-2024-2027

CVE-2024-2027 affects Real Media Library: Media Library Folder & File Manager (WordPress). Root cause: insufficient input sanitization and output escaping in style attributes, enabling Stored XSS. Affected versions: all up to and including 4.22.7. Impact: authenticated attackers with contributor+...

CVE-2024-1466

CVE-2024-1466 targets the WordPress plugin “Elementor Addons by Livemesh” (versions up to 8.3.4). The issue is a Stored Cross-Site Scripting flaw in the Posts Multislider widget via the slider_style attribute, caused by insufficient input sanitization and output escaping. Exploitation requires co...

CVE-2024-2198

CVE-2024-2198 concerns the WordPress plugin Contact Form by BestWebSoft, with a Reflected XSS vulnerability via the cntctfrm_contact_address parameter in versions up to 4.2.8. The issue arises from insufficient input sanitization and output escaping, allowing an unauthenticated attacker to craft ...

CVE-2024-0626

CVE-2024-0626 affects the WooCommerce Clover Payment Gateway plugin for WordPress. The root cause is a missing capability check in the callback_handler, leading to broken access control that allows unauthenticated users to mark orders as paid. Affected versions are

CVE-2024-2112

The CVE-2024-2112 entry concerns the WordPress plugin Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder, affected up to version 1.15.22. The vulnerability, described across sources (NVD/NVD-related, Red Hat, PatchStack), is Sensitive Information Exposure via the plugin’s sign...

CVE-2024-2436

The CVE-2024-2436 entry concerns the Lightweight Accordion WordPress plugin. It describes a stored XSS in the plugin’s shortcodes caused by insufficient input sanitization and output escaping on user-supplied attributes, affecting all versions up to and including 1.5.16. The vulnerability require...

CVE-2023-6777

CVE-2023-6777 affects WP Go Maps (WordPress plugin) up to version 9.0.34, enabling unauthenticated disclosure of the Google API key by embedding it in multiple plugin files. Attackers could use the exposed key to make API requests, potentially exhausting quotas and affecting map functionality. Pu...

CVE-2024-2165

CVE-2024-2165 affects the SEOPress – On-site SEO plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting via the image alt parameter in all versions up to and including 7.5.2.1, caused by insufficient input sanitization and output escaping. Exploitation requires authentication, w...

CVE-2024-1850

The CVE CVE-2024-1850 concerns the WordPress plugin AI Post Generator | AutoWriter up to version 3.3. It lacks a capability check on AJAX-handled functions, enabling authenticated users with subscriber access or higher to view all generated posts (including non-published), create/publish new post...

CVE-2024-2336

CVE-2024-2336 affects the WordPress plugin Popup Maker – Popup for opt-ins, lead gen, & more. All versions up to 1.18.2 are vulnerable to Stored Cross‑Site Scripting via shortcode attributes due to insufficient input sanitization/output escaping. Exploitation requires contributor‑level privileges...

CVE-2024-1308

The CVE-2024-1308 entry covers the WooCommerce Cloak Affiliate Links plugin for WordPress up to version 1.0.33, where a missing authorization check in the permalink_settings_save function allows unauthenticated modification of the affiliate permalink base, enabling traffic redirection to maliciou...

CVE-2024-0826

CVE-2024-0826 affects Qi Addons For Elementor for WordPress. The vulnerability is a Stored Cross‑Site Scripting (XSS) in widget attributes caused by insufficient input sanitization and output escaping, allowing authenticated users with contributor-level or higher permissions to inject scripts tha...