CVE-2024-1413

CVE-2024-1413 affects Exclusive Addons for Elementor (WordPress). Vulnerable in Countdown Timer widget through Stored XSS in all versions up to 2.6.9 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (contributor+) and can cause script executio...

CVE-2024-1793

CVE-2024-1793 : The AWeber – Free Sign Up Form and Landing Page Builder Plugin for WordPress is vulnerable to SQL Injection via the post_id parameter in all versions up to and including 7.3.14 due to insufficient escaping of user input and insufficient preparation of the SQL query. An authenticat...

CVE-2024-1950

The CVE-2024-1950 entry applies to the WordPress plugin “Product Carousel Slider & Grid Ultimate for WooCommerce.” It describes a PHP Object Injection via deserialization of untrusted shortcode input in all versions up to 1.9.7. Attack requires an authenticated user with contributor+ privileges; ...

CVE-2024-1489

CVE-2024-1489 applies to the SMS Alert Order Notifications – WooCommerce plugin for WordPress (versions up to and including 3.6.9). The root cause is missing or incorrect nonce validation in the processBulkAction function, enabling CSRF. This can allow unauthenticated attackers to delete pages an...

CVE-2024-2252

CVE-2024-2252 refers to a stored XSS in the Droit Elementor Addons plugin for WordPress (versions up to 3.1.5). The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes (e.g., URL) in the plugin’s widgets. Exploitation requires authentication at...

CVE-2024-1723

The CVE-2024-1723 entry concerns SiteOrigin Widgets Bundle for WordPress (vulnerable through 1.58.7) with Stored XSS via multiple parameters. Affected parameters include: $instance['fonts']['title_options']['tag'], $headline_tag, $sub_headline_tag, and $feature['icon']; exploitation requires auth...

CVE-2024-2194

CVE-2024-2194 : Stored XSS in WP Statistics for WordPress, affecting all versions up to 14.5 due to insufficient input sanitization and output escaping. Exploitation is unauthenticated and occurs via the URL search parameter. Red Hat confirms the issue; Wordfence notes the vulnerability has a pat...

CVE-2024-1499

CVE-2024-1499 affects Orbit Fox by ThemeIsle (WordPress plugin) up to version 2.10.30, with Stored XSS in the Pricing Table widget via the $settings['title_tags'] field caused by insufficient input sanitization and output escaping. Exploitation is possible by authenticated users with contributor ...

CVE-2024-0827

The CVE CVE-2024-0827 affects the WordPress plugin Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio, vulnerable in all versions up to 3.6.4 due to missing or incorrect nonce validation in several functions. This CSRF flaw could allow unauthenticated attackers to invoke those fu...

CVE-2024-1311

The Brizy – Page Builder plugin for WordPress (Brizy) has a vulnerability (CVE-2024-1311): arbitrary file upload due to missing file type validation in storeImages, affecting all versions up to 2.4.40. Exploitation would require authenticated access (Contributor+); could enable remote code execut...

CVE-2024-1080

CVE-2024-1080 affects the Beaver Builder – WordPress Page Builder plugin for WordPress, with vulnerable versions listed as up to 2.7.4.4. The flaw is Stored Cross-Site Scripting (XSS) in the Heading tag due to insufficient input sanitization and output escaping. Exploitation requires authenticate...

CVE-2024-1806

The CVE-2024-1806 entry concerns the ProfilePress (Paid Membership Plugin) for WordPress. A stored XSS flaw exists in all versions up to 4.15.1 caused by insufficient input sanitization and output escaping on user-supplied attributes within the plugin’s shortcodes. Exploitation requires an attack...

CVE-2024-1541

The Gutenberg Blocks by Kadence Blocks – Page Builder Features WordPress plugin (up to version 3.2.23) is affected by a Stored Cross-Site Scripting vulnerability via the htmlTag attribute due to insufficient input sanitization and output escaping. Exploitation requires authentication with Contrib...

CVE-2024-0829

Technical details about CVE-2024-0829 are not publicly provided in the connected documents. The initial description notes missing authorization in a WordPress plugin (up to version 5.0) but provides no further vendor/product/version specifics. Monitor for updates.

CVE-2024-0369

CVE-2024-0369 affects the WordPress plugin Bulk Edit Post Titles, with all versions up to and including 5.0.0 vulnerable due to a missing capability check in bulkUpdatePostTitles. This flaw allows authenticated users with subscriber access or higher to modify titles of arbitrary posts. The issue ...

CVE-2024-0683

CVE-2024-0683 concerns Bulgarisation for WooCommerce, a WordPress plugin, with unauthorized access due to missing capability checks across several functions in all versions up to 3.0.14. The Red Hat advisory and Wordfence vulnerability entry confirm that both unauthenticated users and authenticat...

CVE-2024-1393

Elementor Addon Elements for WordPress has Stored XSS via the Content Switcher widget (icon_align) in all versions up to 1.12.12. Root cause: insufficient input sanitization and output escaping. Affected: plugin versions

CVE-2023-5663

CVE-2023-5663 - News Announcement Scroll (WordPress) is a SQL Injection in the plugin before and including version 9.0.0. Root cause: insufficient escaping of the user-supplied shortcode parameter and inadequate preparation of the SQL query, enabling an authenticated attacker (contributor level o...

CVE-2024-1505

CVE-2024-1505 affects the Academy LMS plugin for WordPress (

CVE-2024-0700

CVE-2024-0700 is a Stored XSS affecting WordPress Simple Tweet plugin up to version 1.4.0.2 due to insufficient input sanitization and output escaping. An attacker with author-level access (authenticated) can inject scripts that execute when users load injected pages. Root cause: inadequate sanit...