CVE-2024-1083

CVE-2024-1083 refers to the WordPress plugin Simple Restrict (affected versions:

CVE-2024-2172

CVE-2024-2172 affects MiniOrange WordPress plugins: Malware Scanner (up to 4.7.2) and Web Application Firewall (up to 2.1.1). Root cause is a missing capability check in mo_wpns_init(), enabling unauthenticated privilege escalation to administrator. Documented impact: sites can be compromised by ...

CVE-2024-1452

CVE-2024-1452 affects the WordPress GenerateBlocks plugin. The vulnerability exists in the Query Loop and allows authenticated users with at least Contributor access to view content of posts/pages (including drafts, private, or scheduled) due to a sensitive information exposure in versions up to ...

CVE-2023-6880

CVE-2023-6880 affects the Visual Composer website plugins for WordPress (Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages). The vulnerability is stored XSS in plugin custom fields due to insufficient input sanitization and output escaping on user-s...

CVE-2024-0591

CVE-2024-0591 — wpDataTables WordPress plugin is a reflected XSS in the A parameter affecting versions up to 3.4.2.2, caused by insufficient input sanitization and output escaping. Unauthenticated attackers could inject scripts into pages that are executed when a user is tricked into performing a...

CVE-2024-1293

CVE-2024-1293 covers a stored Cross-Site Scripting vulnerability in the Brizy – Page Builder WordPress plugin. The issue arises in the embedded media custom block, affecting all versions up to and including 2.4.40, due to insufficient input sanitization and output escaping. Exploitation requires ...

CVE-2024-0828

The CVE-2024-0828 entry concerns the Play.ht WordPress plugin. The vulnerability is due to missing capability checks in several functions, affecting all versions up to and including 3.6.4. This allows authenticated attackers with subscriber access or higher to delete, retrieve, or modify post met...

CVE-2024-0976

The CVE concerns WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce (WordPress) up to version 3.1.41, which is vulnerable to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping in a plugin parameter. Unauthenticated attackers cou...

CVE-2024-0449

CVE-2024-0449 affects the ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress (versions up to and including 1.1.6). The vulnerability is a stored cross-site scripting flaw in admin settings caused by insufficient input sanitization and output escaping. It requires authenticated acce...

CVE-2024-1127

CVE-2024-1127 affects the WordPress plugin “EventPrime – Events Calendar, Bookings and Tickets.” The vulnerability is a missing capability check in booking_export_all(), present in all versions up to and including 3.4.1. This allows authenticated attackers with subscriber-level access or higher t...

CVE-2024-1484

CVE-2024-1484 — Amelia plugin for WordPress (Booking for Appointments and Events Calendar) Vulnerability type: Reflected Cross-Site Scripting (XSS) via date parameters in the plugin’s input handling. Root cause: Insufficient input sanitization and output escaping allows injection of arbitrary web...

CVE-2024-1535

ProfilePress WordPress plugin (formerly named ProfilePress/Restrict Content) is affected by CVE-2024-1535. According to the sources, versions up to 4.15.2 are vulnerable to stored cross-site scripting via the plugin’s shortcodes due to insufficient input sanitization and output escaping on user-s...

CVE-2024-1862

CVE-2024-1862 affects the WordPress plugin “WooCommerce Add to Cart Custom Redirect” (versions

CVE-2024-1585

CVE-2024-1585 affects Metform – Elementor Contact Form Builder for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) in shortcode handling, caused by insufficient input sanitization and output escaping on user-supplied attributes. Affected versions are up to 3.8.3; exploitation ...

CVE-2024-1642

CVE-2024-1642 affects the MainWP Dashboard: WordPress Manager for Multiple Websites Maintenance plugin. The issue is a Cross-Site Request Forgery (CSRF) in the posting_bulk function caused by missing/incorrect nonce validation, allowing unauthenticated attackers to delete arbitrary posts if a sit...

CVE-2024-1392

CVE-2024-1392 affects the WordPress plugin Elementor Addon Elements (versions

CVE-2024-1935

CVE-2024-1935 concerns the WordPress plugin Giveaways and Contests by RafflePress (versions up to and including 1.12.5). The vulnerability is a Stored XSS via the parent_url parameter caused by insufficient input sanitization and output escaping. Attack scenario: unauthenticated attackers can inj...

CVE-2024-2106

CVE-2024-2106 affects MasterStudy LMS WordPress Plugin

CVE-2024-0326

CVE-2024-0326 affects Premium Addons for Elementor for WordPress. It is a Stored Cross-Site Scripting (XSS) vulnerability in the Link Wrapper feature across all versions up to and including 4.10.17. The issue arises from insufficient input sanitization and output escaping on user-supplied links, ...

CVE-2024-1358

CVE-2024-1358 affects the Elementor Addon Elements WordPress plugin (versions ≤ 1.12.12). The vulnerability is a directory traversal flaw in the render function that allows authenticated attackers with contributor access or higher to include contents of arbitrary PHP files on the server, exposing...