CVE-2024-0516

CVE-2024-0516 refers to a vulnerability in the Royal Elementor Addons and Templates plugin for WordPress, where unauthenticated users can update certain post metadata due to a missing capability check in wpr_update_form_action_meta in all versions up to and including 1.3.87. The issue is supporte...

CVE-2024-1389

CVE-2024-1389 affects the WordPress plugin “Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction.” Root cause: missing capability check in pms_stripe_connect_handle_authorization_return, in all versions up to and including 2.11.1. Impact: unauthenticate...

CVE-2024-1317

The CVE-2024-1317 vulnerability affects the WordPress plugin RSS Aggregator by Feedzy (slug feedzy-rss-feeds). A SQL Injection exists in the search_key parameter for versions up to 4.4.2 due to insufficient escaping and improper use of prepare in a LIKE clause, allowing authenticated attackers wi...

CVE-2024-1336

CVE-2024-1336 refers to the ImageRecycle pdf & image compression WordPress plugin (versions

CVE-2024-0658

The CVE-2024-0658 entry concerns the WordPress Insert PHP Code Snippet plugin. A Stored Cross-Site Scripting (XSS) flaw in versions up to 1.3.4 arises from insufficient input sanitization and output escaping on the insert-php-code-snippet-manage page, allowing an authenticated administrator to in...

CVE-2024-0590

The CVE-2024-0590 entry concerns the Microsoft Clarity WordPress plugin (versions up to and including 0.9.3). It describes a Cross-Site Request Forgery (CSRF) vulnerability caused by missing nonce validation on the edit_clarity_project_id() function, enabling unauthenticated attackers to change t...

CVE-2024-1445

CVE-2024-1445 refers to the WordPress page-scroll-to-id plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) in the plugin’s shortcode attributes, affecting versions up to and including 1.7.8, caused by insufficient input sanitization and output escaping. Exploitation requires authent...

CVE-2024-1054

CVE-2024-1054 (Booster for WooCommerce, WordPress) is a Stored Cross-Site Scripting vulnerability in the Booster for WooCommerce plugin’s wcj_product_barcode shortcode. Exploitation requires authentication at contributor level or higher, and affects all versions up to 7.1.6. The issue stems from ...

CVE-2024-1335

The ImageRecycle pdf & image compression WordPress plugin (

CVE-2024-0702

CVE-2024-0702 concerns the Oliver POS plugin for WordPress. The issue is a missing capability check on several AJAX-hooked functions in includes/class-pos-bridge-install.php, affecting all versions up to and including 2.4.1.8. This design flaw allows authenticated users with subscriber-level acce...

CVE-2024-1206

WP Recipe Maker for WordPress (versions

CVE-2024-0514

CVE-2024-0514 : The WordPress plugin Royal Elementor Addons and Templates (versions

CVE-2024-1276

CVE-2024-1276 affects the WordPress plugin Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders. All versions up to and including 5.9.8 are vulnerable to a Stored XSS via the Content Ticker arrow attribute caused by insufficient input sanitization and ou...

CVE-2024-0515

CVE-2024-0515 involves the WordPress plugin Royal Elementor Addons and Templates (versions

CVE-2024-1070

CVE-2024-1070 concerns the SiteOrigin Widgets Bundle plugin for WordPress. It describes a Stored XSS via the features attribute in all versions up to 1.58.2 caused by insufficient input sanitization and output escaping. The vulnerability permits authenticated attackers with contributor+ privilege...

CVE-2024-1586

CVE-2024-1586 affects the WordPress plugin “Schema & Structured Data for WP & AMP”. All versions up to and including 1.26 are affected due to insufficient input sanitization and output escaping in the custom schema, enabling a stored XSS via authenticated access. By default, authentication is at ...

CVE-2024-1089

The CVE-2024-1089 issue affects ImageRecycle pdf & image compression for WordPress (versions

CVE-2024-1496

CVE-2024-1496 affects the WordPress plugin “Featured Image from URL (FIFU)”. The vulnerability is a Stored Cross-Site Scripting (XSS) via the fifu_input_url parameter, in all versions up to 4.6.2. With contributor+ privileges, an authenticated attacker can inject scripts that execute when users v...

CVE-2024-1235

The Elementor Addons by Livemesh WordPress plugin is affected by CVE-2024-1235, a Stored Cross‑Site Scripting (XSS) due to insufficient input sanitization/escaping in the custom class field. Affected versions are all up to 8.3.2; a fix was released in 8.3.3. Exploitation requires authenticated ac...

CVE-2024-1282

CVE-2024-1282 refers to the WordPress plugin “Email Encoder – Protect Email Addresses and Phone Numbers.” The vulnerability is a Stored Cross-Site Scripting (XSS) in which attacker-supplied attributes in the plugin’s shortcode can inject scripts. Affected versions are all until and including 2.2....