CVE-2024-0428

CVE-2024-0428 concerns the WordPress plugin Index Now. A CSRF vulnerability exists in all versions up to 2.6.3 caused by missing or improper nonce validation in the reset_form function, enabling unauthenticated attackers to delete arbitrary site options via a forged request if a site admin is tri...

CVE-2024-0366

CVE-2024-0366 affects WordPress plugin Starbox – the Author Box for Humans. It is an Insecure Direct Object Reference (IDOR) via an action function caused by missing validation on a user-controlled key, affecting all versions up to 3.4.7. Impact: subscribers could view plugin preferences and pote...

CVE-2024-0586

The CVE-2024-0586 entry concerns the WordPress plugin Essential Addons for Elementor (WPDeveloper) up to version 5.9.4, vulnerable to Stored Cross-Site Scripting via the Login/Register element due to insufficient input sanitization and output escaping on the custom login URL. The vulnerability pe...

CVE-2023-4637

CVE-2023-4637 affects the WPvivid Backup and Migration WordPress plugin. A missing capability check in restore() and get_restore_progress() in versions up to 0.9.94 allows unauthenticated attackers with a backup ID to invoke these functions and obtain full file paths, exposing Information Exposur...

CVE-2024-0709

CVE-2024-0709 affects the WordPress plugin Cryptocurrency Widgets – Price Ticker & Coins List (versions 2.0–2.6.5). The vulnerability is an unauthenticated SQL injection in the coinslist parameter caused by insufficient escaping and lack of proper SQL query preparation, allowing an attacker to ap...

CVE-2023-6953

CVE-2023-6953: The PDF Generator For Fluent Forms – The Contact Form Plugin (WordPress) is vulnerable to Stored XSS via header, PDF body, and footer content in all versions up to 1.1.7 due to insufficient input sanitization and output escaping. Affected versions are

CVE-2024-1208

The CVE-2024-1208 family concerns the LearnDash LMS WordPress plugin. Affected: LearnDash LMS plugin for WordPress; vulnerability: Sensitive Information Exposure via the API that could allow unauthenticated access to quiz questions. Documented impact includes access to quiz questions and related ...

CVE-2023-6808

CVE-2023-6808 affects the WordPress plugin “Booking for Appointments and Events Calendar – Amelia.” The issue is stored cross-site scripting via the plugin’s shortcode attributes due to insufficient input sanitization and output escaping on user-supplied data. It can allow authenticated attackers...

CVE-2024-0597

CVE-2024-0597 concerns the WordPress plugin SEO Plugin by Squirrly SEO. It enables a stored cross-site scripting (XSS) attack via administrator settings in versions up to 12.3.15, requiring an administrative (or higher) privilege and affecting multisite deployments or sites where unfiltered_html ...

CVE-2024-0630

CVE-2024-0630 affects the WP RSS Aggregator plugin for WordPress (versions ≤ 4.23.4). It is a stored Cross-Site Scripting vulnerability via the RSS feed source caused by insufficient input sanitization and output escaping. Exploitation requires administrator-level access and it affects multisite ...

CVE-2024-0954

The CVE-2024-0954 entry concerns the WordPress plugin Essential Addons for Elementor (WPDeveloper). A Stored Cross-Site Scripting vulnerability exists in the editing context via the data-eael-wrapper-link wrapper, affecting all versions up to and including 5.9.7 due to insufficient input sanitiza...

CVE-2024-1046

ProfilePress for WordPress (WordPress plugin) is affected by CVE-2024-1046: stored cross-site scripting via the reg-number-field shortcode. The vulnerability exists in all versions up to and including 4.14.3 due to insufficient input sanitization and output escaping on user-supplied attributes. A...

CVE-2024-1121

CVE-2024-1121 concerns the WordPress plugin Advanced Forms for ACF . The issue is a missing capability check in the function export_json_file(), affecting all versions up to and including 1.9.3.2, enabling unauthenticated attackers to export form settings (unauthorized data access). Public source...

CVE-2024-1075

CVE-2024-1075 affects the WordPress plugin Minimal Coming Soon – Coming Soon Page . The flaw permits unauthenticated maintenance mode bypass and information disclosure due to improper validation of the request path, affecting versions up to and including 2.37. The issue has been acknowledged by m...

CVE-2024-0678

The CVE-2024-0678 entry concerns the WordPress plugin Order Delivery Date for WP e-Commerce. The vulnerability is a Stored Cross-Site Scripting (XSS) in the available-days-tf parameter, affecting all versions up to 1.2. Root cause: insufficient input sanitization and output escaping. Impact: unau...

CVE-2024-0384

The CVE-2024-0384 vulnerability affects the WP Recipe Maker plugin for WordPress, where Stored Cross-Site Scripting is possible via Recipe Notes in all versions up to 9.1.0 due to insufficient input sanitization and output escaping. Authentication requirement is at contributor level or higher, en...

CVE-2024-0961

CVE-2024-0961 : The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the code editor in all versions up to 1.58.1 due to insufficient input sanitization and output escaping. The issue allows authenticated attackers with contributor+ privileges to inj...

CVE-2024-1209

CVE-2024-1209 affects LearnDash LMS for WordPress. Affected versions are all releases up to and including 4.10.1, where direct file access and insufficient protection of uploaded assignments allow unauthenticated access to sensitive uploads, constituting Sensitive Information Exposure. The issue ...

CVE-2024-0834

CVE-2024-0834 affects the WordPress plugin Elementor Addon Elements (versions

CVE-2024-0509

CVE-2024-0509 concerns the WordPress plugin WP 404 Auto Redirect to Similar Post . The vulnerability is a Reflected Cross-Site Scripting (XSS) via the vulnerable parameter named “request” in all versions up to and including 1.0.3, caused by insufficient input sanitization and output escaping. Imp...