CVE-2024-1177

CVE-2024-1177 concerns the WP Club Manager WordPress plugin. Multiple connected sources confirm a missing capability check in settings_save() across versions up to and including 2.2.10, causing unauthorized modification of data by unauthenticated users and allowing updates to the clubs permalink ...

CVE-2024-0835

CVE-2024-0835 affects the Royal Elementor Kit theme for WordPress. A missing capability check in the dismissed_handler function (versions up to and including 1.0.116) allows authenticated attackers with subscriber access or higher to update transients to true. Impact is limited to transients; no ...

CVE-2023-7014

CVE-2023-7014 affects the WordPress plugin Molongui Authorship (Author Box, Guest Author, Co-Authors). The root cause is information exposure via the ma_debu parameter, enabling unauthenticated attackers to retrieve sensitive data (post author emails and names) for all versions up to and includin...

CVE-2024-0255

CVE-2024-0255 refers to a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker WordPress plugin. The flaw exists in the wprm-recipe-text-share shortcode when handling user-supplied attributes, affecting all versions up to and including 9.1.0. Exploitation requires authenticated ...

CVE-2024-0691

The CVE-2024-0691 entry affects the WordPress FileBird plugin. Vulnerable component: imported folder titles handling in FileBird versions up to 5.5.8.1. Root cause: insufficient input sanitization and output escaping, enabling Stored Cross-Site Scripting. Impact: authenticated administrators can ...

CVE-2024-0796

CVE-2024-0796: Active Products Tables for WooCommerce (Profit–Products–Tables for WooCommerce) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation on AJAX actions. Affected versions are up to and including 1.0.6.1; exploitation requires an unauthenticated attacke...

CVE-2023-6635

The CVE-2023-6635 entry concerns the WordPress EditorsKit plugin. Affected component: the import_styles function. Root cause: missing file type validation allows an authenticated administrator to upload arbitrary files to the site server, potentially enabling remote code execution. Affected versi...

CVE-2023-6700

CVE-2023-6700 affects the WordPress plugin Cookie Information | Free GDPR Consent Solution (wp-gdpr-compliance) , with versions ≤ 2.0.22 vulnerable due to a missing capability check in the AJAX handler. This allows authenticated attackers (subscriber-level or higher) to arbitrarily update site op...

CVE-2024-0585

CVE-2024-0585 concerns the WordPress plugin Essential Addons for Elementor – Lite/Pro (Best Elementor Templates, Widgets, Kits & WooCommerce Builders). It describes a Stored Cross-Site Scripting (XSS) flaw in the plugin’s Filterable Gallery widget caused by insufficient input sanitization and out...

CVE-2024-0221

CVE-2024-0221 affects the WordPress plugin Photo Gallery by 10Web – Mobile-Friendly Image Gallery (

CVE-2023-6982

CVE-2023-6982 affects the WordPress plugin Display custom fields in the frontend – Post and User Profile Fields (shortcode-to-display-post-and-user-data). It is a stored XSS flaw caused by insufficient input sanitization/output escaping on user-supplied attributes in shortcode/postmeta, exploitab...

CVE-2024-0823

CVE-2024-0823 affects the WordPress plugin Exclusive Addons for Elementor. A stored XSS flaw exists in carousels via the Link To URL in versions

CVE-2024-0372

CVE-2024-0372 affects the WordPress plugin Views for WPForms Lite up to version 3.2.2, with a missing authorization check in get_form_fields that allows authenticated users with subscriber+ role to create or view form data. The issue is rooted in an improper permission check for the get_form_fiel...

CVE-2023-6526

CVE-2023-6526 affects the WordPress plugin Meta Box – WordPress Custom Fields Framework . The vulnerability is a Stored Cross-Site Scripting (XSS) via custom post meta values rendered by the plugin’s shortcode, present in all versions up to and including 5.9.2. The root cause is insufficient inpu...

CVE-2024-0382

WP Recipe Maker for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 9.1.0 due to unrestricted use of the header_tag attribute. The root cause is the header_tag attribute allowing injection of scripts by authenticated users with contributor-level permissions or higher. A f...

CVE-2024-0659

CVE-2024-0659 : The Easy Digital Downloads – Sell Digital Files plugin (WordPress) is vulnerable to stored XSS via the variable pricing option title in all versions ≤ 3.2.6 due to insufficient input sanitization and output escaping. Exploitation requires shop manager-level authentication and coul...

CVE-2024-0761

CVE-2024-0761 affects the WordPress File Manager plugin. Affected versions include all up to 7.2.1, with a root cause of insufficient randomness in backup filenames (timestamp + 4 random digits). This enables unauthenticated attackers to disclose sensitive data, such as site backups, particularly...

CVE-2024-0869

CVE-2024-0869 – Normal (concrete details available) Affected software: Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels, WordPress plugin (versions up to and including 6.1.0). Root cause: An insufficient validation on the plugin’s instant-images/license REST A...

CVE-2024-0254

CVE-2024-0254 affects the WordPress plugin (Simply) Guest Author Name, vulnerable up to version 4.34 due to insufficient input sanitization and output escaping in post meta. This enables stored cross-site scripting by authenticated users with contributor-level permissions (or higher) and page loa...

CVE-2024-0699

CVE-2024-0699 affects the WordPress plugin “AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!” up to version 2.1.4. The vulnerability is an arbitrary file upload flaw caused by missing file type validation in add_image_from_url, exploitable by authenticated attackers with Editor access...