CVE-2024-10046 افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting

The افزونه پیامک ووکامرس Persian WooCommerce SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of removequeryarg without appropriate escaping on the URL in all versions up to, and including, 7.0.5. This makes it possible for unauthenticated attackers to injec...

CVE-2024-10516

CVE-2024-10516 is an active vulnerability affecting the Swift Performance Lite WordPress plugin. According to connected sources, versions up to and including 2.3.7.1 are vulnerable to an unauthenticated Local PHP File Inclusion via the ajaxify parameter, enabling arbitrary PHP code execution on t...

CVE-2024-10516 Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'

The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of...

CVE-2024-53811 WordPress WDesignKit plugin <= 1.0.40 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in POSIMYTH WDesignkit wdesignkit allows Upload a Web Shell to a Web Server.This issue affects WDesignkit: from n/a through = 1.0.40...

CVE-2024-10909

The The Pojo Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via formpreviewshortcode AJAX action in all versions up to, and including, 1.4.7. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2024-9872

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitasaveuserdatacallback function in all versions up to, and including, 4.5.1. This makes it possible for authenticated...

CVE-2024-12003

The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the generatewpsystempagecontent function. This makes it possible for unauthenticated attackers to inject malicious we...

CVE-2024-12028

The Friends plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to send arbitrary friend requests on behalf of another website,...

CVE-2024-10879

The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 2.1.2. This makes it possible for unauthenticated attackers to...

CVE-2024-10692

The PowerPack Elementor Addons Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 via the Content Reveal widget due to insufficient restrictions on which posts can be included. This makes it possible for...

CVE-2024-10689

CVE-2024-10689 pertains to XLTab – Accordions and Tabs for Elementor Page Builder (WordPress) versions up to 1.4, where an Information Exposure vulnerability allows authenticated attackers with Contributor-level access or higher to extract data from private or draft posts via the XLTAB_INSERT_TPL...

CVE-2024-11823

The Folder Gallery WordPress plugin (versions up to and including 1.7.4) is affected by an authenticated Stored Cross-Site Scripting (XSS) via the foldergallery shortcode. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, enabling a contributor+ at...

CVE-2024-11352

The CVE-2024-11352 entry concerns the TwentyTwenty WordPress plugin. It describes a Stored Cross-Site Scripting (XSS) vulnerability in the plugin’s twentytwenty shortcode, affecting all versions up to 1.0.1. exploitation requires authenticated access at contributor level or higher, enabling an at...

CVE-2024-9705 Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Template Name Update

The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ucsmupdatetemplatenamelite' function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with...

CVE-2024-11178

The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating too weak OTP, and there’s no attempt or time limit. This makes it possible for unauthenticated attackers to generate and brute force the...

CVE-2024-11178

CVE-2024-11178 affects the WordPress Login With OTP plugin. Versions

CVE-2024-9769

CVE-2024-9769 corresponds to the WordPress Video Gallery – YouTube Gallery plugin vulnerability: stored cross-site scripting via admin settings in all versions up to 2.4.1. Exploitation requires authenticated access with administrator-level permissions (and above) and is restricted to multisite i...

CVE-2024-11643 Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update

The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'AllAccessiblesavesettings' function in all versions up to, and including, 1.3.4. This makes it possible for...

CVE-2024-11897

The Contact Form, Survey & Form Builder – MightyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mightyforms' shortcode in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-11200

The Goodlayers Core WordPress plugin has a Reflected Cross-Site Scripting (font-family) in versions up to 2.0.7. It allows unauthenticated attackers to inject scripts in pages executed when a user clicks a crafted link. The vulnerability is marked as patched in the referenced sources; upgrading t...