CVE-2024-12127

The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 0.0.21 due to insufficient input sanitization and output escaping. This...

CVE-2024-12024

CVE-2024-12024 : EventPrime – Events Calendar, Bookings and Tickets (WordPress) is vulnerable to Stored Cross-Site Scripting via em_ticket_category_data and em_ticket_individual_data in all versions up to and including 4.0.5.3. Exploitation requires the Guest Submissions setting to be enabled. If...

CVE-2024-54257

CVE-2024-54257 is a Reflected XSS vulnerability in the WordPress tydskrif theme (versions

CVE-2024-37251 WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPENGINE, INC. Advanced Custom Fields PRO.This issue affects Advanced Custom Fields PRO: from n/a before 6.3.2...

CVE-2024-55981 WordPress Nabz Image Gallery plugin <= v1.00 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Nabajit Roy Nabz Image Gallery allows SQL Injection.This issue affects Nabz Image Gallery: from n/a through v1.00...

CVE-2024-54389

CVE-2024-54389 (addWeather) is documented as a Cross-Site Request Forgery to Stored Cross-Site Scripting issue affecting addWeather versions up to 2.5.1. The Red Hat/Wordfence records corroborate the CSRF-to-XSS chain and list the vulnerability as currently unpatched. Affected software: addWeathe...

CVE-2024-54400 WordPress AppMaps plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in MELONIQ.NET AppMaps allows Stored XSS.This issue affects AppMaps: from n/a through 1.1...

CVE-2024-54420

CVE-2024-54420 documents confirm a CSRF vulnerability in the WordPress plugin Metrika (Aleksander Novikov) that can enable a stored Cross‑Site Scripting (XSS) condition. Affected software is listed as Metrika up to version 1.2 . The connected sources explicitly describe the issue type and affecte...

CVE-2024-10690

The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.4 via the 'SHORTCODEELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with...

CVE-2024-11752

CVE-2024-11752 affects the WordPress Eveeno plugin. The vulnerability is a Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin’s eveeno shortcode. It applies to all versions up to and including 1.7. Exploitation re...

CVE-2024-11865 Tabs Maker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Tabs Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on tab descriptions. This makes it possible for authenticated attackers, with contributor-level access and above, to...

CVE-2024-54324 WordPress SMSify plugin <= 6.0.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Cloud Inn SMSify allows Reflected XSS.This issue affects SMSify: from n/a through 6.0.4...

CVE-2024-54282 WordPress WP Mega Menu plugin <= 1.4.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu wp-megamenu allows Object Injection.This issue affects WP Mega Menu: from n/a through = 1.4.2...

CVE-2023-38385 WordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerability

Missing Authorization vulnerability in artbees JupiterX Core jupiterx-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JupiterX Core: from n/a through 3.0.0-3.3.0...

CVE-2023-36518 WordPress Post Hit Counter plugin <= 1.3.2 - Broken Access Control

Missing Authorization vulnerability in Hugh Lashbrooke Post Hit Counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Hit Counter: from n/a through 1.3.2...

CVE-2023-35052 WordPress Directorist plugin <= 7.5.4 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in wpWax - WP Business Directory Plugin and Classified Listings Directory Directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through 7.5.4...

CVE-2024-9608 MyParcel <= 4.24.1 - Reflected Cross-Site Scripting

The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 4.24.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-11012 Notibar – Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text

The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njtnofitext AJAX action in all versions up to, and including, 2.1.4. This is due to the software allowing users to execute an action that does not properly validate a value...

Wordfence Intelligence Weekly WordPress Vulnerability Report (December 2, 2024 to December 8, 2024)

Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with ourEnd of Year Holiday Extravaganza , High-Risk Bonus Blitz Challenge , and Superhero Challenge for the Wordfence Bug Bounty Program. Through January 6th, 2025: All in-scope vulnerability types for...

CVE-2024-12201 Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, ...