Lucene search

K
wordfenceChloe ChamberlandWORDFENCE:24C6F8B10D5C1F04AE2A49212D04D8E5
HistoryMar 07, 2024 - 4:12 p.m.

Wordfence Intelligence Weekly WordPress Vulnerability Report (February 26, 2024 to March 3, 2024)

2024-03-0716:12:31
Chloe Chamberland
www.wordfence.com
37
wordfence
wordpress
vulnerabilities
plugins
themes
api
webhook
firewall
free
threat intelligence team

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

36.9%


🎉 Did you know we're running a Bug Bounty Extravaganza again?

Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!


Last week, there were 121 vulnerabilities disclosed in 88 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 44 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 14,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.


New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  • WAF-RULE-681 - Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.


Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 83
Unpatched 38

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 106
High Severity 12
Critical Severity 3

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 35
Missing Authorization 23
Cross-Site Request Forgery (CSRF) 21
Improper Access Control 9
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 6
Information Exposure 4
Protection Mechanism Failure 3
Server-Side Request Forgery (SSRF) 3
Incorrect Authorization 2
Authentication Bypass Using an Alternate Path or Channel 1
Authorization Bypass Through User-Controlled Key 1
Deserialization of Untrusted Data 1
Improper Control of Generation of Code ('Code Injection') 1
Improper Input Validation 1
Unrestricted Upload of File with Dangerous Type 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities

Francesco Carlucci

| 34

Krzysztof Zając

| 11

Lucio Sá

| 9

Webbernaut

| 6

Dimas Maulana

| 5

RandomRoot

| 5

wesley (wcraft)

| 4

LVT-tholv2k

| 3

Dmitrii Ignatyev

| 3

István Márton

| 2

Majed Refaea

| 2

Emili Castells

| 2

CatFather

| 2

Denis Werner

| 2

Akbar Kustirama

| 2

Marco Wotschka

| 2

Muhammad Zeeshan (Xib3rR4dAr)

| 2

Muhammad Hassham Nagori

| 1

Tobias Weißhaar (kun_19)

| 1

Asaf Mozes

| 1

rootxsudip

| 1

Hai Zheng

| 1

Richard Telleng (stueotue)

| 1

Rafshanzani Suhada

| 1

Fariq Fadillah Gusti Insani (fariqfgi)

| 1

Francisco Gutierrez

| 1

Joshua Chan

| 1

Ngô Thiên An (ancorn_)

| 1

Dau Hoang Tai

| 1

José Adán Hernández Flores

| 1

Steven Julian

| 1

Dikshita Trivedi (Cybersecdexter)

| 1

Benachi

| 1

Bassem Essam

| 1

Dragonim

| 1

suzuki kaito

| 1

Maksim Kosenko

| 1

Nikolas

| 1

Rafie Muhammad

| 1

Sh

| 1

Peng Zhou

| 1

Dynamic.ooo Team

| 1

Kunal Sharma

| 1

Akshay Kumar

| 1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.


WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Adsmonetizer adsensei-b30
Advanced iFrame advanced-iframe
AI Engine ai-engine
ArtiBot Free Chat Bot for WordPress WebSites artibot
AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth aweber-web-form-widget
Beaver Builder – WordPress Page Builder beaver-builder-lite-version
Booking for Appointments and Events Calendar – Amelia ameliabooking
Bulk Edit Post Titles bulk-edit-post-titles
Calculated Fields Form calculated-fields-form
Categorify – WordPress Media Library Category & File Manager categorify
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back chat-bubble
CodeMirror Blocks wp-codemirror-block
Coming Soon Page & Maintenance Mode responsive-coming-soon
Comments Extra Fields For Post,Pages and CPT wp-comment-fields
Complianz – GDPR/CCPA Cookie Consent complianz-gdpr
Configure SMTP configure-smtp
Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce enhanced-e-commerce-for-woocommerce-store
Custom Field Suite custom-field-suite
Custom fields shortcode custom-fields-shortcode
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan antihacker
Download Manager download-manager
Download Media download-media
Duitku Payment Gateway duitku-social-payment-gateway
Easy PayPal & Stripe Buy Now Button wp-ecommerce-paypal
Ebook Store ebook-store
Elementor Website Builder Pro elementor-pro
Envo's Elementor Templates & Widgets for WooCommerce envo-elementor-for-woocommerce
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates essential-blocks
Events Manager – Calendar, Bookings, Tickets, and more! events-manager
Exclusive Addons for Elementor exclusive-addons-for-elementor
Finale Lite – Sales Countdown Timer & Discount for WooCommerce finale-woocommerce-sales-countdown-timer-discount
Fontific Google Fonts
Friends friends
GenerateBlocks generateblocks
Gestpay for WooCommerce gestpay-for-woocommerce
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers rafflepress
Gutenberg Blocks by Kadence Blocks – Page Builder Features kadence-blocks
Image Optimizer, Resizer and CDN – Sirv sirv
Jeg Elementor Kit jeg-elementor-kit
LifterLMS – WordPress LMS Plugin for eLearning lifterlms
LiteSpeed Cache litespeed-cache
Login as User or Customer login-as-customer-or-user
MainWP Dashboard: WordPress Management without the SaaS mainwp
Marketing Optimizer marketing-optimizer
Master Slider – Responsive Touch Slider master-slider
Media Alt Renamer media-alt-renamer
Migration, Backup, Staging – WPvivid wpvivid-backuprestore
Nextend Social Login and Register nextend-facebook-connect
NextMove Lite – Thank You Page for WooCommerce woo-thank-you-page-nextmove-lite
NotificationX – Best FOMO, Social Proof, Custom & Live Sales Notification, WooCommerce Sales Popup, Floating & Sticky Notification Bar notificationx
Oliver POS – A WooCommerce Point of Sale (POS) oliver-pos
Orbit Fox by ThemeIsle themeisle-companion
Page Duplicator wp-page-duplicator
Page Restrict pagerestrict
Page Restriction WordPress (WP) – Protect WP Pages/Post page-and-post-restriction
PayU India – Official Plugin payu-india
postMash – custom post order postmash
Premium Addons for Elementor premium-addons-for-elementor
Profile Box Shortcode And Widget facebook-likebox-widget-and-shortcode
Redirects redirects
Responsive Pricing Table dk-pricr-responsive-pricing-table
Restaurant Solutions – Checklist restaurant-solutions-checklist
Restrict User Access – Ultimate Membership & Content Protection restrict-user-access
Rolo Slider rolo-slider
Seraphinite Accelerator seraphinite-accelerator
Simple Tweet simple-tweet
Slider Responsive Slideshow – Image slider, Gallery slideshow slider-responsive-slideshow
Slivery Extender slivery-extender
SMS Alert Order Notifications – WooCommerce sms-alert
SoundCloud Shortcode soundcloud-shortcode
Tainacan tainacan
Thank You Page Customizer for WooCommerce – Increase Your Sales woo-thank-you-page-customizer
Ultimate Bootstrap Elements for Elementor ultimate-bootstrap-elements-for-elementor
Under Construction / Maintenance Mode from Acurax coming-soon-maintenance-mode-from-acurax
User Shortcodes Plus user-shortcodes-plus
Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages visualcomposer
Watermark RELOADED watermark-reloaded
WooCommerce Coupon Popup, SmartBar, Slide In MyShopKit
WordPress Access Control wordpress-access-control
WP eCommerce wp-e-commerce
WP Private Content Plus wp-private-content-plus
WP Shortcodes Plugin — Shortcodes Ultimate shortcodes-ultimate
WP Show Posts wp-show-posts
Wp Social Login and Register Social Counter wp-social
WP Social Widget wp-social-widget
WPvivid Backup for MainWP wpvivid-backup-mainwp
蜜蜂采集-BeePress 微信公众号今日头条知乎专栏简书等平台文章采集插件 beepress

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Avada Website Builder For WordPress & WooCommerce
Yuki yuki

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you'd like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection

9.8

CVSS Rating
Critical (9.8)

CVE-ID
CVE-2024-1698

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
NotificationX – Best FOMO, Social Proof, Custom & Live Sales Notification, WooCommerce Sales Popup, Floating & Sticky Notification Bar

Researcher

Krzysztof Zając

More Details >

WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection

9.8

CVSS Rating
Critical (9.8)

CVE-ID
CVE-2024-1514

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
WP eCommerce

Researcher

Krzysztof Zając

More Details >

WPvivid Backup and Migration <= 0.9.68 - Unauthenticated SQL Injection

9.8

CVSS Rating
Critical (9.8)

CVE-ID
CVE-2024-1981

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Migration, Backup, Staging – WPvivid

Researcher

Denis Werner

More Details >

Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-1468

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Avada | Website Builder For WordPress & WooCommerce

Researcher

Muhammad Zeeshan (Xib3rR4dAr)

More Details >

Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce <= 7.0.6 - Authenticated (Subscriber+) SQL Injection

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-1203

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce

Researcher

Krzysztof Zając

More Details >

Conversios <= 7.0.6 - Authenticated (Subscriber+) SQL Injection via ee_syncProductCategory

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-0786

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce

Researcher

Maksim Kosenko

More Details >

Slider Responsive Slideshow – Image slider, Gallery slideshow <= 1.3.8 - Authenticated (Contributor+) PHP Object Injection

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-1859

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
Slider Responsive Slideshow – Image slider, Gallery slideshow

Researcher

Francesco Carlucci

More Details >

Slivery Extender <= 1.0.2 - Authenticated(Contributor+) Remote Code Execution via shortcode

8.8

CVSS Rating
High (8.8)

CVE-ID
CVE-2024-27191

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
Slivery Extender

Researcher

LVT-tholv2k

More Details >

Fontific | Google Fonts <= 0.1.6 - Cross-Site Request Forgery via ajax_fontific_save_all

8.2

CVSS Rating
High (8.2)

CVE-ID
CVE-2024-27194

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
Fontific | Google Fonts

Researcher

Dimas Maulana

More Details >

Watermark RELOADED <= 1.3.5 - Cross-Site Request Forgery via optionsPage

8.2

CVSS Rating
High (8.2)

CVE-ID
CVE-2024-27195

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
Watermark RELOADED

Researcher

Dimas Maulana

More Details >

Login as User or Customer <= 3.8 - Unauthenticated Limited Admin Account Compromise

8.1

CVSS Rating
High (8.1)

CVE-ID
CVE-2023-7247

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Login as User or Customer

Researcher

Dmitrii Ignatyev

More Details >

AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL Injection

7.2

CVSS Rating
High (7.2)

CVE-ID
CVE-2024-1793

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth

Researchers

Kunal Sharma

Akshay Kumar

More Details >

Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
High (7.2)

CVE-ID
CVE-2024-2020

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
Calculated Fields Form

Researcher

Asaf Mozes

More Details >

Giveaways and Contests by RafflePress <= 1.12.5 - Unauthenticated Stored Cross-Site Scripting

7.2

CVSS Rating
High (7.2)

CVE-ID
CVE-2024-1935

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers

Researcher

Krzysztof Zając

More Details >

LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'

7.2

CVSS Rating
High (7.2)

CVE-ID
CVE-2023-40000

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
LiteSpeed Cache

Researcher

Rafie Muhammad

More Details >

AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting

6.5

CVSS Rating
Medium (6.5)

CVE-ID
CVE-2024-0378

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
AI Engine

Researcher

rootxsudip

More Details >

Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries

6.5

CVSS Rating
Medium (6.5)

CVE-ID
CVE-2024-1668

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
Avada | Website Builder For WordPress & WooCommerce

Researcher

Muhammad Zeeshan (Xib3rR4dAr)

More Details >

BeePress <= 6.9.8 - Cross-Site Request Forgery via beepress-pro.php

6.5

CVSS Rating
Medium (6.5)

CVE-ID
CVE-2024-27197

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
蜜蜂采集-BeePress 微信公众号今日头条知乎专栏简书等平台文章采集插件

Researcher

Majed Refaea

More Details >

Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.51 - Missing Authorization to Unauthenticated IP Address Whitelist

6.5

CVSS Rating
Medium (6.5)

CVE-ID
CVE-2024-1860

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan

Researcher

Lucio Sá

More Details >

Redirects <= 1.2.1 - Missing Authorization via save

6.5

CVSS Rating
Medium (6.5)

CVE-ID
CVE-2024-1566

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Redirects

Researcher

Francesco Carlucci

More Details >

Rolo Slider <= 1.0.9 - Missing Authorization to Authenticated(Subscriber+) Settings Change

6.5

CVSS Rating
Medium (6.5)

CVE-ID
CVE-2024-1438

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
Rolo Slider

Researcher

Emili Castells

More Details >

Wp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status Update

6.5

CVSS Rating
Medium (6.5)

CVE-ID
CVE-2024-1763

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
Wp Social Login and Register Social Counter

Researcher

Krzysztof Zając

More Details >

WPvivid Backup and Migration <= 0.9.68 - Missing Authorization

6.5

CVSS Rating
Medium (6.5)

CVE-ID
CVE-2024-1982

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Migration, Backup, Staging – WPvivid

Researcher

Denis Werner

More Details >

Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1074

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Beaver Builder – WordPress Page Builder

Researcher

RandomRoot

More Details >

CodeMirror Blocks <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1791

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
CodeMirror Blocks

Researcher

RandomRoot

More Details >

Custom fields shortcode <= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2023-6809

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Custom fields shortcode

Researcher

Francesco Carlucci

More Details >

Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2023-6954

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Download Manager

Researcher

Richard Telleng (stueotue)

More Details >

Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1854

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates

Researchers

Ngô Thiên An (ancorn_)

Dau Hoang Tai

More Details >

Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1234

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
Exclusive Addons for Elementor

Researcher

Webbernaut

More Details >

Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1414

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
Exclusive Addons for Elementor

Researcher

wesley (wcraft)

More Details >

Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1413

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
Exclusive Addons for Elementor

Researcher

RandomRoot

More Details >

Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-2028

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
Exclusive Addons for Elementor

Researcher

Nikolas

More Details >

Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1541

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
Gutenberg Blocks by Kadence Blocks – Page Builder Features

Researcher

wesley (wcraft)

More Details >

Image Optimizer, Resizer and CDN – Sirv <= 7.2.0 - Authenticated (Subscriber+) Server-Side Request Forgery

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-27949

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
Image Optimizer, Resizer and CDN – Sirv

Researcher

CatFather

More Details >

Jeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1326

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Jeg Elementor Kit

Researcher

RandomRoot

More Details >

Master Slider – Responsive Touch Slider <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1449

Patch Status
Unpatched

Published
Mar 1, 2024

Affected Software
Master Slider – Responsive Touch Slider

Researcher

Bassem Essam

More Details >

Media Alt Renamer 0.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via _wp_attachment_image_alt postmeta

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1434

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
Media Alt Renamer

Researcher

Joshua Chan

More Details >

Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1323

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Orbit Fox by ThemeIsle

Researcher

Webbernaut

More Details >

Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1499

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Orbit Fox by ThemeIsle

Researcher

RandomRoot

More Details >

Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1497

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Orbit Fox by ThemeIsle

Researcher

wesley (wcraft)

More Details >

Premium Addons for Elementor <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1680

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Premium Addons for Elementor

Researcher

Webbernaut

More Details >

Responsive Pricing Table <= 5.1.10 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1333

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Responsive Pricing Table

Researcher

Dmitrii Ignatyev

More Details >

Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1568

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Seraphinite Accelerator

Researcher

Lucio Sá

More Details >

Simple Tweet <= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-0700

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Simple Tweet

Researcher

Benachi

More Details >

SoundCloud Shortcode <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-25936

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
SoundCloud Shortcode

Researcher

LVT-tholv2k

More Details >

Ultimate Bootstrap Elements for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1398

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
Ultimate Bootstrap Elements for Elementor

Researcher

István Márton

More Details >

Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2023-6880

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages

Researcher

Francesco Carlucci

More Details >

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-1808

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
WP Shortcodes Plugin — Shortcodes Ultimate

Researcher

Webbernaut

More Details >

WP Social Widget <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

6.4

CVSS Rating
Medium (6.4)

CVE-ID
CVE-2024-27189

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
WP Social Widget

Researcher

LVT-tholv2k

More Details >

Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.1.8 - Cross-Site Request Forgery

6.3

CVSS Rating
Medium (6.3)

CVE-ID
CVE-2024-1954

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Oliver POS – A WooCommerce Point of Sale (POS)

Researcher

Francesco Carlucci

More Details >

Adsmonetizer <= 3.1.2 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-1437

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
Adsmonetizer

Researcher

Majed Refaea

More Details >

Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-1484

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
Booking for Appointments and Events Calendar – Amelia

Researcher

Muhammad Hassham Nagori

More Details >

Configure SMTP <= 3.1 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-27192

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
Configure SMTP

Researcher

Dimas Maulana

More Details >

PayU India <= 3.8.2 - Reflected Cross-Site Scripting via type

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-27193

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
PayU India – Official Plugin

Researcher

Dimas Maulana

More Details >

postMash – custom post order <= 1.2.0 - Reflected Cross-Site Scripting via m

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-27196

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
postMash – custom post order

Researcher

Dimas Maulana

More Details >

WPvivid Backup for MainWP <= 0.9.32 - Reflected Cross-Site Scripting

6.1

CVSS Rating
Medium (6.1)

CVE-ID
CVE-2024-1383

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
WPvivid Backup for MainWP

Researcher

Krzysztof Zając

More Details >

Friends <= 2.8.5 - Authenticated (Admin+) Blind Server-Side Request Forgery

5.5

CVSS Rating
Medium (5.5)

CVE-ID
CVE-2024-1978

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Friends

Researcher

Francisco Gutierrez

More Details >

Master Slider - Responsive Touch Slider <= 3.9.5 - Cross-Site Request Forgery via process_bulk_action

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2023-6326

Patch Status
Unpatched

Published
Mar 1, 2024

Affected Software
Master Slider – Responsive Touch Slider

Researcher

Rafshanzani Suhada

More Details >

Nextend Social Login and Register <= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error_description

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2024-1775

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
Nextend Social Login and Register

Researcher

Tobias Weißhaar (kun_19)

More Details >

Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution

5.4

CVSS Rating
Medium (5.4)

CVE-ID
CVE-2024-1687

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Thank You Page Customizer for WooCommerce – Increase Your Sales

Researcher

Lucio Sá

More Details >

Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypass

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1136

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Coming Soon Page & Maintenance Mode

Researcher

Lucio Sá

More Details >

Download Manager <= 3.2.84 - Missing Authorization

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2023-6785

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Download Manager

Researcher

wesley (wcraft)

More Details >

Duitku Payment Gateway <= 2.11.4 - Missing Authorization via check_duitku_response

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-0631

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
Duitku Payment Gateway

Researcher

Francesco Carlucci

More Details >

LifterLMS – WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_review

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-0377

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
LifterLMS – WordPress LMS Plugin for eLearning

Researcher

Francesco Carlucci

More Details >

LiteSpeed Cache <= 5.7 - Missing Authorization via update_cdn_status

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2023-45000

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
LiteSpeed Cache

Researcher

Hai Zheng

More Details >

NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1120

Patch Status
Patched

Published
Feb 29, 2024

Affected Software
NextMove Lite – Thank You Page for WooCommerce
Finale Lite – Sales Countdown Timer & Discount for WooCommerce

Researcher

Francesco Carlucci

More Details >

Page Duplicator <= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplication

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1368

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Page Duplicator

Researcher

Lucio Sá

More Details >

Page Restrict <= 2.5.5 - Protection Mechanism Bypass

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-0682

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Page Restrict

Researcher

Francesco Carlucci

More Details >

Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypass

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-0681

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Page Restriction WordPress (WP) – Protect WP Pages/Post

Researcher

Francesco Carlucci

More Details >

Restrict User Access – Ultimate Membership & Content Protection <= 2.5 - Information Exposure

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-0687

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Restrict User Access – Ultimate Membership & Content Protection

Researcher

Francesco Carlucci

More Details >

Tainacan <= 0.20.6 - Unauthenticated Sensitive Information Exposure

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1435

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Tainacan

Researcher

Peng Zhou

More Details >

Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1686

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Thank You Page Customizer for WooCommerce – Increase Your Sales

Researcher

Lucio Sá

More Details >

Under Construction / Maintenance Mode from Acurax <= 2.6 - Information Exposure

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1476

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Under Construction / Maintenance Mode from Acurax

Researcher

Francesco Carlucci

More Details >

User Shortcodes Plus <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via user_meta Shortcode

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2023-6969

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
User Shortcodes Plus

Researcher

Francesco Carlucci

More Details >

WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit <= 1.0.9 - Unauthenticated Sensitive Information Exposure

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1436

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit

Researcher

Emili Castells

More Details >

WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-0975

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
WordPress Access Control

Researcher

Francesco Carlucci

More Details >

WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1516

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
WP eCommerce

Researcher

Krzysztof Zając

More Details >

WP Private Content Plus <= 3.6 - Protection Mechanism Bypass

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-0680

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
WP Private Content Plus

Researcher

Francesco Carlucci

More Details >

WP Show Posts <= 1.1.4 - Information Exposure

5.3

CVSS Rating
Medium (5.3)

CVE-ID
CVE-2024-1479

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
WP Show Posts

Researcher

Webbernaut

More Details >

ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Missing Authorization to Settings Update

5.0

CVSS Rating
Medium (5.0)

CVE-ID
CVE-2024-0447

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
ArtiBot Free Chat Bot for WordPress WebSites

Researcher

Francesco Carlucci

More Details >

Advanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

4.9

CVSS Rating
Medium (4.9)

CVE-ID
CVE-2024-1341

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Advanced iFrame

Researcher

Fariq Fadillah Gusti Insani (fariqfgi)

More Details >

ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Authenticated (Admin+) Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-0449

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
ArtiBot Free Chat Bot for WordPress WebSites

Researcher

Francesco Carlucci

More Details >

Chat Bubble <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-0898

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back

Researcher

Dikshita Trivedi (Cybersecdexter)

More Details >

Custom Field Suite <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-0689

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Custom Field Suite

Researcher

Sh

More Details >

Ebook Store <= 5.8001 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-23501

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
Ebook Store

Researcher

Dragonim

More Details >

Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-0614

Patch Status
Patched

Published
Feb 28, 2024

Affected Software
Events Manager – Calendar, Bookings, Tickets, and more!

Researcher

Akbar Kustirama

More Details >

Master Slider – Responsive Touch Slider < 3.9.5 - Authenticated(Editor+) Stored Cross-Site Scripting via slider callback

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-0611

Patch Status
Unpatched

Published
Mar 1, 2024

Affected Software
Master Slider – Responsive Touch Slider

Researcher

Akbar Kustirama

More Details >

Profile Box Shortcode And Widget <= 1.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-1401

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Profile Box Shortcode And Widget

Researcher

Dmitrii Ignatyev

More Details >

Restaurant Solutions – Checklist 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVSS Rating
Medium (4.4)

CVE-ID
CVE-2024-1977

Patch Status
Unpatched

Published
Feb 28, 2024

Affected Software
Restaurant Solutions – Checklist

Researcher

José Adán Hernández Flores

More Details >

Bulk Edit Post Titles <= 5.0.0 - Missing Authorization via bulkUpdatePostTitles

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0369

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
Bulk Edit Post Titles

Researcher

Francesco Carlucci

More Details >

Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxAddCategory

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1906

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Categorify – WordPress Media Library Category & File Manager

Researcher

Francesco Carlucci

More Details >

Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxClearCategory

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1910

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Categorify – WordPress Media Library Category & File Manager

Researcher

Francesco Carlucci

More Details >

Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategory

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1907

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Categorify – WordPress Media Library Category & File Manager

Researcher

Francesco Carlucci

More Details >

Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategory

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1909

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Categorify – WordPress Media Library Category & File Manager

Researcher

Francesco Carlucci

More Details >

Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1912

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Categorify – WordPress Media Library Category & File Manager

Researcher

Francesco Carlucci

More Details >

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategory

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0385

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Categorify – WordPress Media Library Category & File Manager

Researcher

Francesco Carlucci

More Details >

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1652

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Categorify – WordPress Media Library Category & File Manager

Researcher

Francesco Carlucci

More Details >

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1649

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Categorify – WordPress Media Library Category & File Manager

Researcher

Francesco Carlucci

More Details >

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1650

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Categorify – WordPress Media Library Category & File Manager

Researcher

Francesco Carlucci

More Details >

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1653

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Categorify – WordPress Media Library Category & File Manager

Researcher

Francesco Carlucci

More Details >

Comments Extra Fields For Post,Pages and CPT <= 5.0 - Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0830

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Comments Extra Fields For Post,Pages and CPT

Researcher

Francesco Carlucci

More Details >

Comments Extra Fields For Post,Pages and CPT <= 5.0 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0829

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Comments Extra Fields For Post,Pages and CPT

Researcher

Francesco Carlucci

More Details >

Complianz – GDPR/CCPA Cookie Consent <= 6.5.6 - Cross-Site Request Forgery to Data Request Deletion

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1592

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
Complianz – GDPR/CCPA Cookie Consent

Researcher

Krzysztof Zając

More Details >

Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncation

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1861

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan

Researcher

Lucio Sá

More Details >

Download Media <= 1.4.2 - Missing Authorization via generate_link_for_media

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-27190

Patch Status
Unpatched

Published
Feb 26, 2024

Affected Software
Download Media

Researcher

Steven Julian

More Details >

Easy PayPal & Stripe Buy Now Button <= 1.8.3 & Contact Form 7 – PayPal & Stripe Add-on <= 2.1 - Cross-Site Request Forgery to Settings Update

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1719

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Easy PayPal & Stripe Buy Now Button
Contact Form 7 – PayPal & Stripe Add-on

Researcher

Krzysztof Zając

More Details >

Elementor Pro <= 3.19.2 - Authenticated (Contributor+) Information Exposure

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-23523

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Elementor Website Builder Pro

Researcher

Dynamic.ooo Team

More Details >

Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activation

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0767

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Envo's Elementor Templates & Widgets for WooCommerce

Researcher

Marco Wotschka

More Details >

Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activation

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0768

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Envo's Elementor Templates & Widgets for WooCommerce

Researcher

Marco Wotschka

More Details >

Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_request

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0766

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Envo's Elementor Templates & Widgets for WooCommerce

Researcher

Francesco Carlucci

More Details >

GenerateBlocks <= 1.8.2 - Sensitive Information Exposure

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1452

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
GenerateBlocks

Researcher

Webbernaut

More Details >

Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_delete_card

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0432

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Gestpay for WooCommerce

Researcher

Francesco Carlucci

More Details >

Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_set_default_card

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0431

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
Gestpay for WooCommerce

Researcher

Francesco Carlucci

More Details >

Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_unset_default_card

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-0433

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Gestpay for WooCommerce

Researcher

Francesco Carlucci

More Details >

Image Optimizer, Resizer and CDN – Sirv <= 7.2.0 - Missing Authorization

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-27950

Patch Status
Patched

Published
Mar 1, 2024

Affected Software
Image Optimizer, Resizer and CDN – Sirv

Researcher

CatFather

More Details >

MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1642

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
MainWP Dashboard: WordPress Management without the SaaS

Researcher

Krzysztof Zając

More Details >

Marketing Optimizer <= 20200925 - Cross-Site Request Forgery to Stored Cross-Site Scripting

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1976

Patch Status
Unpatched

Published
Feb 28, 2024

Affected Software
Marketing Optimizer

Researcher

suzuki kaito

More Details >

SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1489

Patch Status
Patched

Published
Feb 26, 2024

Affected Software
SMS Alert Order Notifications – WooCommerce

Researcher

Krzysztof Zając

More Details >

Under Construction / Maintenance Mode from Acurax <= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2023-6922

Patch Status
Unpatched

Published
Feb 27, 2024

Affected Software
Under Construction / Maintenance Mode from Acurax

Researcher

István Márton

More Details >

Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1388

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Yuki

Researcher

Lucio Sá

More Details >

Yuki <= 1.3.14 - Cross-Site Request Forgery to Theme Setting Reset

4.3

CVSS Rating
Medium (4.3)

CVE-ID
CVE-2024-1943

Patch Status
Patched

Published
Feb 27, 2024

Affected Software
Yuki

Researcher

Lucio Sá

More Details >


As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (February 26, 2024 to March 3, 2024) appeared first on Wordfence.

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

36.9%

Related for WORDFENCE:24C6F8B10D5C1F04AE2A49212D04D8E5