Wordfence Intelligence Weekly WordPress Vulnerability Report (June 24, 2024 to June 30, 2024)

🗓️ 03 Jul 2024 15:31:12Reported by Chloe ChamberlandType

Wordfence Intelligence Weekly WordPress Vulnerability Report (June 24, 2024 to June 30, 2024). 121 vulnerabilities disclosed in 99 WordPress Plugins, 20 Themes, and WordPress Core. High risk issues in-scope for researchers. Free access to vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner

Reporter	Title	Published	Views	Family All 1358
zdt	WordPress PayPlus Payment Gateway SQL Injection Exploit	7 Aug 202400:00	–	zdt
Patchstack	WordPress Striking theme <= 2.3.4 - Local File Inclusion vulnerability	27 Jun 202411:36	–	patchstack
Patchstack	WordPress Login with phone number Plugin <= 1.7.35 is vulnerable to Cross Site Scripting (XSS)	28 Jun 202400:00	–	patchstack
Patchstack	WordPress Portfolio Gallery – Image Gallery Plugin plugin <= 1.6.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability	27 Jun 202408:30	–	patchstack
Patchstack	WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability	28 Jun 202408:18	–	patchstack
Patchstack	WordPress Floating Social Buttons plugin <= 1.5 - Cross-Site Request Forgery vulnerability	1 Jul 202406:45	–	patchstack
Patchstack	WordPress OnePress theme <= 2.3.6 - Cross Site Request Forgery (CSRF) vulnerability	28 Jun 202414:25	–	patchstack
Patchstack	WordPress Striking Theme <= 2.3.4 is vulnerable to Local File Inclusion	27 Jun 202400:00	–	patchstack
Patchstack	WordPress WordPress Plugin for Google Maps plugin <= 4.6.1 - Authenticated (Contributor+) SQL Injection vulnerability	1 Jul 202403:53	–	patchstack
Patchstack	WordPress Elegant Pink Theme <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)	28 Jun 202400:00	–	patchstack

03 Jul 2024 15:31Current

9.4High risk

Vulners AI Score9.4

CVSS 3.110

EPSS0.11755

SSVC