Skip to contentWordpress vulnerabilities
Newest
- harmr leaflet maps marker (google maps, openstreetmap, bing maps), wordpress leaflet maps marker +1 moreLeaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) <= 3.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2024-36706.4 Medium
- hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 moreShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _idCVE-2024-39916.4 Medium
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style'CVE-2024-36476.4 Medium
- jegtheme jeg elementor kit, jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpress +1 moreJeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown WidgetCVE-2024-31616.4 Medium
- amaa acf on-the-go, wordpress acf-on-the-go +1 moreACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content UpdateCVE-2024-30714.3 Medium
- justin tadlock unique, wordpress unique theme +1 moreWordPress Unique theme <= 0.3.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-339526.5 Medium
- jordy meow wp media cleaner, wordpress media cleaner +1 moreWordPress WP Media Cleaner plugin <= 6.7.2 - Sensitive Data Exposure via Log File vulnerabilityCVE-2024-339225.3 Medium
- bootstrapped wp recipe maker, wordpress recipe maker +1 moreWP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item ShortcodeCVE-2024-34906.4 Medium
- unknown counter boxCounter Box < 1.2.4 - Counter Deletion via CSRFCVE-2024-34815.2 Medium
- infinitum form geo controllerWordPress Geo Controller < 8.6.5 - PHP Object InjectionCVE-2024-35916.5 Medium
- unknown leadconnectorLeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post DeletionCVE-2024-13716.5 Medium
- tyche softwares payment gateway based fees and discounts for woocommerceWordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 2.12.1 - Broken Access Control vulnerabilityCVE-2024-335854.3 Medium
- n-media orderconvoWordPress OrderConvo plugin <= 12.4 - Unauthenticated API Access to Arbitrary File Upload vulnerabilityCVE-2024-3356610.0 Critical
- 8theme xstore coreWordPress XStore Core plugin <= 5.3.5 - Unauthenticated SQL Injection vulnerabilityCVE-2024-335519.3 Critical
- 10web form maker by 10web – mobile-friendly drag & drop contact form builder, form maker, wordpress form maker by 10web +2 moreForm Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site ScriptingCVE-2024-22584.4 Medium
- extend themes teluro, wordpress teluro theme +1 moreWordPress Teluro theme <= 1.0.31 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-336884.3 Medium
- implecode reviews plusWordPress Reviews Plus plugin <= 1.3.4 - Broken Access Control vulnerabilityCVE-2024-328224.3 Medium
- cookie information a/s wp gdpr compliance, wordpress gdpr compliance +1 moreWordPress WP GDPR Compliance plugin <= 2.0.23 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-336825.4 Medium
- unknown enl newsletter, enl newsletter plugin project enl-newsletter +1 moreENL Newsletter <= 1.0.1 - Admin+ SQL InjectionCVE-2024-30604.5 Medium
- jgwhite33 wp google review sliderWP Google Review Slider < 13.6 - Admin+ Stored XSSCVE-2024-23105.9 Medium
- simple-membership-plugin simple membershipSimple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2024-37305.4 Medium
- themeum tutor lms – elearning and online course solution, tutor lms, wordpress tutor lms elearning and online course solution +2 moreTutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' ShortcodeCVE-2024-39945.4 Medium
- shaonsina sina extension for elementorSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting…CVE-2024-39886.4 Medium
- mestres do wp checkout mestres wp, wordpress checkout mestres +1 moreWordPress Checkout Mestres WP plugin <= 7.1.9.7 - Unauthenticated Arbitrary Options Update vulnerabilityCVE-2023-514718.2 High
- wordpress yith woocommerce compare, yith woocommerce compare +1 moreWordPress YITH WooCommerce Compare plugin <= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-326994.3 Medium
- seers, wordpress seers plugin +1 moreWordPress Seers plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) to XSS vulnerabilityCVE-2024-327897.1 High
- metagauss profilegrid, wordpress profile grid +1 moreWordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2024-327724.3 Medium
- shapedplugin widget post sliderWordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-328015.9 Medium
- bloompixel max addons pro for bricksWordPress Max Addons Pro for Bricks plugin <= 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2024-329527.1 High
- themehigh email customizer for woocommerceWordPress Email Customizer for WooCommerce plugin <= 2.6.0 - Sensitive Data Exposure vulnerabilityCVE-2024-327817.5 High
- webtoffee import export wordpress usersWordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerabilityCVE-2024-328355.4 Medium
- bloompixel max addons pro for bricksWordPress Max Addons Pro for Bricks plugin <= 1.6.1 - Unauthenticated Plugin Settings Reset vulnerabilityCVE-2024-329516.5 Medium
- rankmath seo, wordpress rank math seo, rankmath rank math seo – ai seo tools to dominate seo rankings +2 moreRank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper'CVE-2024-36656.4 Medium
- wordpress elespare, elespare – news, magazine and blog addons for elementor +1 moreElespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! <= 2.1.2 - Missing Authorization to Subscriber+ Arbitrary Post Cre…CVE-2024-09004.3 Medium
- royal-elementor-addons royal elementor addons, wordpress royal-elementor-addons, wproyal royal addons for elementor – addons and templates kit for elementor +2 moreRoyal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingCVE-2024-27986.4 Medium
- royal-elementor-addons royal elementor addons, wordpress royal-elementor-addons, wproyal royal addons for elementor – addons and templates kit for elementor +2 moreRoyal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML TagsCVE-2024-27996.4 Medium
- marco gasi language switcher for transposhWordPress Language Switcher for Transposh plugin <= 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2024-326957.1 High
- thimo grauerholz wp-spreadplugin, wordpress thimo grauerholz wp-spreadplugin +1 moreThimo Grauerholz WP-Spreadplugin spreadplugin.php cross site scriptingCVE-2015-101323.5 Low
- cusrev customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's'CVE-2024-37316.1 Medium
- wordpress popup anythingWordPress Popup Anything plugin <= 2.8 - Broken Access Control vulnerabilityCVE-2024-326015.3 Medium
- plechev andrey wp-recall, wordpress adserve +1 moreWordPress WP-Recall plugin <= 16.26.5 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2024-326044.3 Medium
- layered if menu, wordpress adserve +1 moreWordPress If Menu – Visibility control for Menus plugin <= 0.16.3 - Broken Access ControlCVE-2022-416986.5 Medium
- cssigniterteam elements plus!, wordpress cssigniter elements team +1 moreWordPress Elements Plus! plugin <= 2.16.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-324576.5 Medium
- easy social feed social feed, easysocialfeed easy social feed +1 moreEasy Social Feed < 6.5.6 - Contributor+ Stored XSSCVE-2024-12195.3 Medium
- moove agency import xml and rss feeds, wordpress import xml and rss feeds plugin +1 moreWordPress Import XML and RSS Feeds plugin <= 2.1.5 - Arbitrary File Upload vulnerabilityCVE-2024-312927.2 High
- wordpress, wordpress wordpress-develop +1 moreRemote Code Execution in `WP_HTML_Token`CVE-2024-31211Public exploitFix available5.5 Medium
- wordpress, wordpress wordpress-develop +1 morePHP file upload bypass via Plugin installerCVE-2024-31210Fix available7.7 High
- unknown grid shortcodesGrid Shortcodes < 1.1.1 - Contributor+ Stored XSSCVE-2024-16585.4 Medium
- strangerstudios paid memberships proPaid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field DisclosureCVE-2024-12794.3 Medium
- buddypressWordPress BuddyPress Plugin <= 11.3.1 is vulnerable to Cross Site Scripting (XSS)CVE-2023-508806.5 Medium
- Show moreLoading…