CVE-2024-50512

WordPress Posti Shipping plugin <= 3.10.2 - Full Path Disclosure (FPD) vulnerability

Generation of Error Message Containing Sensitive Information vulnerability in Posti Posti Shipping posti-shipping allows Retrieve Embedded Sensitive Data.This issue affects Posti Shipping: from n/a through <= 3.10.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-50511

WordPress WP donimedia carousel plugin <= 1.0.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in donimedia WP donimedia carousel wp-donimedia-carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through <= 1.0.1.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-50510

WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For Woocommerce ar-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects AR For Woocommerce: from n/a through <= 6.3.

CVSS 3.1 · 10 Critical EPSS 1.0% KEV · Not listed

Vendors

—

Products

—

CVE-2024-50509

WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.

CVSS 3.1 · 8.6 High EPSS 1.4% KEV · Not listed

Vendors

Chetan Khandla Wordpress

Products

Woocommerce Product Design Wordpress

CVE-2024-50508

WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Chetan Khandla Wordpress

Products

Woocommerce Product Design Wordpress

CVE-2024-50507

WordPress DS.DownloadList plugin <= 1.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Daschmi DS.DownloadList dsdownloadlist allows Object Injection.This issue affects DS.DownloadList: from n/a through <= 1.3.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-50506

WordPress Marketing Automation by AZEXO plugin <= 1.27.80 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Privilege Escalation.This issue affects Marketing Automation by AZEXO: from n/a through <= 1.27.80.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Azexo Wordpress

Products

Marketing Automation By Azexo Wordpress

CVE-2024-50504

WordPress Bulk Change Role plugin <= 1.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in webxmedia Bulk Change Role bulk-role-change allows Privilege Escalation.This issue affects Bulk Change Role: from n/a through <= 1.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-50503

WordPress User Toolkit plugin <= 1.2.3 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck User Toolkit user-toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through <= 1.2.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-50502

WordPress Cozy Blocks plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows DOM-Based XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.18.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cozythemes

Products

Cozy Blocks

CVE-2024-50501

WordPress Kata Plus plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Climax Themes Kata Plus kata-plus allows DOM-Based XSS.This issue affects Kata Plus: from n/a through <= 1.4.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Climaxthemes

Products

Kata Plus

CVE-2024-50500

WordPress Phlox Core Elements plugin <= 2.17.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through <= 2.17.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Averta

Products

Shortcodes And Extra Features For Phlox Theme

CVE-2024-50498

WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affects WP Query Console: from n/a through <= 1.0.

CVSS 3.1 · 10 Critical EPSS 53.2% KEV · Not listed

Vendors

Lubus

Products

Wp Querey Table Wp Query Console

CVE-2024-50497

WordPress Advanced Online Ordering and Delivery Platform plugin <= 2.0.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wdesco Advanced Online Ordering and Delivery Platform advanced-online-ordering-and-delivery-platform allows PHP Local File Inclusion.This issue affects Advanced Online Ordering and Delivery Platform: from n/a through <= 2.0.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Buynowdepot

Products

Advanced Online Ordering And Delivery Platform

CVE-2024-50496

WordPress AR For WordPress plugin <= 6.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through <= 6.6.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Webandprint Webandprintdesign

Products

Ar Ar For Wordpress

CVE-2024-50495

WordPress Plugin Propagator plugin <= 0.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in nunomorgadinho Plugin Propagator wp-propagator allows Upload a Web Shell to a Web Server.This issue affects Plugin Propagator: from n/a through <= 0.1.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Widgilabs

Products

Plugin Propagator

CVE-2024-50494

WordPress Sudan Payment Gateway for WooCommerce plugin <= 1.2.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce wc-sudan-payment-gateway allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through <= 1.2.2.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Amin Omer

Products

Wc Sudan Payment Gateway

CVE-2024-50493

WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in masterhomepage Automatic Translation automatic-translation allows Upload a Web Shell to a Web Server.This issue affects Automatic Translation: from n/a through <= 1.0.4.

CVSS 3.1 · 10 Critical EPSS 1.1% KEV · Not listed

Vendors

Masterhomepage

Products

Automatic Translation

CVE-2024-50491

WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MicahBlu RSVP ME rsvp-me allows SQL Injection.This issue affects RSVP ME: from n/a through <= 1.9.9.

CVSS 3.1 · 9.3 Critical EPSS 1.0% KEV · Not listed

Vendors

Micah Blu Micahblu

Products

Rvsp Me Rsvp Me

CVE-2024-50490

WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerability

Missing Authorization vulnerability in lowcage PegaPoll pegapoll allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PegaPoll: from n/a through <= 1.0.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Szabolcs Szecsenyi

Products

Pegapoll