CVE-2024-28000

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.

CVSS 3.1 · 9.8 Critical EPSS 68.3% KEV · Not listed

Vendors

Litespeedtech

Products

Litespeed Cache

CVE-2024-27998

WordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-27997

WordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer.This issue affects Visual Composer Website Builder: from n/a through <= 45.6.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Visualcomposer Wordpress

Products

Visual Composer Website Builder Wordpress

CVE-2024-27994

WordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.5.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-27993

WordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-27987

WordPress Give plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.3.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Givewp Wordpress

Products

Give Givewp Wordpress

CVE-2024-27971

WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Permalink Manager for WooCommerce woo-permalink-manager.This issue affects Premmerce Permalink Manager for WooCommerce: from n/a through <= 2.3.10.

CVSS 3.1 · 8.3 High EPSS 1.5% KEV · Not listed

Vendors

Premmerce

Products

Permalink Manager For Woocommerce

CVE-2024-27965

WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Getwpfunnels

Products

Wpfunnels

CVE-2024-27950

WordPress Sirv plugin <= 7.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Sirv

Products

Sirv

CVE-2024-27949

WordPress Sirv plugin <= 7.2.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Sirv

Products

Sirv

CVE-2024-27195

WordPress Watermark RELOADED plugin <= 1.3.5 - CSRF to XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in sverde1 Watermark RELOADED watermark-reloaded allows Cross Site Request Forgery.This issue affects Watermark RELOADED: from n/a through <= 1.3.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-27193

WordPress PayU India plugin <= 3.8.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PayU India PayU India payu-india allows DOM-Based XSS.This issue affects PayU India: from n/a through <= 3.8.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Woocommerce

Products

Payu India Payment Gateway

CVE-2024-27188

WordPress Breeze plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze.This issue affects Breeze: from n/a through <= 2.1.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudways Wordpress

Products

Breeze Wordpress

CVE-2024-25932

WordPress Change Table Prefix plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Manish Kumar Agarwal Change Table Prefix change-table-prefix allows Cross Site Request Forgery.This issue affects Change Table Prefix: from n/a through <= 2.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Youngtechleads

Products

Change Table Prefix

CVE-2024-25599

WordPress Seriously Simple Podcasting plugin <= 3.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting.This issue affects Seriously Simple Podcasting: from n/a through <= 3.0.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Castos Wordpress

Products

Seriously Simple Podcasting Wordpress

CVE-2024-24871

WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy.This issue affects Blocksy: from n/a through <= 2.0.19.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Creativethemes

Products

Blocksy

CVE-2024-24833

WordPress Happy Addons for Elementor plugin <= 3.10.1 - Broken Access Control on Post Clone vulnerability

Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for Elementor: from n/a through <= 3.10.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Leevio

Products

Happy Addons For Elementor

CVE-2024-24831

WordPress Premium Addons for Elementor plugin <= 4.10.16 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.16.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Leap13

Products

Premium Addons For Elementor

CVE-2024-23507

WordPress InstaWP Connect plugin <= 0.1.0.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Instawp

Products

Instawp Connect

CVE-2024-23506

WordPress InstaWP Connect plugin <= 0.1.0.9 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Instawp

Products

Instawp Connect