CVE-2024-1229

SimpleShop <= 2.10.2 - Missing Authorization

The SimpleShop plugin for WordPress is vulnerable to unauthorized disconnection from SimpleShop due to a missing capability check on the maybe_disconnect_simpleshop function in all versions up to, and including, 2.10.2. This makes it possible for unauthenticated attackers to disconnect the SimpleShop.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redbit Sro Wordpress

Products

Simple Shop Wordpress

CVE-2024-12288

Simple add pages or posts <= 2.0.0 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

The Simple add pages or posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-30461

WordPress Tumult Hype Animations plugin <= 1.9.11 - CSRF to XSS vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tumult Inc Tumult Hype Animations allows DOM-Based XSS.This issue affects Tumult Hype Animations: from n/a through 1.9.11.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tumult Wordpress

Products

Tumult Hype Animations Wordpress

CVE-2024-30480

WordPress CGC Maintenance Mode plugin <= 1.2 - IP Filtering Bypass vulnerability

Authentication Bypass by Spoofing vulnerability in Pippin Williamson CGC Maintenance Mode allows Functionality Bypass.This issue affects CGC Maintenance Mode: from n/a through 1.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-30516

WordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerability

Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking Package: from n/a through 1.6.27.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Saasproject Wordpress

Products

Booking Package Wordpress

CVE-2024-12287

Biagiotti Membership <= 1.0.2 - Authentication Bypass via biagiotti_membership_check_facebook_user

The Biagiotti Membership plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.0.2. This is due to the plugin not properly verifying a user's identity prior to authenticating them. This makes it possible for unauthenticated attackers to log in as other users, such as administrators, granted they have access to an email.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-12260

Ultimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site Scripting

The Ultimate Endpoints With Rest Api plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-30540

WordPress VS Contact Form plugin <= 14.7 - Sum Captcha Bypass vulnerability

Guessable CAPTCHA vulnerability in Guido VS Contact Form allows Functionality Bypass.This issue affects VS Contact Form: from n/a through 14.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-12256

Simple Video Management System <= 1.0.4 - Reflected Cross-Site Scripting

The Simple Video Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'analytics_video' parameter in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Maximize Wordpress

Products

Simple Video Management System Wordpress

CVE-2024-12249

GS Insever Portfolio <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection

The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's CSS settings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-12219

Stop Registration Spam <= 1.23 - Cross-Site Request Forgery to Cross-Site Scripting

The Stop Registration Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2024-56017 is likely a duplicate of this issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-12210

Print Invoice & Delivery Notes for WooCommerce <= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion

The Print Invoice & Delivery Notes for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wcdn_remove_shoplogo' AJAX action in all versions up to, and including, 5.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the shop's logo.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tychesoftwares Wordpress

Products

Print Invoice & Delivery Notes For Woocommerce Wordpress

CVE-2024-12170

ViewMedica Embed <= 1.4.15 - Cross-Site Request Forgery to SQL Injection

The ViewMedica 9 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.15. This is due to missing or incorrect nonce validation on the 'Viewmedica-Admin' page. This makes it possible for unauthenticated attackers to inject arbitrary SQL queries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-12122

ResAds <= 2.0.6 - Reflected Cross-Site Scripting via Multiple Parameters

The ResAds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Web-mv Wordpress

Products

Resads Wordpress

CVE-2024-3065

PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Authenticated (Admin+) Stored Cross-Site Scripting

The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE-2024-5447 may be a duplicate of this issue.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mohsinrasool Wordpress

Products

Paypal Pay Now, Buy Now, Donation And Cart Buttons Shortcode Wordpress

CVE-2024-3072

ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update

The ACF Front End Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_texts() function in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary post title, content, and ACF data.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-12121

Broken Link Checker | Finder <= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery

The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the 'moblc_check_link' function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-12103

Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosure

The Content No Cache: prevent specific content from being cached plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.1.2 via the eos_dyn_get_content action due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-12066

SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion

The SMSA Shipping(official) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsa_delete_label() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE-2024-49249 is likely a duplicate of this issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-31088

WordPress AdsPlace'r – Ad Manager, Inserter, AdSense Ads plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPShop.Ru AdsPlace'r – Ad Manager, Inserter, AdSense Ads allows DOM-Based XSS.This issue affects AdsPlace'r – Ad Manager, Inserter, AdSense Ads: from n/a through 1.1.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress