CVE-2024-50489

WordPress Realty Workstation plugin <= 1.0.45 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in realtyworkstation Realty Workstation realty-workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through <= 1.0.45.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Realty Workstation Realtyworkstation

Products

Realty Workstation Realty Workstation

CVE-2024-50488

WordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in yespbs Token Login token-login allows Authentication Bypass.This issue affects Token Login: from n/a through <= 1.0.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Priyabrata Sarkar Priyabratasarkar

Products

Token Login Token Login

CVE-2024-50487

WordPress MaanStore API plugin <= 1.0.1 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo MaanStore API maanstore-api allows Authentication Bypass.This issue affects MaanStore API: from n/a through <= 1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Maantheme

Products

Maanstore Api

CVE-2024-50486

WordPress Acnoo Flutter API plugin <= 1.0.5 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API acnoo-flutter-api allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through <= 1.0.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Acnoo

Products

Acnoo Flutter Api Flutter Api

CVE-2024-50485

WordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Udit Rawat Exam Matrix exam-matrix allows Privilege Escalation.This issue affects Exam Matrix: from n/a through <= 1.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Udit Rawat

Products

Exam Matrix

CVE-2024-50484

WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Mahlamusa

Products

Multi Purpose Mail Form

CVE-2024-50483

WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Tareq Hasan Meetup meetup allows Privilege Escalation.This issue affects Meetup: from n/a through <= 0.1.

CVSS 3.1 · 9.8 Critical EPSS 2.3% KEV · Not listed

Vendors

Meetup Tareqhasan

Products

Meetup Meetup

CVE-2024-50482

WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.

CVSS 3.1 · 10 Critical EPSS 1.1% KEV · Not listed

Vendors

Chetan Khandla

Products

Woocommerce Product Design

CVE-2024-50481

WordPress Bstone Demo Importer plugin <= 1.0.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in stackthemes Bstone Demo Importer bstone-demo-importer allows Privilege Escalation.This issue affects Bstone Demo Importer: from n/a through <= 1.0.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Stack Themes

Products

Bstone Demo Importer

CVE-2024-50480

WordPress Marketing Automation by AZEXO plugin <= 1.27.80 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in azexo Marketing Automation by AZEXO marketing-automation-by-azexo allows Upload a Web Shell to a Web Server.This issue affects Marketing Automation by AZEXO: from n/a through <= 1.27.80.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Azexo

Products

Marketing Automation By Azexo

CVE-2024-50479

WordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocommerce Quote Calculator woo-quote-calculator-order allows Blind SQL Injection.This issue affects Woocommerce Quote Calculator: from n/a through <= 1.1.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mansurahamed

Products

Woocommerce Quote Calculator

CVE-2024-50477

WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.

CVSS 3.1 · 9.8 Critical EPSS 8.1% KEV · Not listed

Vendors

Stacks Stacksmarket

Products

Stacks Mobile App Builder Stacks Mobile App Builder

CVE-2024-50476

WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability

Missing Authorization vulnerability in GRÜN Software Group GmbH GRÜN spendino Spendenformular spendino allows Privilege Escalation.This issue affects GRÜN spendino Spendenformular: from n/a through <= 1.0.1.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Grun Software Group

Products

Spendino Spendenformular

CVE-2024-50475

WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerability

Missing Authorization vulnerability in Scott Gamon Signup Page signup-page allows Privilege Escalation.This issue affects Signup Page: from n/a through <= 1.0.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Scott Gamon

Products

Signup Page

CVE-2024-50473

WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed ajar-productions-in5-embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through <= 3.1.3.

CVSS 3.1 · 10 Critical EPSS 1.1% KEV · Not listed

Vendors

Ajar Productions

Products

Ajar In5 Embed

CVE-2024-50472

WordPress Amilia Store plugin <= 2.9.8 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martindrapeau Amilia Store amilia-store allows Stored XSS.This issue affects Amilia Store: from n/a through <= 2.9.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Amilia

Products

Store

CVE-2024-50471

WordPress Trip Plan plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in checklistcom Trip Plan tripplan allows DOM-Based XSS.This issue affects Trip Plan: from n/a through <= 1.0.10.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Checklist

Products

Trip Plan

CVE-2024-50470

WordPress Themes4WP YouTube External Subtitles plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themes4WP Themes4WP YouTube External Subtitles themes4wp-youtube-external-subtitles allows DOM-Based XSS.This issue affects Themes4WP YouTube External Subtitles: from n/a through <= 1.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Themes4wp

Products

Youtube External Subtitles

CVE-2024-50469

WordPress Textboxes plugin <= 0.1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brightvesseldev Textboxes textboxes allows DOM-Based XSS.This issue affects Textboxes: from n/a through <= 0.1.3.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-50468

WordPress Raptor Editor plugin <= 1.0.20 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faceleg Raptor Editor wp-raptor allows DOM-Based XSS.This issue affects Raptor Editor: from n/a through <= 1.0.20.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress