CVE-2024-50422

WordPress Breeze plugin <= 2.1.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.1.14.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudways

Products

Breeze

CVE-2024-50421

WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 3.8.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing Slips: from n/a through <= 3.8.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpovernight

Products

Woocommerce Pdf Invoices\& Packing Slips

CVE-2024-50420

WordPress aDirectory plugin <= 1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in aDirectory aDirectory adirectory allows Upload a Web Shell to a Web Server.This issue affects aDirectory: from n/a through <= 1.3.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Adirectory

Products

Adirectory

CVE-2024-50419

WordPress Greenshift plugin <=9.7 - Broken Access Control vulnerability

Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greenshift: from n/a through <= 9.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Greenshiftwp

Products

Greenshift - Animation And Page Builder Blocks

CVE-2024-50418

WordPress Time Slot plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Time Slot Booking Time Slot timeslot allows DOM-Based XSS.This issue affects Time Slot: from n/a through <= 1.3.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-50417

WordPress Bold Page Builder plugin <= 5.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in boldthemes Bold Page Builder bold-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Page Builder: from n/a through <= 5.1.3.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Bold-themes

Products

Bold Page Builder

CVE-2024-50416

WordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through <= 1.2.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wpclever

Products

Wpc Shop As A Customer For Woocommerce

CVE-2024-50415

WordPress Ads.txt & App-ads.txt Manager for WordPress plugin <= 1.1.7.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Ads.txt & App-ads.txt Manager for WordPress app-ads-txt allows Stored XSS.This issue affects Ads.txt & App-ads.txt Manager for WordPress: from n/a through <= 1.1.7.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-50414

WordPress Button contact VR plugin <= 4.7.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buttonizer Button contact VR button-contact-vr allows Stored XSS.This issue affects Button contact VR: from n/a through <= 4.7.9.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-50413

WordPress Import and export users and customers plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through <= 1.27.5.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Codection Wordpress

Products

Import And Export Users And Customers Wordpress

CVE-2024-50412

WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jules Colle Conditional Fields for Contact Form 7 cf7-conditional-fields allows Stored XSS.This issue affects Conditional Fields for Contact Form 7: from n/a through <= 2.4.15.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-50411

WordPress WP Abstracts plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Stored XSS.This issue affects WP Abstracts: from n/a through <= 2.7.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Kevonadonis

Products

Wp Abstracts

CVE-2024-50410

WordPress Namaste! LMS plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kibokolabs

Products

Namaste\! Lms

CVE-2024-50409

WordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Stored XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kibokolabs

Products

Namaste\! Lms

CVE-2024-50408

WordPress Namaste! LMS plugin <= 2.6.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Bob Namaste! LMS namaste-lms allows Object Injection.This issue affects Namaste! LMS: from n/a through <= 2.6.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Kibokolabs

Products

Namaste\! Lms

CVE-2024-50407

WordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Namaste! LMS namaste-lms allows Reflected XSS.This issue affects Namaste! LMS: from n/a through <= 2.6.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kibokolabs

Products

Namaste\! Lms

CVE-2024-4746

WordPress Netgsm plugin <= 2.9.32 - Broken Access Control + CSRF vulnerability

Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm: from n/a through <= 2.9.32.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgsm

Products

Netgsm

CVE-2024-49703

WordPress WpEvently plugin <= 4.2.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam WpEvently mage-eventpress.This issue affects WpEvently: from n/a through <= 4.2.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-49702

WordPress myCred Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred Elementor mycred-for-elementor allows Stored XSS.This issue affects myCred Elementor: from n/a through <= 1.2.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mycred

Products

Mycred Elementor

CVE-2024-49701

WordPress Mags theme <= 1.1.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehorse Mags mags.This issue affects Mags: from n/a through <= 1.1.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Themehorse

Products

Interface Mags