CVE-2024-49614

WordPress SermonAudio Widgets plugin <= 1.9.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SermonAudio SermonAudio Widgets sermonaudio-widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through <= 1.9.3.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Sermonaudio

Products

Sermonaudio Widgets

CVE-2024-49613

WordPress Simple Code Insert Shortcode plugin <= 1.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in developersnote Simple Code Insert Shortcode simple-code-insert-shortcode allows SQL Injection.This issue affects Simple Code Insert Shortcode: from n/a through <= 1.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Lodelgeraldo

Products

Simple Code Insert Shortcode

CVE-2024-49612

WordPress SW Contact Form plugin <= 1.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanjeev SW Contact Form sw-contact-form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through <= 1.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Infotuts

Products

Sw Contact Form

CVE-2024-49611

WordPress Product Website Showcase plugin <= 1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in paxmanpwnz Product Website Showcase product-websites-showcase allows Upload a Web Shell to a Web Server.This issue affects Product Website Showcase: from n/a through <= 1.0.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Paxman

Products

Product Website Showcase

CVE-2024-49610

WordPress photokit plugin <= 1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in photokiteditor photokit photokit allows Upload a Web Shell to a Web Server.This issue affects photokit: from n/a through <= 1.0.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Jack Zhu Jackzhu

Products

Photokit Photokit

CVE-2024-49609

WordPress Author Discussion plugin <= 0.2.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion author-discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through <= 0.2.2.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Brandonwhite

Products

Author Discussion

CVE-2024-49608

WordPress GERRYWORKS Post by Mail plugin <= 1.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in gerryworks GERRYWORKS Post by Mail gerryworks-post-by-mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through <= 1.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Gerryntabuhashe

Products

Gerryworks Post By Mail

CVE-2024-49607

WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in redhopit WP Dropbox Dropins wp-dropbox-dropins allows Upload a Web Shell to a Web Server.This issue affects WP Dropbox Dropins: from n/a through <= 1.0.

CVSS 3.1 · 10 Critical EPSS 1.0% KEV · Not listed

Vendors

Redwan Hilali Redwanhilali

Products

Wp Dropbox Dropins Wp Dropbox Dropins

CVE-2024-49606

WordPress Google Map Locations plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DotsquaresLtd Google Map Locations google-map-locations allows Reflected XSS.This issue affects Google Map Locations: from n/a through <= 1.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Dotsquares

Products

Google Map Locations

CVE-2024-49605

WordPress Community Lite Video Chat plugin <= 2.2 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Stefan Nour AVChat Video Chat avchat-3 allows Stored XSS.This issue affects AVChat Video Chat: from n/a through <= 2.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Avchat.net

Products

Avchat Video Chat

CVE-2024-49335

WordPress GoogleDrive folder list plugin <= 2.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in sh4d0w28 GoogleDrive folder list googledrive-folder-list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through <= 2.2.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Edush Maxim

Products

Googledrive Folder List

CVE-2024-49334

WordPress jLayer Parallax Slider plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unizoe Web Solutions jLayer Parallax Slider jlayer-parallax-slider-wp allows Reflected XSS.This issue affects jLayer Parallax Slider: from n/a through <= 1.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Unizoewebsolutions

Products

Jlayer Parallax Slider

CVE-2024-49332

WordPress Giveaway Boost plugin <= 2.1.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Giveaway Boost Giveawayboost

Products

Giveaway Boost Giveaway Boost

CVE-2024-49331

WordPress Property Lot Management System plugin <= 4.2.38 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Property Lot Management System plms allows Upload a Web Shell to a Web Server.This issue affects Property Lot Management System: from n/a through <= 4.2.38.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Myriad Solutionz Myriadsolutionz

Products

Property Lot Management System Property Lot Management System

CVE-2024-49330

WordPress Nice Backgrounds plugin <= 1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds nicebackgrounds allows Upload a Web Shell to a Web Server.This issue affects Nice Backgrounds: from n/a through <= 1.0.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Brx8r

Products

Nice Backgrounds

CVE-2024-49329

WordPress WP REST API FNS plugin <= 1.0.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Upload a Web Shell to a Web Server.This issue affects WP REST API FNS: from n/a through <= 1.0.0.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Vivek Tamrakar Vivektamrakar

Products

Wp Rest Api Fns Wp Rest Api Fns

CVE-2024-49328

WordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through <= 1.0.0.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed

Vendors

Vivek Tamrakar Vivektamrakar

Products

Wp Rest Api Fns Wp Rest Api Fns

CVE-2024-49327

WordPress Woostagram Connect plugin <= 1.0.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in bepitulaz Woostagram Connect woostagram-connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through <= 1.0.2.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Asepbagjapriandana

Products

Woostagram Connect

CVE-2024-49326

WordPress Affiliator plugin <= 2.1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Vasileios Kerasiotis Affiliator affiliator-lite allows Upload a Web Shell to a Web Server.This issue affects Affiliator: from n/a through <= 2.1.3.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Vasiliskerasiotis

Products

Affiliator

CVE-2024-49325

WordPress Photo Gallery Builder plugin <= 3.0 - Broken Access Control to Notice Dismissal vulnerability

Missing Authorization vulnerability in wpdiscover Photo Gallery Builder photo-gallery-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Photo Gallery Builder: from n/a through <= 3.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpdiscover

Products

Photo Gallery Builder