CVE-2024-43306

WordPress WP-Lister Lite for eBay plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.6.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-43300

WordPress Movie Database plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bert Movie Database movie-database allows Stored XSS.This issue affects Movie Database: from n/a through <= 1.0.11.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Heimkino-praxis

Products

Movie Database

CVE-2024-43299

WordPress SpeedyCache plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Softaculous SpeedyCache speedycache.This issue affects SpeedyCache: from n/a through <= 1.1.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Softaculous

Products

Speedycache

CVE-2024-43290

WordPress Atarim plugin <= 4.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration.This issue affects Atarim: from n/a through <= 4.0.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Atarim

Products

Atarim

CVE-2024-43283

WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 23.1.2.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Contest-gallery

Products

Contest Gallery

CVE-2024-43266

WordPress WP Job Portal plugin <= 2.1.8 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal.This issue affects WP Job Portal: from n/a through <= 2.1.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpjobportal

Products

Wp Job Portal

CVE-2024-43264

WordPress Create by Mediavine plugin <= 1.9.8 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through <= 1.9.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mediavine

Products

Create

CVE-2024-43259

WordPress Order Export for WooCommerce plugin <= 3.23 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue affects Order Export for WooCommerce: from n/a through <= 3.23.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jem-products Jem Plugins

Products

Order Export For Woocommerce Order Expert For Woocommerce

CVE-2024-43255

WordPress MyBookTable Bookstore by Stormhill Media plugin <= 3.3.9 - CSRF to XSS vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable.This issue affects MyBookTable Bookstore: from n/a through <= 3.3.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Stormhillmedia

Products

Mybook Table Bookstore

CVE-2024-43254

WordPress Smart Online Order for Clover plugin <= 1.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a through <= 1.5.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zaytech

Products

Smart Online Order For Clover

CVE-2024-43253

WordPress Smart Online Order for Clover plugin <= 1.5.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders.This issue affects Smart Online Order for Clover: from n/a through <= 1.5.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zaytech

Products

Smart Online Order For Clover

CVE-2024-43252

WordPress Crew HRM plugin <= 1.1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Crew HRM Crew HRM hr-management.This issue affects Crew HRM: from n/a through <= 1.1.1.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Crewhrm

Products

Crewhrm

CVE-2024-43243

WordPress JobBoard Job listing plugin <= 1.2.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in themeglow JobBoard Job listing job-board-light allows Upload a Web Shell to a Web Server.This issue affects JobBoard Job listing: from n/a through <= 1.2.6.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-43241

WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Azzaroco Wordpress

Products

Ultimate Membership Pro Wordpress

CVE-2024-43240

WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated Privilege Escalation vulnerability

Improper Authentication vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Wpindeed

Products

Ultimate Membership Pro

CVE-2024-43239

WordPress Masteriyo LMS plugin <= 1.11.4 - Insecure Direct Object Reference (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Masteriyo

Products

Masteriyo

CVE-2024-43238

WordPress weMail plugin <= 1.14.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows DOM-Based XSS.This issue affects weMail: from n/a through <= 1.14.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wedevs

Products

Wemail

CVE-2024-43237

WordPress Tag Groups plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-groups.This issue affects WordPress Tag Cloud Plugin – Tag Groups: from n/a through <= 2.0.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Taxopress

Products

Taxopress

CVE-2024-43230

WordPress Shared Files – Premium Download Manager & Secure File Sharing with Frontend File Upload plugin <= 1.7.28 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.28.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sharedfilespro Tammersoft

Products

Shared Files Shared Files

CVE-2024-43229

WordPress WP Search Analytics plugin <= 1.4.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cornel Raiu WP Search Analytics search-analytics.This issue affects WP Search Analytics: from n/a through <= 1.4.9.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—