CVE-2024-30431

WordPress Mang Board WP plugin <= 1.8.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hometory Mang Board WP allows Reflected XSS.This issue affects Mang Board WP: from n/a through 1.8.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-30433

WordPress MultiVendorX Marketplace plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX WC Marketplace allows Stored XSS.This issue affects WC Marketplace: from n/a through 4.1.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Multivendorx Wordpress

Products

Wc Marketplace Wordpress

CVE-2024-30242

WordPress Contact Form to Any API plugin <= 1.1.8 - Auth. SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions Contact Form to Any API.This issue affects Contact Form to Any API: from n/a through 1.1.8.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-30432

WordPress B Slider plugin <= 1.1.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider - Slider for your block editor allows Stored XSS.This issue affects B Slider - Slider for your block editor: from n/a through 1.1.12.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-30243

WordPress Tooltips plugin < 9.4.5 - Auth. SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tomas WordPress Tooltips.This issue affects WordPress Tooltips: from n/a before 9.4.5.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-30427

WordPress Spiffy Calendar plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins Spiffy Calendar allows Reflected XSS.This issue affects Spiffy Calendar: from n/a through 4.9.7.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Spiffyplugins

Products

Spiffy Calendar

CVE-2024-30426

WordPress Hash Elements plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Hash Elements allows Stored XSS.This issue affects Hash Elements: from n/a through 1.3.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hashthemes

Products

Hash Elements

CVE-2024-30239

WordPress Zoho Campaigns plugin <= 2.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zoho Campaigns.This issue affects Zoho Campaigns: from n/a through 2.0.6.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-30430

WordPress FluentCRM plugin <= 2.8.44 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Email Newsletter Team - FluentCRM Fluent CRM allows Stored XSS.This issue affects Fluent CRM: from n/a through 2.8.44.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wpmanageninja

Products

Fluentcrm

CVE-2024-30429

WordPress wp-forecast plugin <= 9.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hans Matzen allows Stored XSS.This issue affects wp-forecast: from n/a through 9.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tuxlog

Products

Wp-forecast

CVE-2024-30421

WordPress Events Manager plugin <= 6.4.7.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.7.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pixelite Wordpress

Products

Events Manager Wordpress

CVE-2024-30240

WordPress Calendarista plugin <= 15.5.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Typps Calendarista.This issue affects Calendarista: from n/a through 15.5.7.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Typps Wordpress

Products

Calendarista Wordpress

CVE-2024-30235

WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themeisle Multiple Page Generator Plugin – MPG.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themeisle

Products

Multiple Page Generator

CVE-2024-30234

WordPress WholesaleX plugin <= 1.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Wholesale Team WholesaleX.This issue affects WholesaleX: from n/a through 1.3.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wpxpo

Products

Wholesalex

CVE-2024-30230

WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.3.7.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Acowebs

Products

Pdf Invoices And Packing Slips For Woocommerce

CVE-2024-30227

WordPress Geo Controller plugin <= 8.6.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in INFINITUM FORM Geo Controller.This issue affects Geo Controller: from n/a through 8.6.4.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-30226

WordPress BetterDocs plugin <= 3.3.3 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WPDeveloper BetterDocs.This issue affects BetterDocs: from n/a through 3.3.3.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Wpdeveloper

Products

Betterdocs

CVE-2024-30228

WordPress Hercules Core plugin <= 6.4 - Auth. PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Hercules Design Hercules Core.This issue affects Hercules Core : from n/a through 6.4.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-30225

WordPress WP Migrate plugin <= 2.6.10 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WPENGINE, INC. WP Migrate.This issue affects WP Migrate: from n/a through 2.6.10.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Wpengine

Products

Wp Migrate

CVE-2024-30223

WordPress ARMember plugin <= 4.0.26 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Reputeinfosystems

Products

Armember