CVE-2024-43354

WordPress myCred plugin <= 2.7.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mycred

Products

Mycred

CVE-2024-43242

WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Azzaroco Wpindeed

Products

Ultimate Membership Pro Ultimate Membership Pro

CVE-2024-37927

WordPress Jobmonster theme <= 4.7.5 - Unauthenticated Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in NooTheme Jobmonster noo-jobmonster allows Privilege Escalation.This issue affects Jobmonster: from n/a through <= 4.7.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Nootheme Wordpress

Products

Jobmonster Wordpress

CVE-2024-29135

WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Themefic

Products

Tourfic

CVE-2024-37469

WordPress Blocksy theme <= 1.9.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in creativethemeshq Blocksy blocksy allows Cross Site Request Forgery.This issue affects Blocksy: from n/a through <= 2.0.22.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Creativethemes

Products

Blocksy

CVE-2024-21746

WordPress Wp Ultimate Review plugin <= 2.3.6 - IP limit Bypass vulnerability

Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.This issue affects Wp Ultimate Review: from n/a through <= 2.3.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpmet

Products

Wp Ultimate Review

CVE-2023-49158

WordPress LadiApp plugin <= 4.4 - Broken Access Control lead to XSS vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Binh Nguyen LadiApp ladipage allows Stored XSS.This issue affects LadiApp: from n/a through <= 4.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2023-51360

WordPress Essential Blocks plugin <= 4.2.0 - Multiple Subscriber+ Broken Access Control vulnerability

Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wpdeveloper

Products

Essential Blocks

CVE-2023-49859

WordPress Login With Ajax plugin <= 4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marcus (aka @msykes) Login With Ajax login-with-ajax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login With Ajax: from n/a through <= 4.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2023-50373

WordPress Alt Manager plugin <= 1.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPSAAD Alt Manager alt-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alt Manager: from n/a through <= 1.6.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpsaad

Products

Alt Manager

CVE-2023-5823

WordPress TK Google Fonts GDPR Compliant Plugin <= 2.2.11 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themekraft

Products

Tk Google Fonts Gdpr Compliant

CVE-2023-51359

WordPress Essential Blocks plugin <= 4.2.0 - Multiple Contributor+ Broken Access Control vulnerability

Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpdeveloper

Products

Essential Blocks

CVE-2023-51362

WordPress myStickyElements plugin <= 2.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.1.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Premio

Products

All In One Floating Contact Form My Sticky Elements

CVE-2023-50903

WordPress Metform Elementor Contact Form Builder plugin <= 3.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Roxnor Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through <= 3.4.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpmet

Products

Metform Elementor Contact Form Builder

CVE-2023-51355

WordPress MultiVendorX plugin <= 4.0.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through <= 4.0.23.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Multivendorx

Products

Wc Marketplace

CVE-2023-48739

WordPress Porto Theme Functionality plugin < 2.12.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Porto Theme Porto Theme - Functionality porto-functionality allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Porto Theme - Functionality: from n/a through < 2.12.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-11620

WordPress Rank Math SEO plugin <= 1.0.231 - Arbitrary .htaccess Overwrite to Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Code Injection.This issue affects Rank Math SEO: from n/a through <= 1.0.231.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Rank Math Seo

Products

Rank Math Seo

CVE-2023-49754

WordPress Bulk Edit Post Titles plugin <= 5.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Yogesh Pawar Bulk Edit Post Titles bulk-edit-post-titles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Edit Post Titles: from n/a through <= 5.0.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2023-51357

WordPress Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 6.5.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Conversios

Products

Conversios.io

CVE-2023-50882

WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through <= 4.13.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Profilepress Properfraction

Products

Profilepress Profilepress