CVE-2024-22305

WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object References (IDOR)

Authorization Bypass Through User-Controlled Key vulnerability in ali Forms Contact Form builder with drag & drop for WordPress – Kali Forms.This issue affects Contact Form builder with drag & drop for WordPress – Kali Forms: from n/a through 2.3.36.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Kaliforms

Products

Kali Forms

CVE-2024-22304

WordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Borbis Media FreshMail For WordPress.This issue affects FreshMail For WordPress: from n/a through 2.3.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Borbis

Products

Freshmail For Wordpress

CVE-2024-23505

WordPress PDF Viewer & 3D PDF Flipbook – DearPDF Plugin <= 2.0.38 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DearHive PDF Viewer & 3D PDF Flipbook – DearPDF allows Stored XSS.This issue affects PDF Viewer & 3D PDF Flipbook – DearPDF: from n/a through 2.0.38.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dearhive

Products

Dearpdf

CVE-2024-23508

WordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster – PDF Embedder Plugin for WordPress allows Reflected XSS.This issue affects PDF Poster – PDF Embedder Plugin for WordPress: from n/a through 2.1.17.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Bplugins

Products

Pdf Poster

CVE-2024-23510

WordPress Don't Muck My Markup plugin <= 1.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Martyn Chamberlin Don't Muck My Markup.This issue affects Don't Muck My Markup: from n/a through 1.8.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Martynchamberlin

Products

Dont Muck My Markup

CVE-2024-22306

WordPress Mang Board WP Plugin <= 1.7.7 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hometory Mang Board WP allows Stored XSS.This issue affects Mang Board WP: from n/a through 1.7.7.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mangboard

Products

Mang Board

CVE-2024-22309

WordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in QuantumCloud ChatBot with AI.This issue affects ChatBot with AI: from n/a through 5.1.0.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Quantumcloud

Products

Wpbot

CVE-2024-23501

WordPress Ebook Store Plugin <= 5.788 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shopfiles Ltd Ebook Store allows Stored XSS.This issue affects Ebook Store: from n/a through 5.788.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Shopfiles

Products

Ebook Store

CVE-2024-22310

WordPress Formzu WP Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Formzu Inc. Formzu WP allows Stored XSS.This issue affects Formzu WP: from n/a through 1.6.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Formzu

Products

Formzu Wp

CVE-2024-22308

WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirection

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in smp7, wp.Insider Simple Membership.This issue affects Simple Membership: from n/a through 4.4.1.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Simple-membership-plugin

Products

Simple Membership

CVE-2024-22311

WordPress Simply Schedule Appointments plugin <= 1.6.6.20 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N Squared Simply Schedule Appointments allows Reflected XSS.This issue affects Simply Schedule Appointments: from n/a through 1.6.6.20.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-22301

WordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Sensitive Data Exposure

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ignazio Scimone Albo Pretorio On line.This issue affects Albo Pretorio On line: from n/a through 4.6.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Eduva

Products

Albo Pretorio Online

CVE-2024-22302

WordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ignazio Scimone Albo Pretorio On line allows Stored XSS.This issue affects Albo Pretorio On line: from n/a through 4.6.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Albo Pretorio On Line Project

Products

Albo Pretorio On Line

CVE-2024-22293

WordPress BP Profile Search Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrea Tarantini BP Profile Search allows Reflected XSS.This issue affects BP Profile Search: from n/a through 5.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Dontdream

Products

Bp Profile Search

CVE-2024-22299

WordPress FV Player plugin <= 7.5.41.7212 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Foliovision: Making the web work for you FV Flowplayer Video Player allows Reflected XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.41.7212.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Foliovision Wordpress

Products

Fv Flowplayer Video Player Wordpress

CVE-2024-22300

WordPress Icegram Express plugin <= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Email Subscribers & Newsletters allows Reflected XSS.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.11.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Icegram Wordpress

Products

Email Subscribers & Newsletters Wordpress

CVE-2024-22286

WordPress BA Plus Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aluka BA Plus – Before & After Image Slider FREE allows Reflected XSS.This issue affects BA Plus – Before & After Image Slider FREE: from n/a through 1.0.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Aluka

Products

Ba Plus

CVE-2024-22287

WordPress Better Anchor Links Plugin <= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Luděk Melichar Better Anchor Links allows Cross-Site Scripting (XSS).This issue affects Better Anchor Links: from n/a through 1.7.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ludek

Products

Better Anchor Links

CVE-2024-22292

WordPress WP To Do Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.2.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Delower

Products

Wp To Do

CVE-2024-22296

WordPress 12 Step Meeting List plugin <= 3.14.28 - Broken Access Control vulnerability

Missing Authorization vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.28.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code4recovery

Products

12 Step Meeting List