31
|
6.4 |
MEDIUM
Network
|
-
|
-
|
The WP Awesome Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 0.4.0 due to insufficient input sanitization and outp…
New
|
CWE-79
Cross-site Scripting
|
CVE-2024-9456
|
2024-10-26 14:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
32
|
6.1 |
MEDIUM
Network
|
-
|
-
|
The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on th…
New
|
CWE-79
Cross-site Scripting
|
CVE-2024-8870
|
2024-10-26 13:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
33
|
- |
|
-
|
-
|
The WatchTowerHQ plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.6. This is due to the 'watchtower_ota_token' default value is empty, and the not emp…
New
|
CWE-288
Authentication Bypass Using an Alternate Path or Channel
|
CVE-2024-9933
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
34
|
9.8 |
CRITICAL
Network
-
|
-
|
The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.…
New
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2024-9932
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
35
|
9.8 |
CRITICAL
Network
-
|
-
|
The Wux Blog Editor plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.0.0. This is due to missing validation on the token being supplied during the autol…
New
|
CWE-288
Authentication Bypass Using an Alternate Path or Channel
|
CVE-2024-9931
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
36
|
9.8 |
CRITICAL
Network
-
|
-
|
The Extensions by HocWP Team plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2.3.2. This is due to missing validation on the user being supplied in the…
New
|
CWE-288
Authentication Bypass Using an Alternate Path or Channel
|
CVE-2024-9930
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
37
|
8.8 |
HIGH
Network
|
-
|
-
|
The User Toolkit plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.3. This is due to an improper capability check in the 'switchUser' function. This ma…
New
|
CWE-288
Authentication Bypass Using an Alternate Path or Channel
|
CVE-2024-9890
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
38
|
- |
|
-
|
-
|
The Editorial Assistant by Sovrn plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_zemanta_set_featured_image' function in version…
New
|
-
|
CVE-2024-9626
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
39
|
6.1 |
MEDIUM
Network
|
-
|
-
|
The FormFacade – WordPress plugin for Google Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'userId' and 'publishId' parameters in all versions up to, and includin…
New
|
CWE-79
Cross-site Scripting
|
CVE-2024-9613
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
40
|
4.9 |
MEDIUM
Network
|
-
|
-
|
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the order_by parameter in all versions up to, and including, 5.4.6 due to …
New
|
CWE-89
SQL Injection
|
CVE-2024-9475
|
2024-10-26 12:15 |
2024-10-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|