Nexcess.com Servers.com LiquidWeb.com

Line illustration showing a black application window on a blue gradient background overlaid with a large exclamation point alert icon and three bugs.

WordPress Vulnerability Report � October 23, 2024

In this report, 312 vulnerabilities have been publicly disclosed. Security patches for 131 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 181 plugin and theme vulnerabilities with no patch available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

WordPress Core

WordPress 6.7 Beta 3 is available and ready for testing! This beta version of the WordPress software is under development. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, it is recommended you evaluate Beta 3 on a test server and site.

WordPress Plugins � 130 Patched / 176 Unpatched

Plugin:: Email Template Customizer for WooCommerce
Plugin Slug:: email-template-customizer-for-woo
Installations: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49288

Plugin:: Custom Icons for Elementor
Plugin Slug:: custom-icons-for-elementor
Installations: 20,000+
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49676

Plugin:: CURCY � Multi Currency for WooCommerce � The best free currency exchange plugin � Run smoothly on WooCommerce 8.x
Plugin Slug:: woo-multi-currency
Installations: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49283

Plugin:: G Meta Keywords
Plugin Slug:: g-meta-keywords
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49301

Plugin:: Surfer � WordPress Plugin
Plugin Slug:: surferseo
Installations: 7,000+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49299

Plugin:: Edwiser Bridge � WordPress Moodle LMS Integration
Plugin Slug:: edwiser-bridge
Installations: 5,000+
Vulnerability:: Server Side Request Forgery (SSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49312

Plugin:: Edwiser Bridge � WordPress Moodle LMS Integration
Plugin Slug:: edwiser-bridge
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49311

Plugin:: Lightbox slider � Responsive Lightbox Gallery
Plugin Slug:: simple-lightbox-gallery
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49280

Plugin:: WordPress Portfolio Builder � Portfolio Gallery
Plugin Slug:: uber-grid
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49302

Plugin:: Pinpoint Booking System � #1 WordPress Booking Plugin
Plugin Slug:: booking-system
Installations: 4,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49304

Plugin:: Custom Add to Cart Button Label and Link
Plugin Slug:: woo-custom-cart-button
Installations: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49296

Plugin:: Zoho CRM Lead Magnet
Plugin Slug:: zoho-crm-forms
Installations: 4,000+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49297

Plugin:: Hyperlink Group Block
Plugin Slug:: hyperlink-group-block
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49279

Plugin:: Animator � Scroll Triggered Animations
Plugin Slug:: scroll-triggered-animations
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49308

Plugin:: DPD Baltic Shipping
Plugin Slug:: woo-shipping-dpd-baltic
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-9350

Plugin:: Omnipress
Plugin Slug:: omnipress
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49278

Plugin:: UltraAddons � Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode)
Plugin Slug:: ultraaddons-elementor-lite
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49277

Plugin:: WP SendFox
Plugin Slug:: wp-sendfox
Installations: 1,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49284

Plugin:: Simple Testimonials Showcase
Plugin Slug:: simple-testimonials-showcase
Installations: 900+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49295

Plugin:: TAKETIN To WP Membership
Plugin Slug:: taketin-to-wp-membership
Installations: 60+
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49226

Plugin:: Easy Addons for Elementor
Plugin Slug:: easy-addons-for-elementor
Installations: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49631

Plugin:: UltimateAI
Plugin Slug:: Ultimate_AI
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9104

Plugin:: UltimateAI
Plugin Slug:: Ultimate_AI
Vulnerability:: Broken Authentication
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-9105

Plugin:: AB Categories Search Widget
Plugin Slug:: ab-categories-search-widget
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49240

Plugin:: ACL Floating Cart for WooCommerce
Plugin Slug:: acl-floating-cart-for-woocommerce
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49640

Plugin:: Add Categories Post Footer
Plugin Slug:: add-categories-post-footer
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49239

Plugin:: ADIF Log Search Widget
Plugin Slug:: adif-log-search-widget
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49238

Plugin:: Advanced Advertising System
Plugin Slug:: advanced-advertising-system
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49624

Plugin:: Affiliator
Plugin Slug:: affiliator-lite
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49326

Plugin:: Agile Video Player Lite
Plugin Slug:: agile-video-player
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49636

Plugin:: Ahime Image Printer
Plugin Slug:: ahime-image-printer
Vulnerability:: Arbitrary File Download
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49245

Plugin:: Ahmeti Wp Timeline
Plugin Slug:: ahmeti-wp-timeline
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49237

Plugin:: AI Image Generator for Your Content & Featured Images � AI Postpix
Plugin Slug:: ai-postpix
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49671

Plugin:: Ajax Custom CSS/JS
Plugin Slug:: ajax-awesome-css
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49230

Plugin:: ajax-extend
Plugin Slug:: ajax-extend
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49254

Plugin:: Ajax Rating with Custom Login
Plugin Slug:: ajax-rating-with-custom-login
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49246

Plugin:: Akismet htaccess writer
Plugin Slug:: akismet-htaccess-writer
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49316

Plugin:: All in One Slider
Plugin Slug:: all-in-one-slider
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49323

Plugin:: Analyse Uploads
Plugin Slug:: analyse-uploads
Vulnerability:: Arbitrary File Deletion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49253

Plugin:: Apa Banner Slider
Plugin Slug:: apa-banner-slider
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49622

Plugin:: APA Register Newsletter Form
Plugin Slug:: apa-register-newsletter-form
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49621

Plugin:: Arkhe Blocks
Plugin Slug:: arkhe-blocks
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49261

Plugin:: Author Discussion
Plugin Slug:: author-discussion
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49609

Plugin:: AVChat Video Chat
Plugin Slug:: avchat-3
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49605

Plugin:: Azz Anonim Posting
Plugin Slug:: azz-anonim-posting
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49257

Plugin:: Back Link Tracker
Plugin Slug:: back-link-tracker
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49617

Plugin:: Banner Slider
Plugin Slug:: banner-slider
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49635

Plugin:: Bet WC 2018 Russia
Plugin Slug:: bet-wc-2018-russia
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49637

Plugin:: Better Author Bio
Plugin Slug:: better-author-bio
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49229

Plugin:: BuddyPress Better Registration
Plugin Slug:: better-bp-registration
Vulnerability:: Broken Authentication
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49247

Plugin:: Booking.com Banner Creator
Plugin Slug:: bookingcom-banner-creator
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49265

Plugin:: BuddyPress Greeting Message
Plugin Slug:: bp-greeting-message
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49650

Plugin:: BP Member Type Manager
Plugin Slug:: bp-member-type-manager
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49634

Plugin:: Branding
Plugin Slug:: branding
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9452

Plugin:: Bulk images optimizer
Plugin Slug:: bulk-image-resizer
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9361

Plugin:: bVerse Convert
Plugin Slug:: bverse-convert
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49228

Plugin:: Campus Explorer Widget
Plugin Slug:: campus-explorer-widget
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49660

Plugin:: chatplusjp
Plugin Slug:: chatplusjp
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49664

Plugin:: CJ Change Howdy
Plugin Slug:: cj-change-howdy
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49223

Plugin:: Client Power Tools Portal
Plugin Slug:: client-power-tools
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49670

Plugin:: Code Generate
Plugin Slug:: code-generator
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49646

Plugin:: Cookie Scanner
Plugin Slug:: cookie-scanner
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49220

Plugin:: Coub
Plugin Slug:: coub
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49659

Plugin:: Country Flags for Elementor
Plugin Slug:: country-flags-for-elementor
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49262

Plugin:: Crazy Call To Action Box
Plugin Slug:: crazy-call-to-action-box
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49236

Plugin:: cSlider
Plugin Slug:: cslider
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49221

Plugin:: CSV Product Import Export for WooCommerce
Plugin Slug:: csv-wc-product-import-export
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49244

Plugin:: CWD 3D Image Gallery
Plugin Slug:: cwd-3d-image-gallery
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49632

Plugin:: Digital Lottery
Plugin Slug:: digital-lottery
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49242

Plugin:: DocumentPress
Plugin Slug:: documentpress-display-any-document-on-your-site
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49656

Plugin:: Duplicate Title Validate
Plugin Slug:: duplicate-title-validate
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49623

Plugin:: Dynamic Elementor Addons
Plugin Slug:: dynamic-elementor-addons
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49243

Plugin:: Easy Menu Manager
Plugin Slug:: easy-menu-manager-wpzest
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9366

Plugin:: Easy Post Types
Plugin Slug:: easy-post-types
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-10079

Plugin:: Easy Post Types
Plugin Slug:: easy-post-types
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-10078

Plugin:: Easy Post Types
Plugin Slug:: easy-post-types
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-10080

Plugin:: EKC Tournament Manager
Plugin Slug:: ekc-tournament-manager
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49674

Plugin:: Elemenda
Plugin Slug:: elemenda
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9373

Plugin:: Extra Privacy for Elementor
Plugin Slug:: extra-privacy-for-elementor
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49654

Plugin:: Feed Comments Number
Plugin Slug:: feed-comments-number
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49216

Plugin:: FERMA.ru.net
Plugin Slug:: ferma-ru-net-checkout
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49620

Plugin:: Whitelist
Plugin Slug:: fifthsegment-whitelist
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49643

Plugin:: Flat UI Button
Plugin Slug:: flat-ui-button
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-10014

Plugin:: FREE DOWNLOAD MANAGER
Plugin Slug:: free-download-manager
Vulnerability:: Arbitrary File Deletion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49315

Plugin:: Free Stock Photos Foter
Plugin Slug:: free-stock-photos-foter
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49227

Plugin:: Gantry 4 Framework
Plugin Slug:: gantry
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-9382

Plugin:: GERRYWORKS Post by Mail
Plugin Slug:: gerryworks-post-by-mail
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49608

Plugin:: GetResponse Forms
Plugin Slug:: getresponse
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-8740

Plugin:: Giveaway Boost
Plugin Slug:: giveaway-boost
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49332

Plugin:: Google Docs RSVP
Plugin Slug:: google-docs-rsvp-guestlist
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49672

Plugin:: Google Map Locations
Plugin Slug:: google-map-locations
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49606

Plugin:: GoogleDrive folder list
Plugin Slug:: googledrive-folder-list
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49335

Plugin:: TeploBot – Telegram Bot for WP
Plugin Slug:: green-wp-telegram-bot-by-teplitsa
Vulnerability:: Sensitive Data Exposure
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-9627

Plugin:: iBryl Switch User
Plugin Slug:: ibryl-switch-user
Vulnerability:: Broken Authentication
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49675

Plugin:: Infinite-Scroll
Plugin Slug:: infinite-scroll
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-10040

Plugin:: INK Official
Plugin Slug:: ink-official
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49669

Plugin:: Job Board Manager for WordPress
Plugin Slug:: jemployee
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49322

Plugin:: JiangQie Free Mini Program
Plugin Slug:: jiangqie-free-mini-program
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49314

Plugin:: jLayer Parallax Slider
Plugin Slug:: jlayer-parallax-slider-wp
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49334

Plugin:: Kento Post View Counter
Plugin Slug:: kento-post-view-counter
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2016-15040

Plugin:: LaTeX2HTML
Plugin Slug:: latex2html
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49673

Plugin:: leenk.me
Plugin Slug:: leenkme
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49661

Plugin:: WordPress Gallery Plugin � Limb Image Gallery
Plugin Slug:: limb-gallery
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49260

Plugin:: WordPress Gallery Plugin � Limb Image Gallery
Plugin Slug:: limb-gallery
Vulnerability:: Arbitrary File Download
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49258

Plugin:: Linked Variation for WooCommerce
Plugin Slug:: linked-variation-for-woocommerce
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-48047

Plugin:: Contact Forms, Live Support, CRM, Video Messages
Plugin Slug:: live-support-tickets
Vulnerability:: Sensitive Data Exposure
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49235

Plugin:: Maan Addons For Elementor
Plugin Slug:: maan-elementor-addons
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49251

Plugin:: Local Business Addons For Elementor
Plugin Slug:: map-addons-for-elementor-waze-map
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49667

Plugin:: El mejor Cluster
Plugin Slug:: mejorcluster
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49232

Plugin:: Mighty Builder
Plugin Slug:: mighty-builder
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-48049

Plugin:: Mitm Bug Tracker
Plugin Slug:: mitm-bug-tracker
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49224

Plugin:: Monitor.chat
Plugin Slug:: monitor-chat
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49639

Plugin:: Movie Database
Plugin Slug:: movie-database
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-43300

Plugin:: My Reading Library
Plugin Slug:: my-reading-library
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49318

Plugin:: MyTweetLinks
Plugin Slug:: mytweetlinks
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49618

Plugin:: Nice Backgrounds
Plugin Slug:: nicebackgrounds
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49330

Plugin:: PDF-Rechnungsverwaltung
Plugin Slug:: pdf-rechnungsverwaltung
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49287

Plugin:: Photo Gallery Builder
Plugin Slug:: photo-gallery-builder
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49325

Plugin:: photokit
Plugin Slug:: photokit
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49610

Plugin:: Property Lot Management System
Plugin Slug:: plms
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49331

Plugin:: Portfolleo
Plugin Slug:: portfolleo
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49653

Plugin:: Product Customizer Light
Plugin Slug:: product-customizer-light
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9848

Plugin:: Product Website Showcase
Plugin Slug:: product-websites-showcase
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49611

Plugin:: Rate Own Post
Plugin Slug:: rate-own-post
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49616

Plugin:: Recently
Plugin Slug:: recently-viewed-most-viewed-and-sold-products-for-woocommerce
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49218

Plugin:: 3D Work In Progress
Plugin Slug:: renee-work-in-progress
Vulnerability:: Arbitrary File Deletion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49657

Plugin:: 3D Work In Progress
Plugin Slug:: renee-work-in-progress
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49652

Plugin:: WP REST API FNS
Plugin Slug:: rest-api-fns
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49329

Plugin:: WP REST API FNS
Plugin Slug:: rest-api-fns
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49328

Plugin:: Risk Warning Bar
Plugin Slug:: risk-warning-bar
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49638

Plugin:: RS-Members
Plugin Slug:: rs-members
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49219

Plugin:: SafetyForms
Plugin Slug:: safetymails-forms
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49615

Plugin:: SEO Manager
Plugin Slug:: seo-manager
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9521

Plugin:: SermonAudio Widgets
Plugin Slug:: sermonaudio-widgets
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49614

Plugin:: Shipyaari Shipping Management
Plugin Slug:: shipyaari-shipping-managment
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49626

Plugin:: Simple Code Insert Shortcode
Plugin Slug:: simple-code-insert-shortcode
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49613

Plugin:: Simple Custom Admin
Plugin Slug:: simple-custom-admin
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49647

Plugin:: Simple Load More
Plugin Slug:: simple-load-more
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49662

Plugin:: SiteBuilder Dynamic Components
Plugin Slug:: sitebuilder-dynamic-components
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49625

Plugin:: Affiliate Platform
Plugin Slug:: smdp-affiliate-platform
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49645

Plugin:: Social Link Groups
Plugin Slug:: social-link-groups
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49619

Plugin:: Social Share With Floating Bar
Plugin Slug:: social-share-with-floating-bar
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-8790

Plugin:: Sovratec Case Management
Plugin Slug:: sovratec-case-management
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49324

Plugin:: SSV Events
Plugin Slug:: ssv-events
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49286

Plugin:: SSV MailChimp
Plugin Slug:: ssv-mailchimp
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49285

Plugin:: Suki Sites Import
Plugin Slug:: suki-sites-import
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-8916

Plugin:: SVG Captcha
Plugin Slug:: svg-captcha
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49648

Plugin:: SW Contact Form
Plugin Slug:: sw-contact-form
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49612

Plugin:: Table of Contents Plus
Plugin Slug:: table-of-contents-plus
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49250

Plugin:: Tida URL Screenshot
Plugin Slug:: tida-url-screenshot
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49641

Plugin:: Tito
Plugin Slug:: tito
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49241

Plugin:: Todo Custom Field
Plugin Slug:: todo-custom-field
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49642

Plugin:: uCAT � Next Story
Plugin Slug:: ucat-next-story
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49663

Plugin:: Unlimited Addon For Elementor
Plugin Slug:: unlimited-addon-for-elementor
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49267

Plugin:: Adding drop down roles in registration
Plugin Slug:: user-drop-down-roles-in-registration
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49217

Plugin:: Verbalize WP
Plugin Slug:: verbalize-wp
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49668

Plugin:: VKontakte Wall Post
Plugin Slug:: vkontakte-wall-post
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49313

Plugin:: Web Bricks Addons for Elementor
Plugin Slug:: webbricks-addons
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49665

Plugin:: Woocommerce Custom Profile Picture
Plugin Slug:: woo-custom-profile-picture
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49658

Plugin:: Edit WooCommerce Templates
Plugin Slug:: woo-edit-templates
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-10049

Plugin:: Woo Manage Fraud Orders
Plugin Slug:: woo-manage-fraud-orders
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-9937

Plugin:: Parcel Pro
Plugin Slug:: woo-parcel-pro
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-9383

Plugin:: WooCommerce Maintenance Mode
Plugin Slug:: woocommerce-maintenance-mode
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49651

Plugin:: Woostagram Connect
Plugin Slug:: woostagram-connect
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49327

Plugin:: WordPress Video
Plugin Slug:: wordpress-video
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49231

Plugin:: Category and Taxonomy Image
Plugin Slug:: wp-custom-taxonomy-image
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9591

Plugin:: Category and Taxonomy Meta Fields
Plugin Slug:: wp-custom-taxonomy-meta
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9588

Plugin:: Category and Taxonomy Meta Fields
Plugin Slug:: wp-custom-taxonomy-meta
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9590

Plugin:: Category and Taxonomy Meta Fields
Plugin Slug:: wp-custom-taxonomy-meta
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9589

Plugin:: WP Dropbox Dropins
Plugin Slug:: wp-dropbox-dropins
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49607

Plugin:: WordPress Image SEO
Plugin Slug:: wp-post-459182 wp-image-seo
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49627

Plugin:: Simple User Registration
Plugin Slug:: wp-registration
Vulnerability:: Broken Authentication
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49604

Plugin:: SendGrid for WordPress
Plugin Slug:: wp-sendgrid-mailer
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9364

Plugin:: WP-Spreadplugin
Plugin Slug:: wp-spreadplugin
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49266

Plugin:: wpPricing Builder
Plugin Slug:: wppricing-builder-lite-responsive-pricing-table-builder
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49225

Plugin:: Wsify Widget
Plugin Slug:: wsify-widget
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-48048

Plugin:: Elementor Website Builder � More than Just a Page Builder
Plugin Slug:: elementor
Installations: 10,000,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 3.24.6
Severity Score:: Medium
CVE:: 2024-6757

Plugin:: WooCommerce
Plugin Slug:: woocommerce
Installations: 8,000,000+
Vulnerability:: Content Injection
Patched in Version:: 9.1.0
Severity Score:: Medium
CVE:: 2024-9944

Plugin:: All-in-One WP Migration and Backup
Plugin Slug:: all-in-one-wp-migration
Installations: 5,000,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 7.87
Severity Score:: Medium
CVE:: 2024-8852

Plugin:: Jetpack � WP Security, Backup, Speed, & Growth
Plugin Slug:: jetpack
Installations: 4,000,000+
Vulnerability:: Broken Access Control
Patched in Version:: 13.9.1
Severity Score:: Medium
CVE:: 2024-9926

Plugin:: Secure Custom Fields
Plugin Slug:: advanced-custom-fields
Installations: 2,000,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.3.6.3
Severity Score:: Medium

Plugin:: Forminator Forms � Contact Form, Payment Form & Custom Form Builder
Plugin Slug:: forminator
Installations: 500,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.36.0
Severity Score:: Medium
CVE:: 2024-9352

Plugin:: Forminator Forms � Contact Form, Payment Form & Custom Form Builder
Plugin Slug:: forminator
Installations: 500,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.36.0
Severity Score:: Medium
CVE:: 2024-9351

Plugin:: Royal Elementor Addons and Templates
Plugin Slug:: royal-elementor-addons
Installations: 400,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 1.3.987
Severity Score:: Medium
CVE:: 2024-7417

Plugin:: Ad Inserter � Ad Manager & AdSense Ads
Plugin Slug:: ad-inserter
Installations: 300,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.7.38
Severity Score:: High
CVE:: 2024-49248

Plugin:: Simple Custom Post Order
Plugin Slug:: simple-custom-post-order
Installations: 300,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.5.8
Severity Score:: Medium
CVE:: 2024-49321

Plugin:: Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Plugin Slug:: unlimited-elements-for-elementor
Installations: 300,000+
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 1.5.122
Severity Score:: Critical
CVE:: 2024-49271

Plugin:: Responsive Lightbox & Gallery
Plugin Slug:: responsive-lightbox
Installations: 200,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.4.9
Severity Score:: Medium
CVE:: 2024-49282

Plugin:: Custom Twitter Feeds � A Tweets Widget or X Feed Widget
Plugin Slug:: custom-twitter-feeds
Installations: 100,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.2.4
Severity Score:: Medium
CVE:: 2024-49685

Plugin:: GiveWP � Donation Plugin and Fundraising Platform
Plugin Slug:: give
Installations: 100,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 3.16.4
Severity Score:: Critical
CVE:: 2024-9634

Plugin:: Translate WordPress � Google Language Translator
Plugin Slug:: google-language-translator
Installations: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.0.10
Severity Score:: Medium
CVE:: 2021-4452

Plugin:: Schema & Structured Data for WP & AMP
Plugin Slug:: schema-and-structured-data-for-wp
Installations: 100,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 1.36
Severity Score:: Medium
CVE:: 2024-49683

Plugin:: Discount Rules for WooCommerce � Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons
Plugin Slug:: woo-discount-rules
Installations: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.6.6
Severity Score:: High
CVE:: 2024-8541

Plugin:: WP Content Copy Protection & No Right Click
Plugin Slug:: wp-content-copy-protector
Installations: 100,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 3.6.1
Severity Score:: Medium
CVE:: 2024-49306

Plugin:: SlimStat Analytics
Plugin Slug:: wp-slimstat
Installations: 90,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.2.7
Severity Score:: High
CVE:: 2024-9548

Plugin:: WP ULike � All-in-One Engagement Toolkit
Plugin Slug:: wp-ulike
Installations: 80,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 4.7.5
Severity Score:: Medium
CVE:: 2024-9649

Plugin:: Exclusive Addons for Elementor
Plugin Slug:: exclusive-addons-for-elementor
Installations: 60,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.7.2
Severity Score:: Medium
CVE:: 2024-49292

Plugin:: WP-Members Membership Plugin
Plugin Slug:: wp-members
Installations: 60,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.4.9.6
Severity Score:: High
CVE:: 2024-9231

Plugin:: Calculated Fields Form
Plugin Slug:: calculated-fields-form
Installations: 50,000+
Vulnerability:: Content Injection
Patched in Version:: 5.2.46
Severity Score:: Medium
CVE:: 2024-9940

Plugin:: Qi Blocks
Plugin Slug:: qi-blocks
Installations: 50,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 1.3.3
Severity Score:: High
CVE:: 2024-49690

Plugin:: Photo Gallery, Images, Slider in Rbs Image Gallery
Plugin Slug:: robo-gallery
Installations: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.2.22
Severity Score:: Medium
CVE:: 2024-49696

Plugin:: Simple Membership
Plugin Slug:: simple-membership
Installations: 50,000+
Vulnerability:: Open Redirection
Patched in Version:: 4.5.4
Severity Score:: Medium
CVE:: 2024-49682

Plugin:: Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)
Plugin Slug:: sina-extension-for-elementor
Installations: 50,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 3.5.8
Severity Score:: Medium
CVE:: 2024-9540

Plugin:: Product Filter by WBW
Plugin Slug:: woo-product-filter
Installations: 50,000+
Vulnerability:: SQL Injection
Patched in Version:: 2.7.1
Severity Score:: High
CVE:: 2024-49691

Plugin:: Appointment Booking Calendar � Simply Schedule Appointments Booking Plugin
Plugin Slug:: simply-schedule-appointments
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.7.55
Severity Score:: Medium
CVE:: 2024-7877

Plugin:: Appointment Booking Calendar � Simply Schedule Appointments Booking Plugin
Plugin Slug:: simply-schedule-appointments
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.7.55
Severity Score:: Medium
CVE:: 2024-7876

Plugin:: Themesflat Addons For Elementor
Plugin Slug:: themesflat-addons-for-elementor
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.2.2
Severity Score:: Medium
CVE:: 2024-49310

Plugin:: WPIDE � File Manager & Code Editor
Plugin Slug:: wpide
Installations: 40,000+
Vulnerability:: Full Path Disclosure (FPD)
Patched in Version:: 3.5.0
Severity Score:: Medium
CVE:: 2024-9546

Plugin:: Timetable and Event Schedule by MotoPress
Plugin Slug:: mp-timetable
Installations: 30,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.3.9
Severity Score:: High
CVE:: 2020-36840

Plugin:: ?????? ????? ??????? Persian WooCommerce SMS
Plugin Slug:: persian-woocommerce-sms
Installations: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 7.0.3
Severity Score:: High
CVE:: 2024-9213

Plugin:: VOD Infomaniak
Plugin Slug:: vod-infomaniak
Installations: 30,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.5.8
Severity Score:: Medium
CVE:: 2024-49274

Plugin:: Logo Slider � Logo Carousel, Logo Showcase & Client Logo Slider WordPress Plugin
Plugin Slug:: logo-slider-wp
Installations: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.1.0
Severity Score:: Medium
CVE:: 2024-5429

Plugin:: Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
Plugin Slug:: publishpress-authors
Installations: 20,000+
Vulnerability:: Privilege Escalation
Patched in Version:: 4.7.2
Severity Score:: High
CVE:: 2024-9215

Plugin:: Backup and Staging by WP Time Capsule
Plugin Slug:: wp-time-capsule
Installations: 20,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 1.22.22
Severity Score:: High
CVE:: 2024-49684

Plugin:: AffiliateX � Affiliate Blocks for WordPress, Amazon, eBay, AliExpress Affiliates
Plugin Slug:: affiliatex
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.9.1
Severity Score:: Medium
CVE:: 2024-49692

Plugin:: Mega Elements � Addons for Elementor
Plugin Slug:: mega-elements-addons-for-elementor
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.7
Severity Score:: Medium
CVE:: 2024-49693

Plugin:: Multiline files upload for contact form 7
Plugin Slug:: multiline-files-for-contact-form-7
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.9
Severity Score:: Medium
CVE:: 2024-9891

Plugin:: WooCommerce Bulk Edit Products, Orders, Coupons, Any WordPress Post Type (Advanced) � Smart Manager
Plugin Slug:: smart-manager-for-wp-e-commerce
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 8.46.0
Severity Score:: Medium
CVE:: 2024-49687

Plugin:: WP Photo Album Plus
Plugin Slug:: wp-photo-album-plus
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 8.8.07.004
Severity Score:: High
CVE:: 2024-9951

Plugin:: WP VR � 360 Panorama and Virtual Tour Builder For WordPress
Plugin Slug:: wpvr
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 8.5.6
Severity Score:: Medium
CVE:: 2024-49680

Plugin:: WP VR � 360 Panorama and Virtual Tour Builder For WordPress
Plugin Slug:: wpvr
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 8.5.5
Severity Score:: Medium
CVE:: 2024-49293

Plugin:: Add Widget After Content
Plugin Slug:: add-widget-after-content
Installations: 9,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.5
Severity Score:: Medium
CVE:: 2024-9892

Plugin:: Contact Form by Supsystic
Plugin Slug:: contact-form-by-supsystic
Installations: 9,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7.29
Severity Score:: Medium
CVE:: 2024-48046

Plugin:: Awesome Contact Form7 for Elementor
Plugin Slug:: awesome-contact-form7-for-elementor
Installations: 8,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1
Severity Score:: Medium
CVE:: 2024-49319

Plugin:: Events Addon for Elementor
Plugin Slug:: events-addon-for-elementor
Installations: 8,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.2.1
Severity Score:: Medium
CVE:: 2024-49264

Plugin:: Event Manager and Tickets Selling Plugin for WooCommerce � WpEvently � WordPress Plugin
Plugin Slug:: mage-eventpress
Installations: 8,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.2.6
Severity Score:: Medium
CVE:: 2024-49703

Plugin:: Primary Addon for Elementor
Plugin Slug:: primary-addon-for-elementor
Installations: 8,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.9
Severity Score:: Medium
CVE:: 2024-49259

Plugin:: Admin Management Xtended
Plugin Slug:: admin-management-xtended
Installations: 7,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.4.7
Severity Score:: Medium
CVE:: 2024-49307

Plugin:: Customer Email Verification for WooCommerce
Plugin Slug:: emails-verification-for-woocommerce
Installations: 7,000+
Vulnerability:: SQL Injection
Patched in Version:: 2.9.0
Severity Score:: Critical
CVE:: 2024-49305

Plugin:: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Plugin Slug:: erp
Installations: 7,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.13.3
Severity Score:: High
CVE:: 2024-47640

Plugin:: ProfileGrid � User Profiles, Groups and Communities
Plugin Slug:: profilegrid-user-profiles-groups-and-communities
Installations: 7,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 5.9.3.1
Severity Score:: Medium
CVE:: 2024-49273

Plugin:: Kama SpamBlock
Plugin Slug:: kama-spamblock
Installations: 6,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.3
Severity Score:: High
CVE:: 2024-9647

Plugin:: WP Popup Builder � Popup Forms and Marketing Lead Generation
Plugin Slug:: wp-popup-builder
Installations: 6,000+
Vulnerability:: Content Injection
Patched in Version:: 1.3.6
Severity Score:: High
CVE:: 2024-9061

Plugin:: Arconix Shortcodes
Plugin Slug:: arconix-shortcodes
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1.13
Severity Score:: Medium
CVE:: 2024-9703

Plugin:: ElementsReady Addons for Elementor
Plugin Slug:: element-ready-lite
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.4.4
Severity Score:: Medium
CVE:: 2024-9444

Plugin:: ElementInvader Addons for Elementor
Plugin Slug:: elementinvader-addons-for-elementor
Installations: 5,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 1.3.0
Severity Score:: Medium
CVE:: 2024-9889

Plugin:: ElementInvader Addons for Elementor
Plugin Slug:: elementinvader-addons-for-elementor
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.9
Severity Score:: Medium
CVE:: 2024-9888

Plugin:: WPKoi Templates for Elementor
Plugin Slug:: wpkoi-templates-for-elementor
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1.1
Severity Score:: Medium
CVE:: 2024-49679

Plugin:: PeproDev Ultimate Invoice
Plugin Slug:: pepro-ultimate-invoice
Installations: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.7
Severity Score:: Medium
CVE:: 2024-49298

Plugin:: Fonto � Custom Web Fonts Manager
Plugin Slug:: fonto
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.2
Severity Score:: Medium
CVE:: 2024-8920

Plugin:: Parallax Image
Plugin Slug:: parallax-image
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.9
Severity Score:: Medium
CVE:: 2024-9898

Plugin:: Community by PeepSo � Social Network, Membership, Registration, User Profiles, Premium � Mobile App
Plugin Slug:: peepso-core
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.4.6.2
Severity Score:: Medium
CVE:: 2024-9873

Plugin:: RSS Feed Widget
Plugin Slug:: rss-feed-widget
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.0
Severity Score:: Medium
CVE:: 2024-10057

Plugin:: Accordion Slider
Plugin Slug:: accordion-slider
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.9.12
Severity Score:: Medium
CVE:: 2024-9582

Plugin:: Anchor Episodes Index (Spotify for Podcasters)
Plugin Slug:: anchor-episodes-index
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1.11
Severity Score:: Medium
CVE:: 2024-10189

Plugin:: Smart Online Order for Clover
Plugin Slug:: clover-online-orders
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.8
Severity Score:: High
CVE:: 2024-8787

Plugin:: Smart Online Order for Clover
Plugin Slug:: clover-online-orders
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.8
Severity Score:: Medium
CVE:: 2024-9895

Plugin:: Flexmls� IDX Plugin
Plugin Slug:: flexmls-idx
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.14.23
Severity Score:: High
CVE:: 2024-8719

Plugin:: Htaccess File Editor � Easily Edit, Backup, Restore .htaccess file
Plugin Slug:: htaccess-file-editor
Installations: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.0.19
Severity Score:: Medium
CVE:: 2024-49256

Plugin:: Leyka
Plugin Slug:: leyka
Installations: 2,000+
Vulnerability:: Full Path Disclosure (FPD)
Patched in Version:: 3.31.7
Severity Score:: Medium
CVE:: 2024-49252

Plugin:: MAS Companies For WP Job Manager
Plugin Slug:: mas-wp-job-manager-company
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.14
Severity Score:: High
CVE:: 2024-9206

Plugin:: My Wp Brand � Hide menu & Hide Plugin
Plugin Slug:: my-wp-brand
Installations: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.1.3
Severity Score:: Medium
CVE:: 2024-49694

Plugin:: Smart Blocks
Plugin Slug:: smart-blocks
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1
Severity Score:: Medium
CVE:: 2024-49270

Plugin:: WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin
Plugin Slug:: timetics
Installations: 2,000+
Vulnerability:: Privilege Escalation
Patched in Version:: 1.0.26
Severity Score:: Critical
CVE:: 2024-9263

Plugin:: Advanced Category and Custom Taxonomy Image
Plugin Slug:: advanced-category-and-custom-taxonomy-image
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.0
Severity Score:: Medium
CVE:: 2024-9425

Plugin:: AppPresser � Mobile App Framework
Plugin Slug:: apppresser
Installations: 1,000+
Vulnerability:: Privilege Escalation
Patched in Version:: 4.4.5
Severity Score:: High
CVE:: 2024-9305

Plugin:: Great Restaurant Menu WP
Plugin Slug:: best-restaurant-menu-by-pricelisto
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.4.3
Severity Score:: Medium
CVE:: 2024-49698

Plugin:: Clio Grow Form
Plugin Slug:: clio-grow-form
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.3
Severity Score:: High
CVE:: 2024-49276

Plugin:: Encyclopedia / Glossary / Wiki
Plugin Slug:: encyclopedia-lexicon-glossary-wiki-dictionary
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7.61
Severity Score:: High
CVE:: 2024-49320

Plugin:: HD Quiz � Save Results Light
Plugin Slug:: hd-quiz-save-results-light
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 0.6
Severity Score:: Medium
CVE:: 2024-49689

Plugin:: IdeaPush
Plugin Slug:: ideapush
Installations: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 8.71
Severity Score:: Medium
CVE:: 2024-49275

Plugin:: Landing Page Cat � Coming Soon Page, Maintenance Page & Squeeze Pages
Plugin Slug:: landing-page-cat
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.7.5
Severity Score:: Medium
CVE:: 2024-49686

Plugin:: Locatoraid Store Locator
Plugin Slug:: locatoraid
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.9.48
Severity Score:: High
CVE:: 2024-9652

Plugin:: Most And Least Read Posts Widget
Plugin Slug:: most-and-least-read-posts-widget
Installations: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.5.19
Severity Score:: Medium
CVE:: 2024-49628

Plugin:: My Favorites
Plugin Slug:: my-favorites
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.3
Severity Score:: Medium
CVE:: 2024-49263

Plugin:: myCred Elementor
Plugin Slug:: mycred-for-elementor
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.7
Severity Score:: Medium
CVE:: 2024-49702

Plugin:: News Kit Elementor Addons
Plugin Slug:: news-kit-elementor-addons
Installations: 1,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 1.2.2
Severity Score:: Medium
CVE:: 2024-9541

Plugin:: ReDi Restaurant Reservation
Plugin Slug:: redi-restaurant-reservation
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 24.1015
Severity Score:: High
CVE:: 2024-9240

Plugin:: WordPress Social Share Buttons
Plugin Slug:: share-button
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.20
Severity Score:: High
CVE:: 2024-9219

Plugin:: StreamWeasels Twitch Integration
Plugin Slug:: streamweasels-twitch-integration
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.7
Severity Score:: Medium
CVE:: 2024-9897

Plugin:: Sunshine Photo Cart: Free Client Photo Galleries for Photographers
Plugin Slug:: sunshine-photo-cart
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 3.2.10
Severity Score:: Medium
CVE:: 2024-49697

Plugin:: Click to Chat � WP Support All-in-One Floating Widget
Plugin Slug:: support-chat
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.3.4
Severity Score:: Medium
CVE:: 2024-10055

Plugin:: Click to Chat � WP Support All-in-One Floating Widget
Plugin Slug:: support-chat
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.3.4
Severity Score:: Medium
CVE:: 2024-49281

Plugin:: WP Flow Plus
Plugin Slug:: wp-imageflow2
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.2.4
Severity Score:: Medium
CVE:: 2024-49695

Plugin:: Photo Gallery Slideshow & Masonry Tiled Gallery
Plugin Slug:: wp-responsive-photo-gallery
Installations: 1,000+
Vulnerability:: SQL Injection
Patched in Version:: 1.0.4
Severity Score:: High
CVE:: 2019-25218

Plugin:: The Ultimate WordPress Toolkit � WP Extended
Plugin Slug:: wpextended
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.10
Severity Score:: High
CVE:: 2024-9347

Plugin:: Zita Elementor Site Library
Plugin Slug:: zita-site-library
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.4
Severity Score:: Medium
CVE:: 2024-8921

Plugin:: SendPulse Free Web Push
Plugin Slug:: sendpulse-web-push
Installations: 900+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.7
Severity Score:: High
CVE:: 2024-9184

Plugin:: MAS Elementor
Plugin Slug:: mas-addons-for-elementor
Installations: 700+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.7
Severity Score:: Medium
CVE:: 2024-49233

Plugin:: Time Clock � A WordPress Employee & Volunteer Time Clock Plugin
Plugin Slug:: time-clock
Installations: 600+
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 1.2.3
Severity Score:: High
CVE:: 2024-9593

Plugin:: WP Sessions Time Monitoring Full Automatic
Plugin Slug:: activitytime
Installations: 500+
Vulnerability:: SQL Injection
Patched in Version:: 1.1.0
Severity Score:: Critical
CVE:: 2024-49681

Plugin:: Plexx Elementor Extension
Plugin Slug:: plexx-elementor-extension
Installations: 400+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.7
Severity Score:: Medium
CVE:: 2024-49234

Plugin:: AADMY � Add Auto Date Month Year Into Posts
Plugin Slug:: auto-date-year-month
Installations: 300+
Vulnerability:: Content Injection
Patched in Version:: 2.0.2
Severity Score:: Medium
CVE:: 2024-9837

Plugin:: Rover IDX
Plugin Slug:: rover-idx
Installations: 300+
Vulnerability:: Privilege Escalation
Patched in Version:: 3.0.0.2906
Severity Score:: High
CVE:: 2024-10002

Plugin:: Rover IDX
Plugin Slug:: rover-idx
Installations: 300+
Vulnerability:: Broken Access Control
Patched in Version:: 3.0.0.2905
Severity Score:: Medium
CVE:: 2024-10003

Plugin:: Da Reactions
Plugin Slug:: da-reactions
Installations: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.2.0
Severity Score:: Medium
CVE:: 2024-49255

Plugin:: Point Maker
Plugin Slug:: point-maker
Installations: 200+
Vulnerability:: Local File Inclusion
Patched in Version:: 0.1.5
Severity Score:: High
CVE:: 2024-49317

Plugin:: Endless Posts Navigation
Plugin Slug:: endless-posts-navigation
Installations: 100+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.2.8
Severity Score:: High
CVE:: 2024-49629

Plugin:: Miniorange OTP Verification with Firebase
Plugin Slug:: miniorange-firebase-sms-otp-verification
Installations: 100+
Vulnerability:: Broken Authentication
Patched in Version:: 3.6.1
Severity Score:: High
CVE:: 2024-9861

Plugin:: Miniorange OTP Verification with Firebase
Plugin Slug:: miniorange-firebase-sms-otp-verification
Installations: 100+
Vulnerability:: Broken Authentication
Patched in Version:: 3.6.1
Severity Score:: Critical
CVE:: 2024-9862

Plugin:: Miniorange OTP Verification with Firebase
Plugin Slug:: miniorange-firebase-sms-otp-verification
Installations: 100+
Vulnerability:: Privilege Escalation
Patched in Version:: 3.6.1
Severity Score:: Critical
CVE:: 2024-9863

Plugin:: WP 2FA with Telegram
Plugin Slug:: two-factor-login-telegram
Installations: 100+
Vulnerability:: Broken Authentication
Patched in Version:: 3.1
Severity Score:: High
CVE:: 2024-9687

Plugin:: WP 2FA with Telegram
Plugin Slug:: two-factor-login-telegram
Installations: 100+
Vulnerability:: Bypass Vulnerability
Patched in Version:: 3.1
Severity Score:: Medium
CVE:: 2024-9820

Plugin:: WP Education � Education WordPress Plugin for Elementor
Plugin Slug:: wp-education
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.9
Severity Score:: Medium
CVE:: 2024-49630

Plugin:: Debrandify � Remove or Replace WordPress Branding
Plugin Slug:: debrandify
Installations: 60+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.3
Severity Score:: Medium
CVE:: 2024-9674

Plugin:: Advanced Custom Fields PRO
Plugin Slug:: advanced-custom-fields-pro
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.3.9
Severity Score:: Medium

Plugin:: Cooked Pro
Plugin Slug:: cooked-pro
Vulnerability:: Arbitrary File Upload
Patched in Version:: 1.8.0
Severity Score:: Critical
CVE:: 2024-49291

Plugin:: Cooked Pro
Plugin Slug:: cooked-pro
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.8.0
Severity Score:: Medium
CVE:: 2024-49290

Plugin:: Cooked Pro
Plugin Slug:: cooked-pro
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.0
Severity Score:: Medium
CVE:: 2024-49289

Plugin:: EventON Pro
Plugin Slug:: eventon-wordpress-event-calendar-plugin
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 4.7
Severity Score:: Medium
CVE:: 2023-6243

Plugin:: Nextend Social Login Pro
Plugin Slug:: nextend-social-login-pro
Vulnerability:: Broken Authentication
Patched in Version:: 3.1.15
Severity Score:: Critical
CVE:: 2024-9893

Plugin:: Social Auto Poster
Plugin Slug:: social-auto-poster
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 5.3.16
Severity Score:: Medium
CVE:: 2024-49272

Plugin:: Time Clock Pro
Plugin Slug:: time-clock-pro
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 1.1.5
Severity Score:: High
CVE:: 2024-9593

Plugin:: File Manager Pro
Plugin Slug:: wp-file-manager-pro
Vulnerability:: Arbitrary File Upload
Patched in Version:: 8.3.10
Severity Score:: High
CVE:: 2024-8918

Plugin:: File Manager Pro
Plugin Slug:: wp-file-manager-pro
Vulnerability:: Broken Access Control
Patched in Version:: 8.3.10
Severity Score:: High
CVE:: 2024-8746

Plugin:: File Manager Pro
Plugin Slug:: wp-file-manager-pro
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 8.3.10
Severity Score:: High
CVE:: 2024-8507

WordPress Themes � 1 Patched / 5 Unpatched

Theme:: Digitally
Theme Slug:: digitally
Downloads: 8,046
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49309

Theme:: disconnected
Theme Slug:: disconnected
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49268

Theme:: js paper
Theme Slug:: js-paper
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49678

Theme:: my flatonica
Theme Slug:: my-flatonica
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49269

Theme:: my wooden under construction
Theme Slug:: my-wooden-under-construction
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49269

Theme:: Mags
Theme Slug:: mags
Downloads: 25,887
Vulnerability:: Local File Inclusion
Patched in Version:: 1.1.7
Severity Score:: High
CVE:: 2024-49701