Vulnerabilities

DATE CVE VULNERABILITY TITLE RISK
2024-11-21 CVE-2024-10796 The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be included.
network
low complexity
CWE-639
4.3
4.3
2024-11-21 CVE-2024-10890 The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.1.7.
network
low complexity
CWE-79
6.1
6.1
2024-11-21 CVE-2024-10898 The Contact Form 7 Email Add on plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the cf7_email_add_on_add_admin_template() function.
network
low complexity
CWE-98
8.8
8.8
2024-11-21 CVE-2024-11197 The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5.
network
high complexity
CWE-693
4.2
4.2
2024-11-21 CVE-2024-11334 The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportar_registros() function in all versions up to, and including, 2.0.
network
low complexity
CWE-862
4.3
4.3
2024-11-21 CVE-2024-11354 The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the del_ytsingvid() function in all versions up to, and including, 3.3.
network
low complexity
CWE-862
4.3
4.3
2024-11-21 CVE-2024-11360 The Page Parts plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.4.3.
network
low complexity
CWE-79
6.1
6.1
2024-11-21 CVE-2024-11365 The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.6.
network
low complexity
CWE-79
6.1
6.1
2024-11-21 CVE-2024-11370 The Subaccounts for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.6.0.
network
low complexity
CWE-79
6.1
6.1
2024-11-21 CVE-2024-11371 The Theater for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.18.6.2.
network
low complexity
CWE-79
6.1
6.1