Vulnerabilities

DATE CVE VULNERABILITY TITLE RISK
2025-01-31 CVE-2025-24686 Cross-site Scripting vulnerability in Metagauss Registrationmagic
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss User Registration Forms RegistrationMagic allows Reflected XSS.
network
low complexity
metagauss CWE-79
6.1
6.1
2025-01-31 CVE-2024-13530 The Custom Login Page Styler – Limit Login Attempts – Restrict Content With Login – Redirect After Login – Change Login URL – Sign in , Sign out plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the lps_handle_delete_all_logs(), lps_handle_delete_login_log(), and lps_handle_end_session() functions in all versions up to, and including, 7.1.1.
network
low complexity
CWE-862
4.3
4.3
2025-01-31 CVE-2024-13623 The Order Export for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.24 via the 'uploads' directory.
network
high complexity
CWE-200
5.9
5.9
2025-01-31 CVE-2024-11886 The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler ' shortcode in all versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping on user supplied attributes.
network
low complexity
CWE-79
6.4
6.4
2025-01-31 CVE-2024-12772 Cross-site Scripting vulnerability in Wpmanageninja Ninja Tables
The Ninja Tables WordPress plugin before 5.0.17 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, leading to a Cross Site Scripting vulnerability.
network
low complexity
wpmanageninja CWE-79
5.4
5.4
2025-01-31 CVE-2024-13216 The HT Event – WordPress Event Manager Plugin for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.7 via the 'render' function in /includes/widgets/htevent_sponsor.php.
network
low complexity
CWE-359
4.3
4.3
2025-01-31 CVE-2024-13415 The Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function in all versions up to, and including, 5.1.4.
network
low complexity
CWE-862
4.3
4.3
2025-01-31 CVE-2024-13424 The Ni Sales Commission For WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'niwoosc_ajax' AJAX endpoint in all versions up to, and including, 1.2.4.
network
low complexity
CWE-862
4.3
4.3
2025-01-31 CVE-2024-13504 The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dfxp File uploads in all versions up to, and including, 1.7.42 due to insufficient input sanitization and output escaping.
network
low complexity
CWE-79
7.2
7.2
2025-01-31 CVE-2024-13717 The Contact Form and Calls To Action by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_ajax_toggle_ae and vcita_ajax_toggle_contact functions in all versions up to, and including, 2.7.1.
network
low complexity
CWE-862
4.3
4.3