Wordfence Intelligence Weekly WordPress Vulnerability Report (November 25, 2024 to December 1, 2024)

by

💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program. Through January 6th, 2025:

  • All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
  • All plugins and themes with 50-999 active installs hosted in the WordPress.org repository and updated within the last 2 years are in-scope for all researchers!
  • All plugins and themes hosted in the WordPress.org repository with any install count are in scope for our preset list of high threat vulnerabilities.
  • $150 bonus awarded when a researcher submits at least 15 valid high threat vulnerabilities, and then a $50 bonus awarded for every 5 submitted thereafter.
  • Minimum bounty of $5 for all valid in-scope submissions.
  • All researchers earn automatic bonuses of between 5% to 180% for valid submissions
  • Pending report limits are increased for all
  • It’s possible to earn up to $31,200 for high impact vulnerabilities!

Last week, there were 104 vulnerabilities disclosed in 103 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 39 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 20,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

  •  WAF-RULE-773 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 50
Unpatched 54

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 90
High Severity 8
Critical Severity 6

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) 49
Cross-Site Request Forgery (CSRF) 23
Missing Authorization 6
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) 4
Authorization Bypass Through User-Controlled Key 3
Exposure of Sensitive Information to an Unauthorized Actor 3
Unrestricted Upload of File with Dangerous Type 3
Improper Control of Generation of Code (‘Code Injection’) 2
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) 2
Authentication Bypass Using an Alternate Path or Channel 1
Improper Authorization 1
Improper Check or Handling of Exceptional Conditions 1
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) 1
Improper Handling of Missing Values 1
Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) 1
Incorrect Conversion between Numeric Types 1
Path Traversal: ‘…/…//’ 1
Weak Password Recovery Mechanism for Forgotten Password 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
26
7
6
6
6
5

Gab
4
4
2
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
Additional Order Filters for WooCommerce additional-order-filters-for-woocommerce
Advanced What should we write next about advanced-what-should-we-write-about-next
AppPresser – Mobile App Framework apppresser
ArCa Payment Gateway arca-payment-gateway
Best Addons for Elementor best-addons-for-elementor
BNE Gallery Extended bne-gallery-extended
Booking & Appointment Plugin for WooCommerce woocommerce-booking
Booking calendar, Appointment Booking System booking-calendar
Booster for WooCommerce woocommerce-jetpack
Build App Online build-app-online
Capitalize My Title WordPress Plugin capitalize-my-title
Chatter chatter
CM Business Directory Plugin – Business Listing Directory cm-business-directory
CM Header & Footer Script Loader – Insert Script Plugin cm-header-footer-script-loader
CM Pop-Up Banners for WordPress cm-pop-up-banners
CM Tooltip Glossary enhanced-tooltipglossary
CM WordPress Search And Replace Plugin cm-on-demand-search-and-replace
Content Audit Exporter content-audit-exporter
Countdown Timer for Elementor countdown-timer-for-elementor
Counter Up – Animated Number Counter & Milestone Showcase wp-counter-up
Cowidgets – Elementor Addons cowidgets-elementor-addons
CultBooking Hotel Booking Engine cultbooking-booking-engine
Custom Post Type to Map Store cpt-to-map-store
DancePress (TRWA) dancepress-trwa
Devnex Addons For Elementor devnex-addons-for-elementor
Donate Me donate-me
Elementor Button Plus fd-elementor-button-plus
Elementor Image Gallery Plugin ( Masonry Gallery, Elementor Gallery Plugin With Captions, Elementor Portfolio Gallery Widget, Filterable Gallery ) skyboot-portfolio-gallery
Elementor Website Builder – More than Just a Page Builder elementor
EmbedPress – Embed PDF, PDF 3D FlipBook, Instagram Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Maps & Upload PDF Documents embedpress
Essential Breadcrumbs essential-breadcrumbs
FAQ Builder AYS faq-builder-ays
FastBook – Responsive Appointment Booking and Scheduling System fastbook-responsive-appointment-booking-and-scheduling-system
File Manager Pro – Filester filester
HLS Player hls-player
Hustle – Email Marketing, Lead Generation, Optins, Popups wordpress-popup
Image Alt Text image-alt-text
InPost Gallery inpost-gallery
Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) automatic-internal-links-for-seo
Jeg Elementor Kit jeg-elementor-kit
JobSearch WP Job Board wp-jobsearch
Kudos Donations – Easy donations and payments with Mollie kudos-donations
LegalWeb Cloud legalweb-cloud
Lenxel Core lenxel-core
Load More Posts load-more-posts
Login with Vipps and MobilePay login-with-vipps
Mins To Read mins-to-read
Multilevel Referral Affiliate Plugin for WooCommerce multilevel-referral-plugin-for-woocommerce
Name: CM E-Mail Registration Blacklist cm-email-blacklist
Newsletter, Email Marketing, Email Subscriber – Mail Picker mail-picker
Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE otter-blocks
Out Of Stock Badge out-of-stock-badge
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress wp-user-avatar
Parsi Date wp-parsidate
PayPal Responder paypal-responder
Photo Video Store photo-video-store
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons contest-gallery
Pixobe Cartography pixobe-cartography
Plugin Plugin
Post Carousel Slider for Elementor post-carousel-slider-for-elementor
Pricing Tables For WPBakery Page Builder (formerly Visual Composer) pricing-tables-for-visual-composer
Primary Addon for Elementor primary-addon-for-elementor
Product Input Fields for WooCommerce product-input-fields-for-woocommerce
Ragic Shortcode ragic-shortcode
Random Banner random-banner
Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor
RingCentral Communications Plugin – FREE rccp-free
Royal Elementor Addons and Templates royal-elementor-addons
Security & Malware scan by CleanTalk security-malware-firewall
SEO Landing Page Generator seo-landing-page-generator
Simple Header and Footer simple-header-and-footer
Simple Popup Plugin simple-popup-plugin
SimpleSchema Free simpleschema-free
Skt NURCaptcha skt-nurcaptcha
Smart Marketing SMS and Newsletters Forms smart-marketing-for-wp
Social Sharing Plugin – Sassy Social Share sassy-social-share
Softtemplates For Elementor softtemplates-for-elementor
Sp*tify Play Button for WordPress spotify-play-button-for-wordpress
Spam protection, Anti-Spam, FireWall by CleanTalk cleantalk-spam-protect
Sparkle Elementor Kit sparkle-elementor-kit
SpatialMatch IDX spatialmatch-free-lifestyle-search
StreamWeasels YouTube Integration streamweasels-youtube-integration
Stripe Donation bin-stripe-donation
Support SVG – Upload svg files in wordpress without hassle support-svg
Third Party Cookie Eraser third-party-cookie-eraser
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid boldgrid-backup
Tumult Hype Animations tumult-hype-animations
Vertical Carousel vertical-carousel-slider
Video Lessons Manager – WordPress LMS Plugin cm-video-lesson-manager
Video Player for WPBakery video-player-for-wpbakery
Wallet for WooCommerce woo-wallet
Watu Quiz watu
Widget Options – The WordPress Widget & Block Control Plugin widget-options
WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card
WordPress Contact Forms by Cimatti contact-forms
WordPress Portfolio Builder – Portfolio Gallery uber-grid
WP Find Your Nearest wp-find-your-nearest
WP MathJax wp-mathjax-plus
WP Mermaid wp-mermaid
Yahoo! WebPlayer yahoo-media-player
Znajdź Pracę z Praca.pl znajdz-prace-z-pracapl
소셜 공유 버튼 By 코스모스팜 cosmosfarm-share-buttons

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

Tumult Hype Animations <= 1.9.15 – Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-11082
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Tumult Hype Animations
Researcher
More Details >

Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 – Authenticated (Contributor+) Remote Code Execution

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-8672
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Widget Options – The #1 WordPress Widget & Block Control Plugin
Researcher
More Details >

AppPresser – Mobile App Framework <= 4.4.6 – Unauthenticated Privilege Escalation via Password Reset

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-11024
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
AppPresser – Mobile App Framework
Researcher
More Details >

Contest Gallery <= 24.0.7 – Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-11103
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons
Researcher
More Details >

Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 – Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10542
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Spam protection, Anti-Spam, FireWall by CleanTalk
Researcher
More Details >

WP JobSearch <= 2.6.7 – Authentication Bypass to Account Takeover and Privilege Escalation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-11925
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
JobSearch WP Job Board
Researcher
More Details >

Booking & Appointment Plugin for WooCommerce <= 6.9.0 – Authenticated (Subscriber+) Arbitrary Option Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-10729
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Booking & Appointment Plugin for WooCommerce
Researcher
More Details >

Lenxel Core <= 1.1 – Authenticated (Contributor+) Local File Inclusion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-53790
Patch Status
Unpatched
Published
Nov 29, 2024
Affected Software
Lenxel Core
Researcher
More Details >

Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 – Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installation

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-10781
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Spam protection, Anti-Spam, FireWall by CleanTalk
Researcher
More Details >

File Manager Pro – Filester <= 1.8.4 – Authenticated (Subscriber+) Arbitrary File Upload

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-8066
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
File Manager Pro – Filester
Researcher
More Details >

Security & Malware scan by CleanTalk <= 2.145 – Authorization Bypass via Reverse DNS Spoofing to Unauthenticated SQL Injection

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-10570
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Security & Malware scan by CleanTalk
Researcher
More Details >

Booking calendar, Appointment Booking System <= 3.2.15 – Unauthenticated Stored Cross-Site Scripting via SVG File Upload

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-9504
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Booking calendar, Appointment Booking System
Researcher
More Details >

File Manager Pro – Filester <= 1.8.5 – Authenticated (Administrator+) Local JavaScript File Inclusion

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-9669
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
File Manager Pro – Filester
Researcher
More Details >

Total Upkeep <= 1.16.6 – Authenticated (Administrator+) Remote Code Execution via Backup Settings

7.2
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-9461
Patch Status
Patched
Published
Nov 26, 2024
Affected Software
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
Researcher
More Details >

Product Input Fields for WooCommerce <= 1.9 – Authenticated (Contributor+) Arbitrary File Read

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-10857
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Product Input Fields for WooCommerce
Researcher
More Details >

Wallet for WooCommerce <= 1.5.6 – Authenticated (Subscriber+) Incorrect Conversion between Numeric Types

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-7747
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Wallet for WooCommerce
Researcher
More Details >

Watu Quiz <= 3.4.1.2 – Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-53792
Patch Status
Patched
Published
Nov 29, 2024
Affected Software
Watu Quiz
Researcher
More Details >

Best Addons for Elementor <= 1.0.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53763
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Best Addons for Elementor
Researcher
Gab
More Details >

BNE Gallery Extended <= 1.2.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11119
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
BNE Gallery Extended
Researcher
More Details >

Capitalize My Title <= 0.5.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53760
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Capitalize My Title WordPress Plugin
Researcher
More Details >

Countdown Timer for Elementor <= 1.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53743
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Countdown Timer for Elementor
Researcher
More Details >

Counter Up – Animated Number Counter & Milestone Showcase <= 2.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10895
Patch Status
Unpatched
Published
Nov 26, 2024
Affected Software
Counter Up – Animated Number Counter & Milestone Showcase
Researcher
More Details >

Cowidgets – Elementor Addons <= 1.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53786
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Cowidgets – Elementor Addons
Researcher
More Details >

Devnex Addons For Elementor <= 1.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53766
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Devnex Addons For Elementor
Researcher
Gab
More Details >

Elementor Button Plus <= 1.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53746
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Elementor Button Plus
Researcher
More Details >

Elementor Image Gallery Plugin <= 1.0.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53744
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Elementor Image Gallery Plugin ( Masonry Gallery, Elementor Gallery Plugin With Captions, Elementor Portfolio Gallery Widget, Filterable Gallery )
Researcher
More Details >

Elementor Website Builder – More than Just a Page Builder <= 3.25.7 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8236
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Elementor Website Builder – More than Just a Page Builder
Researcher
More Details >

EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via ‘provider_name’

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11203
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
EmbedPress – Embed PDF, PDF 3D FlipBook, Instagram Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Maps & Upload PDF Documents
Researcher
More Details >

HLS Player <= 1.0.10 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11333
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
HLS Player
Researcher
More Details >

Jeg Elementor Kit <= 2.6.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via JKit – Countdown Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10308
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Jeg Elementor Kit
Researcher
More Details >

LegalWeb Cloud <= 1.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11761
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
LegalWeb Cloud
Researcher
More Details >

Lenxel Core <= 1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53791
Patch Status
Unpatched
Published
Nov 29, 2024
Affected Software
Lenxel Core
Researcher
More Details >

Login with Vipps and MobilePay <= 1.3.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11786
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Login with Vipps and MobilePay
Researcher
More Details >

Mail Picker <= 1.0.14 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53772
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Newsletter, Email Marketing, Email Subscriber – Mail Picker
Researcher
More Details >

Pixobe Cartography <= 1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53767
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Pixobe Cartography
Researcher
More Details >

Post Carousel Slider for Elementor <= 1.4.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53749
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Post Carousel Slider for Elementor
Researcher
More Details >

Pricing Tables For WPBakery Page Builder (formerly Visual Composer) <= 1.4 – Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10175
Patch Status
Unpatched
Published
Nov 26, 2024
Affected Software
Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
Researcher
More Details >

Ragic Shortcode <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11431
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Ragic Shortcode
Researcher
More Details >

Random Banner <= 4.2.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53787
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Random Banner
Researcher
More Details >

Simple Popup <= 4.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53741
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Simple Popup Plugin
Researcher
More Details >

SimpleSchema <= 1.7.6.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53771
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
SimpleSchema Free
Researcher
More Details >

Softtemplates For Elementor <= 1.0.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53764
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Softtemplates For Elementor
Researcher
Gab
More Details >

Sparkle Elementor Kit <= 2.0.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53774
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Sparkle Elementor Kit
Researcher
Gab
More Details >

Spotify Play Button for WordPress <= 2.11 – Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11192
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Sp*tify Play Button for WordPress
Researcher
More Details >

StreamWeasels YouTube Integration <= 1.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11788
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
StreamWeasels YouTube Integration
Researcher
More Details >

Stripe Donation <= 1.2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53752
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Stripe Donation
Researcher
More Details >

Support SVG – Upload svg files in wordpress without hassle <= 1.1.0 – Authenticated (Author+) Stored Cross-site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-11091
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Support SVG – Upload svg files in wordpress without hassle
Researcher
More Details >

Vertical Carousel <= 1.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53756
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Vertical Carousel
Researcher
More Details >

Video Player for WPBakery <= 1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53747
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Video Player for WPBakery
Researcher
More Details >

WP Find Your Nearest <= 0.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53757
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
WP Find Your Nearest
Researcher
More Details >

WP MathJax <= 1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53758
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
WP MathJax
Researcher
More Details >

WP Mermaid <= 1.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53748
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
WP Mermaid
Researcher
More Details >

Znajdź Pracę z Praca.pl <= 2.2.3 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53773
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Znajdź Pracę z Praca.pl
Researcher
More Details >

소셜 공유 버튼 By 코스모스팜 <= 1.9 – Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-53745
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
소셜 공유 버튼 By 코스모스팜
Researcher
More Details >

InPost Gallery <= 2.1.4.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_template

6.3
CVSS Rating
Medium (6.3)
CVE-ID
CVE-2024-11002
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
InPost Gallery
Researcher
More Details >

Additional Order Filters for WooCommerce <= 1.21 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11418
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Additional Order Filters for WooCommerce
Researcher
More Details >

CultBooking Hotel Booking Engine <= 2.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53753
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
CultBooking Hotel Booking Engine
Researcher
More Details >

Custom Post Type to Map Store <= 1.1.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53769
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Custom Post Type to Map Store
Researcher
More Details >

Donate Me <= 1.2.5 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53776
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Donate Me
Researcher
More Details >

Essential Breadcrumbs <= 1.1.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53778
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Essential Breadcrumbs
Researcher
More Details >

FAQ Builder AYS <= 1.7.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11458
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
FAQ Builder AYS
Researcher
More Details >

FastBook – Responsive Appointment Booking and Scheduling System <= 1.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53762
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
FastBook – Responsive Appointment Booking and Scheduling System
Researcher
More Details >

Kudos Donations – Easy donations and payments with Mollie <= 3.2.9 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11684
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Kudos Donations – Easy donations and payments with Mollie
Researcher
More Details >

Kudos Donations – Easy donations and payments with Mollie <= 3.2.9 – Reflected Cross-Site Scripting via ‘add_query_arg’

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11685
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Kudos Donations – Easy donations and payments with Mollie
Researcher
More Details >

Load More Posts <= 1.4.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53780
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Load More Posts
Researcher
More Details >

Mins To Read <= 1.2.2 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53765
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Mins To Read
Researcher
More Details >

Multilevel Referral Affiliate Plugin for WooCommerce <= 2.27 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53742
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Multilevel Referral Affiliate Plugin for WooCommerce
Researcher
More Details >

Multiple Plugins <= (Various Versions) – Reflected Cross-Site Scripting via cminds_free_guide Shortcode

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11202
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
CM WordPress Search And Replace Plugin
Video Lessons Manager – WordPress LMS Plugin
CM Tooltip Glossary
CM Pop-Up Banners for WordPress
CM Header & Footer Script Loader – Insert Script Plugin
Name: CM E-Mail Registration Blacklist
CM Business Directory Plugin – Business Listing Directory
Researcher
More Details >

Out Of Stock Badge <= 1.3.1 – Cross-Site Request Forgery to Stored Cross-site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53754
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Out Of Stock Badge
Researcher
More Details >

Parsi Date <= 5.1.1 – Reflected Cross-Site Scripting via add_query_arg Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11032
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Parsi Date
Researcher
More Details >

PayPal Responder <= 1.2 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53750
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
PayPal Responder
Researcher
More Details >

Photo Video Store <= 21.07 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53782
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Photo Video Store
Researcher
More Details >

SEO Landing Page Generator <= 1.66.2 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11366
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
SEO Landing Page Generator
Researcher
More Details >

Simple Header and Footer <= 1.0.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53777
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Simple Header and Footer
Researcher
More Details >

Skt NURCaptcha <= 3.5.0 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11342
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Skt NURCaptcha
Researcher
More Details >

Social Sharing Plugin – Sassy Social Share <= 3.3.69 – Reflected Cross-Site Scripting via heateor_mastodon_share Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-11252
Patch Status
Patched
Published
Nov 29, 2024
Affected Software
Social Sharing Plugin – Sassy Social Share
Researcher
More Details >

SpatialMatch IDX <= 3.0.9 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53781
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
SpatialMatch IDX
Researcher
More Details >

Third Party Cookie Eraser <= 1.0.2 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53755
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Third Party Cookie Eraser
Researcher
More Details >

WooCommerce Ultimate Gift Card – Create, Sell and Manage Gift Cards with Customized Email Templates < 2.9.1 – Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53740
Patch Status
Patched
Published
Nov 28, 2024
Affected Software
WooCommerce Ultimate Gift Card
Researcher
More Details >

WP Revisions Manager <= 1.0.2 – Cross-Site Request Forgery

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53761
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Plugin
Researcher
More Details >

Yahoo! WebPlayer <= 2.0.6 – Cross-Site Request Forgery to Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-53779
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Yahoo! WebPlayer
Researcher(s): Unknown
More Details >

Booster for WooCommerce <= 7.2.3 – Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcode

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-9170
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Booster for WooCommerce
Researcher
More Details >

ArCa Payment Gateway <= 1.3.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-53759
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
ArCa Payment Gateway
Researcher
More Details >

RingCentral Communications <= 1.6.1 – Cross-Site Request Forgery to Stored Cross-Site Scripting

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-53770
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
RingCentral Communications Plugin – FREE
Researcher
More Details >

Content Audit Exporter <= 1.1 – Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-53768
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Content Audit Exporter
Researcher
More Details >

Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 – Missing Authorization to Unauthorized Form Submission

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-10580
Patch Status
Patched
Published
Nov 26, 2024
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups
Researcher
More Details >

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 – Unauthetnicated Path Traversal to Arbitrary Image View

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-11219
Patch Status
Patched
Published
Nov 26, 2024
Affected Software
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
Researcher
More Details >

ProfilePress <= 4.15.18 – Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-11083
Patch Status
Patched
Published
Nov 26, 2024
Affected Software
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
Researcher
More Details >

Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) <= 1.2.1 – Authenticated (Administrator+) SQL Injection via post_id Parameter

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-11009
Patch Status
Patched
Published
Nov 26, 2024
Affected Software
Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic)
Researcher
More Details >

Ni WooCommerce Cost Of Goods <= 3.2.8 – Authenticated (Administrator+) SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-53783
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Ni WooCommerce Cost Of Goods
Researcher
More Details >

DancePress (TRWA) <= 3.1.11 – Cross-Site Request Forgery

4.7
CVSS Rating
Medium (4.7)
CVE-ID
CVE-2024-53775
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
DancePress (TRWA)
Researcher
More Details >

WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 – Authenticated (Editor+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-53788
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
WordPress Portfolio Builder – Portfolio Gallery
Researcher
More Details >

Advanced What should we write next about <= 1.0.3 – Cross-Site Request Forgery to Stored Cross-Site Scripting

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53789
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Advanced What should we write next about
Researcher
More Details >

Build App Online <= 1.0.22 – Cross-Site Request Forgery

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53751
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Build App Online
Researcher
More Details >

Chatter <= 1.0.1 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53785
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Chatter
Researcher
More Details >

eDoc Easy Tables <= 1.29 – Cross-Site Request Forgery to SQL Injection

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53793
Patch Status
Unpatched
Published
Nov 29, 2024
Affected Software
Plugin
Researcher
More Details >

Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 – Missing Authorization to Unpublished Form Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10579
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups
Researcher
More Details >

Image Alt Text <= 2.0.0 – Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-11918
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Image Alt Text
Researchers
More Details >

Jeg Elementor Kit <= 2.6.9 – Authenticated (Contributor+) Sensitive Information Exposure via sg_content_template

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-8899
Patch Status
Patched
Published
Nov 25, 2024
Affected Software
Jeg Elementor Kit
Researcher
More Details >

Primary Addon for Elementor <= 1.6.2 – Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10670
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Primary Addon for Elementor
Researcher
More Details >

Restaurant & Cafe Addon for Elementor <= 1.5.9 – Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10780
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Restaurant & Cafe Addon for Elementor
Researcher
More Details >

Royal Elementor Addons and Templates <= 1.7.1003 – Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10798
Patch Status
Patched
Published
Nov 27, 2024
Affected Software
Royal Elementor Addons and Templates
Researcher
More Details >

Smart Marketing SMS and Newsletters Forms <= 5.0.9 – Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-53784
Patch Status
Unpatched
Published
Nov 28, 2024
Affected Software
Smart Marketing SMS and Newsletters Forms
Researcher
More Details >

WordPress Contact Forms by Cimatti <= 1.9.2 – Cross-Site Request Forgery via process_bulk_action Function

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10521
Patch Status
Patched
Published
Nov 26, 2024
Affected Software
WordPress Contact Forms by Cimatti
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (November 25, 2024 to December 1, 2024) appeared first on Wordfence.

Leave a Comment