newsThe portal itself — self-promo until real sponsors land
Subscribe, build a custom feed, or pitch a sponsorship at hello@acadenix.com
Latest intel// live feed
25 results//sorted by published//last sync 2026-07-13 10:00Z
Subscribe to news →
CVE-2024-1538 — Filemanagerpro File_manager: The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all
The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile
8.8
CVSS v3.1
96
Edit Score
CVE-2024-1202 — Authentication: Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass.
Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass. This issue affects Octopod: before v1. NOTE: The vendor was contacted and it was learned that the product is not supported. CVSSv3.1 9.8 (CRITICAL) · EPSS 21th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2024-25294 — Getrebuild Rebuild: An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information
An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload,URL parameters. CVSSv3.1 9.1 (CRITICAL) · EPSS 57th percentile
9.1
CVSS v3.1
96
Edit Score
CVE-2024-28735 — Unit4 Financials_by_coda: Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control
Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request. CVSSv3.1 8.1 (HIGH) · EPSS 50th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2024-1711 — Create: The Create by Mediavine plugin for WordPress is vulnerable to SQL Injection via the
The Create by Mediavine plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.9.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 79th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2024-1205 — Wemanage Wemanage: The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring
The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the nouvello_upload_csv_file function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution p CVSSv3.1 8.8 (HIGH) · EPSS 90th percentile
8.8
CVSS v3.1
96
Edit Score
CVE-2024-1799 — Gamipress Gamipress: The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks
The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to SQL Injection via the 'achievement_types' attribute of the gamipress_earnings shortcode in all versions up to, and including, 6.8.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access an CVSSv3.1 8.8 (HIGH) · EPSS 48th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-2387 — Advanced: The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets
The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms plugin for WordPress is vulnerable to SQL Injection via the ‘integration_id’ parameter in all versions up to, and including, 1.82.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries a CVSSv3.1 6.1 (MEDIUM) · EPSS 97th percentile
6.1
CVSS v3.1
92
Edit Score
CVE-2024-29136 — Themefic Tourfic: Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a
Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17. CVSSv3.1 8.5 (HIGH)
8.5
CVSS v3.1
93
Edit Score
CVE-2024-29135 — Themefic Tourfic: Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects
Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15. CVSSv3.1 9.9 (CRITICAL) · EPSS 69th percentile
9.9
CVSS v3.1
100
Edit Score
CVE-2024-1685 — Sygnoos Social_media_share_buttons: The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection
The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of untrusted input through the attachmentUrl parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it cou CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-1795 — Pluginus Husky_-_products_filter_professional_for_woocommerce: The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to SQL Injection via the 'name' parameter in the woof shortcode in all versions up to, and including, 1.3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries CVSSv3.1 8.8 (HIGH) · EPSS 60th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-2242 — Rocklobster Contact_form_7: The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via
The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVSSv3.1 6.1 (MEDIUM) · EPSS 99th percentile
6.1
CVSS v3.1
100
Edit Score
CVE-2024-2194 — Statistics: The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVSSv3.1 7.2 (HIGH) · EPSS 96th percentile
7.2
CVSS v3.1
94
Edit Score
CVE-2024-2172 — Malware: The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by
The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator. CVSSv3.1 9.8 (CRITICAL) · EPSS 78th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2024-2006 — Wpwax Post_grid\,_slider_\&_carousel_ultimate: The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.7 via deserialization of untrusted input in the outpost_shortcode_metabox_markup function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the CVSSv3.1 8.8 (HIGH) · EPSS 84th percentile
8.8
CVSS v3.1
95
Edit Score
CVE-2024-1862 — Renventura Woocommerce_add_to_cart_custom_redirect: The WooCommerce Add to Cart Custom Redirect plugin for WordPress is vulnerable to unauthorized
The WooCommerce Add to Cart Custom Redirect plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wcr_dismiss_admin_notice' function in all versions up to, and including, 1.2.13. This makes it possible for authenticated attackers, with contributor access and above, to update the values of arbitrary site options to 'dismissed'. CVSSv3.1 8.1 (HIGH) · EPSS 42th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2024-1772 — Hammadh Play.ht: The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin
The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.4 via deserialization of untrusted input from the play_podcast_data post meta. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or t CVSSv3.1 8.8 (HIGH) · EPSS 73th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-1751 — Themeum Tutor_lms: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can b CVSSv3.1 8.8 (HIGH) · EPSS 97th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2024-1505 — Kodezen Academy_lms: The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress
The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info() function. This makes it possible for authenticated attackers, with minimal permissions such as students, to elevate their user role to that of an administrator. CVSSv3.1 8.8 (HIGH) · EPSS 39th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-1380 — Relevanssi Relevanssi: The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access
The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssi_export_log_check() function in all versions up to, and including, 4.22.0 (Free) and 2.25.0 (Premium). This makes it possible for unauthenticated attackers to export the query log data. The vendor has indicated that they may look into adding a capability check for proper authorization control, however, this vulnerability is theo CVSSv3.1 5.3 (MEDIUM) · EPSS 99th percentile
5.3
CVSS v3.1
100
Edit Score
CVE-2024-1358 — Webtechstreet Elementor_addon_elements: The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all
The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on the server, which may expose sensitive information. CVSSv3.1 8.8 (HIGH) · EPSS 86th percentile
8.8
CVSS v3.1
95
Edit Score
CVE-2024-1311 — Brizy Brizy: The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads
The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all versions up to, and including, 2.4.40. This makes it possible for authenticated attackers, with contributor access or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH) · EPSS 93th percentile
8.8
CVSS v3.1
97
Edit Score
CVE-2024-1203 — Conversios Conversios: The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag
The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 7.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into a CVSSv3.1 8.8 (HIGH) · EPSS 72th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-0683 — Autopolis Bulgarisation_for_woocommerce: The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to
The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in all versions up to, and including, 3.0.14. This makes it possible for unauthenticated and authenticated attackers, with subscriber-level access and above, to generate and delete labels. CVSSv3.1 7.3 (HIGH) · EPSS 96th percentile
7.3
CVSS v3.1
94
Edit Score