Explore CVE records

MedPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54309

WordPress PostBox plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in wpdebuglog PostBox postbox-email-logs allows Retrieve Embedded Sensitive Data.This issue affects PostBox: from n/a through <= 1.0.4.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54308

WordPress Cryptocurrency Price Widget plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Cryptocurrency Price Widget cryptocurrency-price-widget allows Stored XSS.This issue affects Cryptocurrency Price Widget: from n/a through <= 1.2.3.

Excerpt language: en.

MedPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54307

WordPress AIcomments plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in aipost AIcomments aicomments allows Cross Site Request Forgery.This issue affects AIcomments: from n/a through <= 1.4.1.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54306

WordPress AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in aitool AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot ai-seo-translator allows Cross Site Request Forgery.This issue affects AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot: from n/a through <= 1.6.2.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54305

WordPress J&T Express Malaysia plugin <= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtexpress J&T Express Malaysia jt-express allows Reflected XSS.This issue affects J&T Express Malaysia: from n/a through <= 2.0.13.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:38 WIB

Official record

HighPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54304

WordPress Hive Support plugin <= 1.1.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hive Support Hive Support hive-support allows SQL Injection.This issue affects Hive Support: from n/a through <= 1.1.2.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54303

WordPress Simple Payment plugin <= 2.3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ido Kobelkowsky Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through <= 2.3.8.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54302

WordPress VForm plugin <= 3.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Ratudi VPSUForm v-form allows Reflected XSS.This issue affects VPSUForm: from n/a through <= 3.0.0.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54301

WordPress FormFacade plugin <= 1.3.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in manidoraisamy FormFacade formfacade allows Reflected XSS.This issue affects FormFacade: from n/a through <= 1.3.6.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54300

WordPress AutoWP plugin <= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Cross Site Request Forgery.This issue affects AutoWP: from n/a through <= 2.0.8.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 05:22 WIB

Official record

HighPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54299

WordPress Revi.io plugin <= 5.7.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revidev Revi.io revi-io-customer-and-product-reviews allows Reflected XSS.This issue affects Revi.io: from n/a through <= 5.7.3.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 05:21 WIB

Official record

MedPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54298

WordPress Car Dealer plugin <= 4.46 - Broken Access Control vulnerability

Missing Authorization vulnerability in sminozzi Car Dealer cardealer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Dealer: from n/a through <= 4.46.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54297

WordPress vBSSO-lite plugin <= 1.4.3 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in extremeidea vBSSO-lite vbsso-lite allows Authentication Bypass.This issue affects vBSSO-lite: from n/a through <= 1.4.3.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54296

WordPress CoSchool LMS plugin <= 1.4.3 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Codexpert, Inc CoSchool LMS coschool allows Authentication Bypass.This issue affects CoSchool LMS: from n/a through <= 1.4.3.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54295

WordPress ListApp Mobile Manager plugin <= 1.7.7 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder ListApp Mobile Manager listapp-mobile-manager allows Authentication Bypass.This issue affects ListApp Mobile Manager: from n/a through <= 1.7.7.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:38 WIB

Official record

CritPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54294

WordPress Firebase OTP Authentication plugin <= 1.0.1 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Appgenix Infotech Firebase OTP Authentication authentication-via-otp-using-firebase allows Authentication Bypass.This issue affects Firebase OTP Authentication: from n/a through <= 1.0.1.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54293

WordPress CE21 Suite plugin <= 2.2.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in CE21 CE21 Suite ce21-suite allows Privilege Escalation.This issue affects CE21 Suite: from n/a through <= 2.2.0.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54292

WordPress Appsplate plugin <= 2.1.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsplate Appsplate appsplate allows SQL Injection.This issue affects Appsplate: from n/a through <= 2.1.3.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54290

WordPress Role Includer plugin <= 1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Fletcher Role Includer role-includer allows Reflected XSS.This issue affects Role Includer: from n/a through <= 1.6.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 13 Dec 2024, 21:25 WIB

CVE-2024-54289

WordPress Awesome Support plugin <= 6.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.3.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:40 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage