| CVE-2024-0975 | WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API | brandonwamboldt | WordPress Access Control | Medium | 5.3 | 2024-02-28 08:33:06 | Deep Dive |
| CVE-2024-1650 | Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory | frenify | Categorify – WordPress Media Library Category & File Manager | Medium | 4.3 | 2024-02-27 11:05:11 | Deep Dive |
| CVE-2024-1649 | Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory | frenify | Categorify – WordPress Media Library Category & File Manager | Medium | 4.3 | 2024-02-27 11:05:10 | Deep Dive |
| CVE-2024-1910 | Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxClearCategory | frenify | Categorify – WordPress Media Library Category & File Manager | Medium | 4.3 | 2024-02-27 11:05:10 | Deep Dive |
| CVE-2024-1652 | Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory | frenify | Categorify – WordPress Media Library Category & File Manager | Medium | 4.3 | 2024-02-27 11:05:09 | Deep Dive |
| CVE-2024-1906 | Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxAddCategory | frenify | Categorify – WordPress Media Library Category & File Manager | Medium | 4.3 | 2024-02-27 11:05:08 | Deep Dive |
| CVE-2024-1912 | Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition | frenify | Categorify – WordPress Media Library Category & File Manager | Medium | 4.3 | 2024-02-27 11:05:08 | Deep Dive |
| CVE-2024-1653 | Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition | frenify | Categorify – WordPress Media Library Category & File Manager | Medium | 4.3 | 2024-02-27 11:05:07 | Deep Dive |
| CVE-2024-1909 | Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategory | frenify | Categorify – WordPress Media Library Category & File Manager | Medium | 4.3 | 2024-02-27 11:05:07 | Deep Dive |
| CVE-2024-1907 | Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategory | frenify | Categorify – WordPress Media Library Category & File Manager | Medium | 4.3 | 2024-02-27 11:05:06 | Deep Dive |
| CVE-2023-5775 | BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password | wp_media | BackWPup – WordPress Backup & Restore Plugin | Low | 2.2 | 2024-02-24 08:38:15 | Deep Dive |
| CVE-2024-24837 | Cross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress plugins | Frédéric GILLES | FG PrestaShop to WooCommerce | Medium | 4.3 | 2024-02-21 07:18:55 | Deep Dive |
| CVE-2024-1081 | 3D FlipBook – PDF Flipbook WordPress <= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarks | iberezansky | 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery | Medium | 6.4 | 2024-02-21 06:47:57 | Deep Dive |
| CVE-2024-1218 | Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization | wpchill | Kali Forms — Contact Form & Drag-and-Drop Builder | Medium | 4.3 | 2024-02-20 18:56:50 | Deep Dive |
| CVE-2024-0604 | Best WordPress Gallery Plugin – FooGallery <= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settings | fooplugins | Gallery by FooGallery | Medium | 4.4 | 2024-02-20 18:56:47 | Deep Dive |
| CVE-2024-0656 | Password Protected <= 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting | saadiqbal | Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content | Medium | 4.4 | 2024-02-20 18:56:40 | Deep Dive |
| CVE-2024-1322 | Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change | wpwax | Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium | 5.3 | 2024-02-20 18:56:39 | Deep Dive |
| CVE-2024-1217 | Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation | wpchill | Kali Forms — Contact Form & Drag-and-Drop Builder | High | 7.6 | 2024-02-20 18:56:35 | Deep Dive |
| CVE-2024-1512 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection | stylemix | MasterStudy LMS WordPress Plugin – for Online Courses and Education | Critical | 9.8 | 2024-02-17 07:36:57 | Deep Dive |
| CVE-2024-0420 | MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSS | Unknown | MapPress Maps for WordPress | 中危 | - | 2024-02-12 16:05:59 | Deep Dive |