Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises.

To help educate website owners about potential threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month.

The vulnerabilities listed below are virtually patched by the Sucuri Firewall and existing clients are protected. If you don’t have it installed yet, you can use our web application firewall to protect your site against known vulnerabilities.

WordPress 6.6.2 Maintenance Release

WordPress version 6.6.2 has been released! This update includes 15 bug fixes in the Core and 11 in the Block Editor, fixing issues like unexpected CSS specificity changes in various themes.

We strongly encourage WordPress users to always keep their CMS patched with the latest core updates to mitigate risk and protect the WordPress environment.

Plugin Vulnerabilities

Elementor Website Builder – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-5416
Number of Installations: 10,000,000+
Affected Software: Elementor Website Builder <= 3.23.9
Patched Versions: Elementor Website Builder 3.24.0

Mitigation steps: Update to Elementor Website Builder plugin version 3.24.0 or greater.

LiteSpeed Cache – Broken Authentication

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Broken Authentication
CVE: CVE-2024-44000
Number of Installations: 6,000,000+
Affected Software: LiteSpeed Cache <= 6.5.0
Patched Versions: LiteSpeed Cache 6.5.0.1

Mitigation steps: Update to LiteSpeed Cache plugin version 6.5.0.1 or greater.

Essential Addons for Elementor – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-8440
Number of Installations: 2,000,000+
Affected Software: Essential Addons for Elementor <= 6.0.3
Patched Versions: Essential Addons for Elementor 6.0.4

Mitigation steps: Update to Essential Addons for Elementor plugin version 6.0.4 or greater.

MC4WP: Mailchimp for WordPress – Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-8850
Number of Installations: 2,000,000+
Affected Software: MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16
Patched Versions: MC4WP: Mailchimp for WordPress 4.9.17

Mitigation steps: Update to MC4WP: Mailchimp for WordPress plugin version 4.9.17 or greater.

MC4WP: Mailchimp for WordPress – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-8680
Number of Installations: 2,000,000+
Affected Software: MC4WP: Mailchimp for WordPress <= 4.9.16
Patched Versions: MC4WP: Mailchimp for WordPress 4.9.17

Mitigation steps: Update to MC4WP: Mailchimp for WordPress plugin version 4.9.17 or greater.

W3 Total Cache – Sensitive Data Exposure

Security Risk: Low
Exploitation Level: No authentication required.
Vulnerability: Sensitive Data Exposure
CVE: CVE-2023-5359
Number of Installations: 1,000,000+
Affected Software: W3 Total Cache <= 2.7.5
Patched Versions: W3 Total Cache 2.7.6

Mitigation steps: Update to W3 Total Cache plugin version 2.7.6 or greater.

Ninja Forms – Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: N/A
Number of Installations: 800,000+
Affected Software: Ninja Forms <= 3.8.10
Patched Versions: Ninja Forms 3.8.11

Mitigation steps: Update to Ninja Forms plugin version 3.8.11 or greater.

Ninja Forms – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43999
Number of Installations: 800,000+
Affected Software: Ninja Forms <= 3.8.11
Patched Versions: Ninja Forms 3.8.12

Mitigation steps: Update to Ninja Forms plugin version 3.8.12 or greater.

Popup Maker – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-5561
Number of Installations: 700,000+
Affected Software: Popup Maker <= 1.19.0
Patched Versions: Popup Maker 1.19.1

Mitigation steps: Update to Popup Maker plugin version 1.19.1 or greater.

Migration, Backup, Staging – WPvivid – Sensitive Data Exposure

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Sensitive Data Exposure
CVE: CVE-2024-7315
Number of Installations: 500,000+
Affected Software: WPvivid <= 0.9.105
Patched Versions: WPvivid 0.9.106

Mitigation steps: Update to WPvivid plugin version 0.9.106 or greater.

Page Builder Gutenberg Blocks – CoBlocks – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-7132
Number of Installations: 400,000+
Affected Software: CoBlocks <= 3.1.12
Patched Versions: CoBlocks 3.1.13

Mitigation steps: Update to CoBlocks plugin version 3.1.13 or greater.

Contact Form Plugin by Fluent Forms – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-5053
Number of Installations: 400,000+
Affected Software: Fluent Forms <= 5.1.18
Patched Versions: Fluent Forms 5.1.19

Mitigation steps: Update to Fluent Forms plugin version 5.1.19 or greater.

PixelYourSite – Sensitive Data Exposure

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Sensitive Data Exposure
CVE: CVE-2024-7870
Number of Installations: 400,000+
Affected Software: PixelYourSite <= 9.7.1
Patched Versions: PixelYourSite 9.7.2

Mitigation steps: Update to PixelYourSite plugin version 9.7.2 or greater.

Royal Elementor Addons and Templates – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-44001
Number of Installations: 400,000+
Affected Software: Royal Elementor Addons <= 1.3.984
Patched Versions: Royal Elementor Addons 1.3.985

Mitigation steps: Update to Royal Elementor Addons plugin version 1.3.985 or greater.

HubSpot – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-5879
Number of Installations: 300,000+
Affected Software: HubSpot <= 11.1.33
Patched Versions: HubSpot 11.1.34

Mitigation steps: Update to HubSpot plugin version 11.1.34 or greater.

Backuply – SQL Injection

Security Risk: Medium
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: SQL Injection
CVE: CVE-2024-8669
Number of Installations: 200,000+
Affected Software: Backuply <= 1.3.4
Patched Versions: Backuply 1.3.5

Mitigation steps: Update to Backuply plugin version 1.3.5 or greater.

Jeg Elementor Kit – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-6804
Number of Installations: 200,000+
Affected Software: Jeg Elementor Kit <= 2.6.7
Patched Versions: Jeg Elementor Kit 2.6.8

Mitigation steps: Update to Jeg Elementor Kit plugin version 2.6.8 or greater.

Responsive Lightbox & Gallery – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2024-43924
Number of Installations: 200,000+
Affected Software: Responsive Lightbox & Gallery <= 2.4.7
Patched Versions: Responsive Lightbox & Gallery 2.4.8

Mitigation steps: Update to Responsive Lightbox & Gallery plugin version 2.4.8 or greater.

Photo Gallery by 10Web – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-44043
Number of Installations: 200,000+
Affected Software: Photo Gallery by 10Web <= 1.8.27
Patched Versions: Photo Gallery by 10Web 1.8.28

Mitigation steps: Update to Photo Gallery by 10Web plugin version 1.8.28 or greater.

Popup Builder – Sensitive Data Exposure

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Sensitive Data Exposure
CVE: CVE-2024-2541
Number of Installations: 200,000+
Affected Software: Popup Builder <= 4.3.3
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Beaver Builder – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-7895
Number of Installations: 100,000+
Affected Software: Beaver Builder <= 2.8.3.5
Patched Versions: Beaver Builder 2.8.3.6

Mitigation steps: Update to Beaver Builder plugin version 2.8.3.6 or greater.

Beaver Builder – Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43926
Number of Installations: 100,000+
Affected Software: Beaver Builder <= 2.8.3.3
Patched Versions: Beaver Builder 2.8.3.4

Mitigation steps: Update to Beaver Builder plugin version 2.8.3.4 or greater.

EmbedPress – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43936
Number of Installations: 100,000+
Affected Software: EmbedPress <= 4.0.8
Patched Versions: EmbedPress 4.0.9

Mitigation steps: Update to EmbedPress plugin version 4.0.9 or greater.

My Sticky Bar – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-7133
Number of Installations: 100,000+
Affected Software: My Sticky Bar <= 2.7.2
Patched Versions: My Sticky Bar 2.7.3

Mitigation steps: Update to My Sticky Bar plugin version 2.7.3 or greater.

Envira Photo Gallery – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-3899
Number of Installations: 100,000+
Affected Software: Envira Photo Gallery <= 1.8.14
Patched Versions: Envira Photo Gallery 1.8.15

Mitigation steps: Update to Envira Photo Gallery plugin version 1.8.15 or greater.

Envira Photo Gallery – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43925
Number of Installations: 100,000+
Affected Software: Envira Photo Gallery <= 1.8.14
Patched Versions: Envira Photo Gallery 1.8.15

Mitigation steps: Update to Envira Photo Gallery plugin version 1.8.15 or greater.

GiveWP – Sensitive Data Exposure

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Sensitive Data Exposure
CVE: CVE-2024-6551
Number of Installations: 100,000+
Affected Software: GiveWP <= 3.15.9
Patched Versions: GiveWP 3.16.0

Mitigation steps: Update to GiveWP plugin version 3.16.0 or greater.

Ivory Search – WordPress Search Plugin – Sensitive Data Exposure

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Sensitive Data Exposure
CVE: CVE-2024-6835
Number of Installations: 100,000+
Affected Software: Ivory Search – WordPress Search Plugin <= 5.5.6
Patched Versions: Ivory Search – WordPress Search Plugin 5.5.7

Mitigation steps: Update to Ivory Search plugin version 5.5.7 or greater.

NitroPack – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2024-43922
Number of Installations: 100,000+
Affected Software: NitroPack <= 1.16.7
Patched Versions: NitroPack 1.16.8

Mitigation steps: Update to NitroPack plugin version 1.16.8 or greater.

Page Builder: Pagelayer – Drag and Drop website builder – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43972
Number of Installations: 100,000+
Affected Software: Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.7
Patched Versions: Page Builder: Pagelayer – Drag and Drop website builder 1.8.8

Mitigation steps: Update to Page Builder: Pagelayer plugin version 1.8.8 or greater.

The Plus Addons for Elementor – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43977
Number of Installations: 100,000+
Affected Software: The Plus Addons for Elementor <= 5.6.2
Patched Versions: The Plus Addons for Elementor 5.6.3

Mitigation steps: Update to The Plus Addons for Elementor plugin version 5.6.3 or greater.

The Plus Addons for Elementor – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43932
Number of Installations: 100,000+
Affected Software: The Plus Addons for Elementor <= 5.6.2
Patched Versions: The Plus Addons for Elementor – 5.6.3

Mitigation steps: Update to The Plus Addons for Elementor plugin version 5.6.3 or greater.

The Post Grid – Sensitive Data Exposure

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Sensitive Data Exposure
CVE: CVE-2024-7418
Number of Installations: 100,000+
Affected Software: The Post Grid <= 7.7.11
Patched Versions: The Post Grid – 7.7.12

Mitigation steps: Update to The Post Grid plugin version 7.7.12 or greater.

WooCommerce Multilingual & Multicurrency with WPML – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-44006
Number of Installations: 100,000+
Affected Software: WooCommerce Multilingual & Multicurrency with WPML <= 5.3.6
Patched Versions: WooCommerce Multilingual & Multicurrency with WPML 5.3.7

Mitigation steps: Update to WooCommerce Multilingual & Multicurrency with WPML plugin version 5.3.7 or greater.

YARPP – Yet Another Related Posts Plugin – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2024-43919
Number of Installations: 100,000+
Affected Software: YARPP – Yet Another Related Posts Plugin <= 5.30.10
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

LearnPress – WordPress LMS Plugin – SQL Injection

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: SQL Injection
CVE: CVE-2024-8522
Number of Installations: 90,000+
Affected Software: LearnPress – WordPress LMS Plugin <= 4.2.7
Patched Versions: LearnPress – WordPress LMS Plugin 4.2.7.1

Mitigation steps: Update to LearnPress plugin version 4.2.7.1 or greater.

LearnPress – WordPress LMS Plugin – SQL Injection

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: SQL Injection
CVE: CVE-2024-8529
Number of Installations: 90,000+
Affected Software: LearnPress – WordPress LMS Plugin <= 4.2.7
Patched Versions: LearnPress – WordPress LMS Plugin 4.2.7.1

Mitigation steps: Update to LearnPress plugin version 4.2.7.1 or greater.

Ninja Tables – Easiest Data Table Builder – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-7304
Number of Installations: 90,000+
Affected Software: Ninja Tables – Easiest Data Table Builder <= 5.0.12
Patched Versions: Ninja Tables – Easiest Data Table Builder 5.0.13

Mitigation steps: Update to Ninja Tables plugin version 5.0.13 or greater.

Permalink Manager Lite – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2024-8195
Number of Installations: 90,000+
Affected Software: Permalink Manager Lite <= 2.4.4
Patched Versions: Permalink Manager Lite 2.4.4.1

Mitigation steps: Update to Permalink Manager Lite plugin version 2.4.4.1 or greater.

AI Engine – SQL Injection

Security Risk: Medium
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: SQL Injection
CVE: CVE-2024-6723
Number of Installations: 80,000+
Affected Software: AI Engine <= 2.4.7
Patched Versions: AI Engine 2.4.8

Mitigation steps: Update to AI Engine plugin version 2.4.8 or greater.

WP ULike – The Ultimate Engagement Toolkit for Websites – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-6792
Number of Installations: 80,000+
Affected Software: WP ULike – The Ultimate Engagement Toolkit for Websites <= 4.7.2
Patched Versions: WP ULike – The Ultimate Engagement Toolkit for Websites 4.7.2.1

Mitigation steps: Update to WP ULike plugin version 4.7.2.1 or greater.

Reviews Feed – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-8199
Number of Installations: 70,000+
Affected Software: Reviews Feed <= 1.1.9
Patched Versions: Reviews Feed 1.2.0

Mitigation steps: Update to Reviews Feed plugin version 1.2.0 or greater.

FOX – Currency Switcher Professional for WooCommerce – Broken Access Control

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2024-8271
Number of Installations: 60,000+
Affected Software: FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1
Patched Versions: FOX – Currency Switcher Professional for WooCommerce 1.4.2.2

Mitigation steps: Update to FOX plugin version 1.4.2.2 or greater.

WP Booking Calendar – Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-8274
Number of Installations: 50,000+
Affected Software: WP Booking Calendar <= 10.5.0
Patched Versions: WP Booking Calendar 10.5.1

Mitigation steps: Update to WP Booking Calendar plugin version 10.5.1 or greater.

Shield Security – Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-7313
Number of Installations: 50,000+
Affected Software: Shield Security <= 20.0.5
Patched Versions: Shield Security 20.0.6

Mitigation steps: Update to Shield Security plugin version 20.0.6 or greater.

Pixel Cat – Conversion Pixel Manager – Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-8544
Number of Installations: 50,000+
Affected Software: Pixel Cat – Conversion Pixel Manager <= 3.0.5
Patched Versions: Pixel Cat – Conversion Pixel Manager 3.0.6

Mitigation steps: Update to Pixel Cat plugin version 3.0.6 or greater.

Visual CSS Style Editor – Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43963
Number of Installations: 50,000+
Affected Software: Visual CSS Style Editor <= 7.6.3
Patched Versions: Visual CSS Style Editor 7.6.4

Mitigation steps: Update to Visual CSS Style Editor plugin version 7.6.4 or greater.

Premium Portfolio Features for Phlox theme – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-1384
Number of Installations: 50,000+
Affected Software: Premium Portfolio Features for Phlox theme <= 2.3.3
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Theme Vulnerabilities

Mantra – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-44056
Number of Downloads: 1,152,946
Affected Software: Mantra <= 3.3.2
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Nirvana – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-44057
Number of Downloads: 752,479
Affected Software: Nirvana <= 1.6.3
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Mystique – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43988
Number of Downloads: 705,708
Affected Software: Mystique <= 2.5.7
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited. However, this theme is abandoned and has not been updated in over a year. We recommend switching to a new theme.

Tempera – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43951
Number of Downloads: 703,523
Affected Software: Tempera <= 1.8.2
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Delicate – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-5867
Number of Downloads: 686,668
Affected Software: Delicate <= 3.5.5
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited. However, this theme is abandoned and has not been updated in over a year. We recommend switching to a new theme.

Parabola – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-44058
Number of Downloads: 635,288
Affected Software: Parabola <= 2.4.1
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Sliding Door – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43987
Number of Downloads: 537,528
Affected Software: Sliding Door <= 3.6
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Fluida – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-44054
Number of Downloads: 486,615
Affected Software: Fluida <= 1.8.8
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Hotel Galaxy – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43991
Number of Downloads: 247,851
Affected Software: Hotel Galaxy <= 4.4.24
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Kahuna – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43994
Number of Downloads: 170,236
Affected Software: Kahuna <= 1.7.0
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

FotaWP – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2024-43980
Number of Downloads: 146,783
Affected Software: FotaWP <= 1.4.1
Patched Versions: FotaWP 1.4.2

Mitigation steps: Update to FotaWP theme version 1.4.2 or greater.

Septera – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-45452
Number of Downloads: 126,076
Affected Software: Septera <= 1.5.1
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Verbosa – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-44050
Number of Downloads: 108,792
Affected Software: Verbosa <= 1.2.3
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Roseta – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-45451
Number of Downloads: 97,031
Affected Software: Roseta <= 1.3.0
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Posterity – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43995
Number of Downloads: 96,548
Affected Software: Posterity <= 3.6
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Attire – PHP Object Injection

Security Risk: High
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: PHP Object Injection
CVE: CVE-2024-7435
Number of Downloads: 72,378
Affected Software: Attire <= 2.0.6
Patched Versions: Attire 2.0.7

Mitigation steps: Update to Attire theme version 2.0.7 or greater.

Esotera – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Cross Site Scripting (XSS)
CVE: CVE-2024-43952
Number of Downloads: 59,473
Affected Software: Esotera <= 1.2.5.1
Patched Versions: No Fix

Mitigation steps: This vulnerability poses a low risk and is not likely to be exploited.

Update your website software to mitigate risk. Users who are not able to update their software with the latest version are encouraged to use a web application firewall to help virtually patch known vulnerabilities and protect their website.