CVE-2026-3174Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update Exploitation status Not known exploited Fix Affected product E Event Tickets and Registration Published 09/08/2026 Severity High CVE-2026-12843LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint Exploitation status Not known exploited Fix Affected product L LearnDash LMS Published 09/05/2026 Severity Medium CVE-2026-12483LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler Exploitation status Not known exploited Fix Affected product L LearnDash LMS Published 09/04/2026 Severity High CVE-2026-5510GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 08/28/2026 Severity Medium CVE-2026-9273Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover Exploitation status Not known exploited Fix Affected product M Membership Plugin – Kadence Memberships Published 08/05/2026 Severity Critical CVE-2026-18062Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 08/01/2026 Severity Medium CVE-2026-18435Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 08/01/2026 Severity Medium CVE-2026-14987GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 07/16/2026 Severity Medium CVE-2026-15286Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 07/10/2026 Severity Medium CVE-2026-13704GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Form Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 07/02/2026 Severity Medium CVE-2026-11981GiveWP <= 4.15.3 - Cross-Site Request Forgery Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 07/01/2026 Severity Medium CVE-2026-12902Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 07/01/2026 Severity Medium CVE-2026-12904Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 07/01/2026 Severity Medium CVE-2026-13246GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 07/01/2026 Severity Medium CVE-2026-11357Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 06/18/2026 Severity Medium CVE-2026-42642WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product G GiveWP Published 04/29/2026 Severity Medium CVE-2026-42643WordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product I Image Widget Published 04/29/2026 Severity Medium CVE-2026-2826Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 04/04/2026 Severity Medium CVE-2026-32546WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product R Restrict Content Published 03/25/2026 Severity High CVE-2026-3079LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter Exploitation status Not known exploited Fix Affected product L LearnDash LMS Published 03/24/2026 Severity Medium CVE-2026-4136Membership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect Exploitation status Not known exploited Fix Affected product M Membership Plugin – Restrict Content Published 03/20/2026 Severity Medium CVE-2026-3585The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 03/10/2026 Severity High CVE-2026-1321Membership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level' Exploitation status Not known exploited Fix Affected product M Membership Plugin – Restrict Content Published 03/05/2026 Severity High CVE-2026-2694The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 02/25/2026 Severity Medium CVE-2026-27056WordPress iThemes Sync plugin <= 3.2.8 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product I iThemes Sync Published 02/19/2026 Severity Medium CVE-2026-2633Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 02/18/2026 Severity Medium CVE-2026-1857Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 02/18/2026 Severity Medium CVE-2026-1304Membership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings Exploitation status Not known exploited Fix Affected product M Membership Plugin – Restrict Content Published 02/18/2026 Severity Medium CVE-2026-2608Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorization Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 02/17/2026 Severity Medium CVE-2025-15043The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 01/20/2026 Severity Medium CVE-2025-14844Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product M Membership Plugin – Restrict Content Published 01/16/2026 Severity High CVE-2025-69352WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 01/06/2026 Severity Medium CVE-2025-14000Membership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes Exploitation status Not known exploited Fix Affected product M Membership Plugin – Restrict Content Published 12/23/2025 Severity Medium CVE-2025-67467WordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product G GiveWP Published 12/09/2025 Severity Medium CVE-2025-66533WordPress GiveWP plugin <= 4.13.1 - Arbitrary Shortocde Execution vulnerability Exploitation status Not known exploited Fix Affected product G GiveWP Published 12/09/2025 Severity Medium CVE-2025-13387Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product K Kadence WooCommerce Email Designer Published 12/02/2025 Severity High CVE-2025-13206GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name' Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 11/19/2025 Severity High CVE-2025-12633Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection Exploitation status Not known exploited Fix Affected product B Bookit — Booking & Appointment Calendar Published 11/12/2025 Severity High CVE-2025-12192The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 11/05/2025 Severity Medium CVE-2025-12197The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 11/05/2025 Severity High CVE-2025-12175The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 10/31/2025 Severity Medium CVE-2025-62027WordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product E Event Tickets Published 10/22/2025 Severity Medium CVE-2025-49906WordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WPComplete Published 10/22/2025 Severity Medium CVE-2025-11517Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass Exploitation status Not known exploited Fix Affected product E Event Tickets and Registration Published 10/18/2025 Severity High CVE-2025-11228GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 10/04/2025 Severity Medium CVE-2025-11227GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 10/04/2025 Severity Medium CVE-2025-58974WordPress WPComplete Plugin <= 2.9.5.2 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product W WPComplete Published 09/22/2025 Severity Medium CVE-2025-9808The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 09/16/2025 Severity Medium CVE-2025-9807The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 09/12/2025 Severity High CVE-2025-7221GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Update Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 08/21/2025 Severity Medium CVE-2025-54697WordPress Kadence WooCommerce Email Designer Plugin <= 1.5.16 - Privilege Escalation Vulnerability Exploitation status Not known exploited Fix Affected product K Kadence WooCommerce Email Designer Published 08/14/2025 Severity High CVE-2025-8620GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 08/06/2025 Severity Medium CVE-2025-7205GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 07/31/2025 Severity Medium CVE-2025-5678Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 07/09/2025 Severity Medium CVE-2025-50046WordPress WPComplete plugin <= 2.9.5 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product W WPComplete Published 06/20/2025 Severity Medium CVE-2025-4571GiveWP – Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 06/19/2025 Severity Medium CVE-2025-5144The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 06/11/2025 Severity Medium CVE-2025-48246WordPress The Events Calendar plugin <= 6.11.2.1 - Broken Access Control Vulnerability Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 05/19/2025 Severity Medium CVE-2024-8493The Events Calendar < 6.6.4 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product T The Events Calendar Published 05/15/2025 Severity Medium CVE-2025-39557WordPress Kadence WooCommerce Email Designer plugin <= 1.5.14 - Arbitrary File Upload vulnerability Exploitation status Not known exploited Fix Affected product K Kadence WooCommerce Email Designer Published 04/16/2025 Severity Critical CVE-2025-30794WordPress Event Tickets plugin <= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product E Event Tickets Published 04/01/2025 Severity High CVE-2025-2331GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 03/22/2025 Severity Medium CVE-2025-2025Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 03/15/2025 Severity Medium CVE-2025-0912GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 03/04/2025 Severity Critical CVE-2025-1291Gutenberg Blocks by Kadence Blocks <= 3.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 03/01/2025 Severity Medium CVE-2025-22633WordPress Give – Divi Donation Modules plugin <= 2.0.0 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product G Give – Divi Donation Modules Published 02/23/2025 Severity Medium CVE-2025-1402Event Tickets and Registration <= 5.19.1.1 - Missing Authorization to Ticket Deletion Exploitation status Not known exploited Fix Affected product E Event Tickets and Registration Published 02/21/2025 Severity Medium CVE-2024-13457Event Tickets <= 5.18.1 - Insecure Direct Object Reference to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product E Event Tickets and Registration Published 01/30/2025 Severity Medium CVE-2025-24537WordPress The Events Calendar plugin <= 6.7.0 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 01/27/2025 Severity Medium CVE-2024-11090Membership Plugin – Restrict Content <= 3.2.13 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product M Membership Plugin – Restrict Content Published 01/26/2025 Severity Medium CVE-2025-24753WordPress Kadence Blocks plugin <= 3.3.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product G Gutenberg Blocks by Kadence Blocks Published 01/24/2025 Severity Medium CVE-2024-12118The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 01/23/2025 Severity Medium CVE-2025-22777WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product G GiveWP Published 01/13/2025 Severity Critical CVE-2024-12877GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 01/11/2025 Severity Critical CVE-2024-12304Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 01/11/2025 Severity Medium CVE-2024-38762WordPress Event Tickets and Registration plugin <= 5.11.0.4 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product E Event Tickets Published 01/02/2025 Severity Medium CVE-2024-37518WordPress The Events Calendar plugin <= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 01/02/2025 Severity Medium CVE-2023-47183WordPress GiveWP plugin <= 2.33.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product G GiveWP Published 01/02/2025 Severity Medium CVE-2024-5333The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure Exploitation status Public exploit Fix Affected product T The Events Calendar Published 12/16/2024 Severity Medium CVE-2023-40001WordPress iThemes Sync plugin <= 2.1.13 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product I iThemes Sync Published 12/13/2024 Severity Medium CVE-2023-35777WordPress The Events Calendar plugin <= 6.1.2.2 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 12/13/2024 Severity Medium CVE-2024-10939Image Widget < 4.4.11 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product I Image Widget Published 12/13/2024 Severity Medium CVE-2024-12581Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 12/13/2024 Severity Medium CVE-2024-10785Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 11/21/2024 Severity Medium CVE-2024-9655Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 11/01/2024 Severity Medium CVE-2022-4974Freemius SDK <= 2.4.2 - Missing Authorization Checks Exploitation status Not known exploited Fix Affected product B Bookit — Booking & Appointment Calendar Published 10/16/2024 Severity Medium CVE-2024-9634GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 10/16/2024 Severity Critical CVE-2024-8353GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 09/28/2024 Severity Critical CVE-2024-6931The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 09/27/2024 Severity High CVE-2024-9130GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 09/27/2024 Severity High CVE-2024-47315WordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product G GiveWP Published 09/25/2024 Severity Medium CVE-2024-8275The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection Exploitation status Not known exploited Fix Affected product T The Events Calendar Published 09/25/2024 Severity Critical CVE-2024-6551GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 08/29/2024 Severity Medium CVE-2024-5940GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 08/20/2024 Severity Medium CVE-2024-5939GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 08/20/2024 Severity Medium CVE-2024-5932GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution Exploitation status Public exploit Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 08/20/2024 Severity Critical CVE-2024-5941GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 08/20/2024 Severity Medium CVE-2024-5977GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions Exploitation status Not known exploited Fix Affected product G GiveWP – Donation Plugin and Fundraising Platform Published 07/19/2024 Severity Medium CVE-2024-5648LearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update Exploitation status Not known exploited Fix Affected product L LearnDash LMS – Reports Published 07/09/2024 Severity Medium CVE-2024-5819Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes Exploitation status Not known exploited Fix Affected product K Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Published 06/29/2024 Severity Medium 
