PatchTheCVE: wow-company

CVE-2024-13901: The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vul

Wed, 17 Jun 2026 07:02:57 +0000

MEDIUM 4.4: The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This make

CVE-2025-0897: The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting

Wed, 17 Jun 2026 08:27:20 +0000

MEDIUM 6.4: The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all versions up to, and including, 6.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it poss

CVE-2025-24717: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Modal Window modal-window allows Cross Site Req

Wed, 17 Jun 2026 08:59:29 +0000

MEDIUM 5.4: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Modal Window modal-window allows Cross Site Request Forgery.This issue affects Modal Window: from n/a through <= 6.1.4.

CVE-2025-24715: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box counter-box allows Cross Site Reque

Wed, 17 Jun 2026 08:59:29 +0000

MEDIUM 5.4: Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Counter Box counter-box allows Cross Site Request Forgery.This issue affects Counter Box: from n/a through <= 2.0.5.

CVE-2024-6926: The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using

Wed, 17 Jun 2026 08:18:59 +0000

CRITICAL 9.8: The Viral Signup WordPress plugin through 2.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

CVE-2024-6927: The Viral Signup WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could

Wed, 17 Jun 2026 08:18:59 +0000

MEDIUM 4.8: The Viral Signup WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVE-2024-43346: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in W

Wed, 17 Jun 2026 07:50:51 +0000

MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wow-Company Modal Window allows Stored XSS.This issue affects Modal Window: from n/a through 6.0.3.

CVE-2024-3481: The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could all

Wed, 17 Jun 2026 07:44:21 +0000

MEDIUM 5.2: The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such deleting counters via CSRF attacks

CVE-2024-3478: The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could al

Wed, 17 Jun 2026 07:44:21 +0000

MEDIUM 6.1: The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks

CVE-2024-3477: The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow