Medium
CVE-2024-9592
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2024-9704
Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2024-9047
WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
Medium
CVE-2024-7489
Forms for Mailchimp by Optin Cat <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters
Medium
CVE-2024-9824
ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update
Medium
CVE-2024-9778
ImagePress – Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2024-7514
WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal
Medium
CVE-2024-9507
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read
Medium
CVE-2024-9051
WP Ultimate Post Grid <= 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters Shortcode
Medium
CVE-2024-9616
BlockMeister – Block Pattern Builder <= 3.1.10 - Reflected Cross-Site Scripting
Medium
CVE-2024-9211
FULL – Cliente <= 3.1.22 - Reflected Cross-Site Scripting
Medium
CVE-2024-9610
Language Switcher <= 3.7.13 - Reflected Cross-Site Scripting
Critical
CVE-2024-9234
GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2024-9232
Download Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site Scripting
Medium
CVE-2024-9586
Linkz.ai <= 1.1.8 - Missing Authorization to Unauthenticated Plugin Settings Update
Medium
CVE-2024-9587
Linkz.ai <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via AJAX
Critical
CVE-2024-9707
Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
Medium
CVE-2024-9436
PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site Scripting
Medium
CVE-2024-8700
Event Calendar <= 1.0.4 - Missing Authorization to Unauthenticated Arbitrary Calendar Deletion
Medium
CVE-2024-9221
Tainacan <= 0.21.10 - Reflected Cross-Site Scripting
High
CVE-2024-9201
SEUR Oficial <= 2.2.10.2 - Unauthenticated SQL Injection
Medium
CVE-2024-9538
ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template
Medium
CVE-2024-9543
Powerpress <= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode
Critical
CVE-2024-9822
Pedalo Connector <= 2.0.5 - Authentication Bypass to Administrator
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.