High
CVE-2024-10828
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2024-10852
Buy one click WooCommerce <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Settings Export
Medium
CVE-2024-10853
Buy one click WooCommerce <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Order Deletion
Critical
CVE-2024-10820
WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload
Medium
CVE-2024-10854
Buy one click WooCommerce <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Settings Import
High
CVE-2024-10800
WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2024-10882
Product Delivery Date for WooCommerce - Lite <= 2.8.0 - Reflected Cross-Site Scripting
Critical
CVE-2024-52379
kineticPay for WooCommerce <= 2.0.8 - Unauthenticated Arbitrary File Upload
Medium
CVE-2024-52395
Floating Buttons for WooCommerce <= 2.8.8 - Missing Authorization
Medium
CVE-2024-10837
SysBasics Customize My Account for WooCommerce <= 2.7.29 - Reflected Cross-Site Scripting via tab Parameter
High
CVE-2024-10626
WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2024-10625
WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2024-51813
Anant Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-10640
The FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution
Critical
CVE-2024-10627
WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload
Medium
CVE-2024-10325
Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2024-10187
myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode
Medium
CVE-2024-8442
Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget
Medium
CVE-2024-10168
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode
Medium
CVE-2024-10535
Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion
Medium
CVE-2024-9178
XT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
High
CVE-2024-10711
WooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update
Medium
CVE-2024-51784
FriendStore for WooCommerce <= 1.4.2 - Reflected Cross-Site Scripting
High
CVE-2024-10114
Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.