Medium
CVE-2024-39652
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2024-8542
Everest Forms <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2024-39663
WP Fast Total Search <= 1.68.232 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-39659
WP-PostRatings <= 1.91.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-7389
Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure
Medium
CVE-2024-39657
Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.6.18 - Cross-Site Request Forgery
Medium
CVE-2024-39660
Photo Engine <= 6.3.1 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2024-6346
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget
Medium
CVE-2024-7302
Blog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
Medium
CVE-2024-5331
Breakdance <= 1.7.2 - Missing Authorization
Medium
CVE-2024-5330
Breakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-2455
Element Pack - Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL
Medium
CVE-2024-2090
Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery
High
CVE-2024-6698
FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2024-8493
The Events Calendar <= 6.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-6687
CTT Expresso para WooCommerce <= 3.2.12 - Information Exposure via Unprotected Directory
High
CVE-2024-6770
Lifetime free Drag & Drop Contact Form Builder for WordPress VForm <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-5901
SiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget
Medium
CVE-2024-7135
Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2024-6725
Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2024-6208
Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-2508
WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification
Critical
CVE-2024-39638
Registrations for the Events Calendar – Event Registration Plugin <= 2.12.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2024-7100
Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.