Medium
CVE-2024-39626
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2024-39621
ListingPro Plugin <= 2.9.4 - Authenticated (Author+) Local File Inclusion
Critical
CVE-2024-39620
ListingPro Plugin <= 2.9.4 - Authenticated (Subscriber+) SQL Injection
The ListingPro plugin for WordPress is vulnerable to SQL injection, allowing authenticated users with subscriber-level access or higher to extract sensitive database information.
Critical
CVE-2024-39622
ListingPro <= 2.9.4 - Unauthenticated SQL Injection
Medium
CVE-2024-39630
Timetable and Event Schedule <= 2.4.13 - Authenticated (Admin+) PHP Object Injection
High
CVE-2024-39623
ListingPro <= 2.9.4 - Cross-Site Request Forgery to Account Takeover
High
CVE-2024-38795
ListingPro Plugin <= 2.9.4 - Unauthenticated SQL Injection
High
CVE-2024-39624
ListingPro <= 2.9.4 - Authenticated (Subscriber+) Local File Inclusion
Medium
CVE-2024-6724
Generate Images – Magic Post Thumbnail <= 5.2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-39629
Himalayas <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-38794
Custom Query Blocks <= 5.2.0 - Missing Authorization via REST Routes
Critical
CVE-2024-39619
ListingPro Plugin <= 2.9.4 - Unauthenticated Local File Inclusion
Medium
CVE-2024-38792
Language Translate Widget for WordPress – ConveyThis <= 234 - Missing Authorization to Limited Option Update
Medium
CVE-2024-39627
NextGEN Gallery <= 3.59.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2024-6960
H2O vulnerable to Deserialization of Untrusted Data
Medium
CVE-2024-38789
Telegram Bot & Channel <= 3.8.2 - Cross-Site Request Forgery
Medium
CVE-2024-38790
Smartsupp – live chat, chatbots, AI and lead generation <= 3.6 - Cross-Site Request Forgery
Medium
CVE-2024-1845
VikRentCar Car Rental Management System <= 1.3.1 - Cross-Site Request Forgery
Medium
CVE-2024-6848
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload
Low
CVE-2024-41597
ProcessWire Cross Site Request Forgery vulnerability
High
CVE-2024-40400
Automad arbitrary file upload vulnerability
High
CVE-2024-6497
SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter
Medium
CVE-2024-6491
Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update
Medium
CVE-2024-3934
Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.