Medium
CVE-2024-3636
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Critical
CVE-2024-6457
HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection
Medium
CVE-2024-6270
Community Events <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2024-1937
Brizy – Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification
Medium
CVE-2024-3587
Premium Portfolio Features for Phlox theme <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ' Grid Portfolios'
Medium
CVE-2024-6621
WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update
Medium
CVE-2024-2232
Himer - Social Questions and Answers <= 2.1.2 - Cross-Site Request Forgery to Arbitrary User Invites
Medium
CVE-2024-6570
Glossary <= 2.2.26 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-6498
Chatbot for WordPress by Collect.chat ⚡️ <= 2.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-5852
WordPress File Upload <= 4.24.7 - Authenticated (Contributor+) Directory Traversal
Medium
CVE-2024-38767
BSK PDF Manager <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6710
Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.44 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6720
Light Poll <= 1.0.0 - Cross-Site Request Forgery to Poll Answers Deletion
Medium
CVE-2024-5081
Wp EMember < 10.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-6559
XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-2691
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode
Medium
CVE-2024-6390
Quiz and Survey Master <= 9.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6477
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories
Critical
CVE-2024-38770
Backup and Staging by WP Time Capsule <= 1.22.20 - Authentication Bypass to Account Takeover
High
CVE-2024-5902
UserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter
Medium
CVE-2024-38762
Event Tickets <= 5.11.0.4 - Cross-Site Request Forgery
Medium
CVE-2024-5595
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6574
Laposta <= 1.12 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-38765
Oceanic <= 1.0.53 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.