Medium
CVE-2024-5852
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2024-38767
BSK PDF Manager <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6710
Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.44 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6720
Light Poll <= 1.0.0 - Cross-Site Request Forgery to Poll Answers Deletion
Medium
CVE-2024-5081
Wp EMember < 10.7.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-6559
XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-2691
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode
Medium
CVE-2024-6390
Quiz and Survey Master <= 9.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6477
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories
Critical
CVE-2024-38770
Backup and Staging by WP Time Capsule <= 1.22.20 - Authentication Bypass to Account Takeover
High
CVE-2024-5902
UserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter
Medium
CVE-2024-38762
Event Tickets <= 5.11.0.4 - Cross-Site Request Forgery
Medium
CVE-2024-5595
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6574
Laposta <= 1.12 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-38765
Oceanic <= 1.0.53 - Cross-Site Request Forgery
Medium
CVE-2024-38760
Send Users Email <= 1.5.1 - Unauthenticated Information Exposure
Medium
CVE-2024-6465
WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update
Medium
CVE-2024-38763
Popularis Verse <= 1.0.1 - Cross-Site Request Forgery
Medium
CVE-2024-38761
Zephyr Project Manager <= 3.3.99 - Unauthenticated Information Exposure
Medium
CVE-2024-38764
i-transform <= 3.0.9 - Cross-Site Request Forgery
High
CVE-2024-6353
Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'
Medium
CVE-2024-6625
WP Total Branding <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter
Medium
CVE-2024-6588
PowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter
Medium
CVE-2024-6555
WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.