High
CVE-2024-37092
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2024-37094
MasterStudy LMS <= 3.2.12 - Missing Authorization
High
CVE-2024-37108
WishList Member X < 3.26.7 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2024-37090
Consulting Elementor Widgets <= 1.3.0 - Authenticated (Contributor+) SQL Injection
Critical
CVE-2024-37112
WishList Member X <= 3.25.1 - Unauthenticated Arbitrary SQL Execution
Medium
CVE-2024-37115
Newspack Blocks <= 3.0.8 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2024-37103
Education Zone <= 1.3.4 - Cross-Site Request Forgery to Notice Dismissal
Medium
CVE-2024-37111
WishList Member X < 3.26.7 - Unauthenticated Denial of Service
Medium
CVE-2024-6225
Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-6026
Slider by 10Web <= 1.2.55 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2024-37101
WP Post Author <= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-5639
User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update
Medium
CVE-2024-4390
Depicter <= 3.0.2 - Authenticated (Contributor+) Arbitrary Nonce Generation
Medium
CVE-2024-5686
WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget
Medium
CVE-2024-4626
JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters
Medium
CVE-2024-1168
SEOPress – On-site SEO <= 7.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URL
Medium
CVE-2024-3558
Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]
High
CVE-2024-3562
Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Field
High
CVE-2024-3561
Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom Field
Medium
CVE-2024-4742
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection
Critical
CVE-2024-3605
WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection
Medium
CVE-2024-3602
Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer <= 1.1.0 - Missing Authorization
High
CVE-2024-3597
Export WP Page to Static HTML/CSS <= 2.2.2 - Open Redirect
Medium
CVE-2024-3627
Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.