Critical
CVE-2024-4371
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2024-0979
Dashboard Widgets Suite <= 3.4.3 - Reflected Cross-Site Scripting
Medium
CVE-2024-4615
Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget
Medium
CVE-2024-5265
WPBakery Page Builder <= 7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute
Medium
CVE-2024-5757
Elementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget
Medium
CVE-2024-5787
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects Widget
Medium
CVE-2024-2040
Himer <= 2.1.0 - Cross-Site Request Forgery to Private Group Join
Medium
CVE-2024-2234
Himer <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-2235
Himer <= 2.1.0 - Cross-Site Request Forgery to Poll Voting
Medium
CVE-2024-2233
Himer <= 2.1.0 - Cross-Site Request Forgery to Group Leave
Medium
CVE-2024-2375
WPQA - Builder forms Addon For WordPress plugin <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-2231
Himer - Social Questions and Answers <= 2.1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2024-2098
Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary
Medium
CVE-2024-2376
WPQA Builder <= 6.1.0 - Cross-Site Request Forgery
Medium
CVE-2024-5674
Newsletter - API v1 and v2 addon for Newsletter <= 2.4.5 - Missing Authorization to Email Subscribers Management
Critical
CVE-2024-4898
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation
Medium
CVE-2024-2092
Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget
Medium
CVE-2024-5468
WordPress Header Builder Plugin – Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion
Medium
CVE-2024-5266
Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes
Medium
CVE-2024-3925
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events
Medium
CVE-2024-5892
Divi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
Medium
CVE-2024-3559
Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]
Medium
CVE-2024-4564
CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2024-4892
BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.