High
CVE-2024-2344
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2024-2428
The Ultimate Video Player For WordPress <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-29127
Advanced Access Manager <= 6.9.20 - Reflected Cross-Site Scripting
Medium
CVE-2024-2507
JetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL
Medium
CVE-2023-6385
WordPress Ping Optimizer <= 2.35.1.3.0 - Cross-Site Request Forgery to Log Clearing
Medium
CVE-2024-2340
Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing
Medium
CVE-2024-2343
Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action
Medium
CVE-2024-2543
Plugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor
Medium
CVE-2024-2457
Modal Window – create popup modal window <= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-2738
Permalink Manager Lite and Permalink Manager Pro <= 2.4.3.1 - Reflected Cross-Site Scripting
High
CVE-2024-1538
File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion
Medium
CVE-2024-2336
Popup Maker – Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-1308
WooCommerce Cloak Affiliate Links <= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification
Medium
CVE-2024-2702
Olive One Click Demo Import <= 1.1.1 - Missing Authorization
High
CVE-2024-2342
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode
Critical
CVE-2024-1711
Create by Mediavine <= 1.9.4 - Unauthenticated SQL Injection via 'id'
High
CVE-2024-1799
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode
Medium
CVE-2024-1995
Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure
Medium
CVE-2024-1984
Graphene <= 2.9.2 - Missing Authorization
Medium
CVE-2024-0881
Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel <= 2.2.74 - Information Exposure
Medium
CVE-2024-2124
Translate WordPress and go Multilingual – Weglot <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
Medium
CVE-2024-2384
WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure
Medium
CVE-2024-2255
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-1325
Live Sales Notification for Woocommerce – Woomotiv <= 3.4.3 - Cross-Site Request Forgery via ajax_cancel_review
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.