Critical
CVE-2024-9488
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2024-50452
Nexter Blocks <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-50457
Qode Essential Addons <= 1.6.3 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2024-50416
WPC Shop as a Customer for WooCommerce <= 1.2.6 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2024-50455
SEOPress <= 8.1.1 - Missing Authorization
High
CVE-2024-50408
Namaste! LMS <= 2.6.3 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2024-50436
Clean Retina <= 3.0.6 - Unauthenticated Local File Inclusion
Critical
CVE-2024-50435
Meta News <= 1.1.7 - Unauthenticated Local File Inclusion
Medium
CVE-2024-50414
Button contact VR <= 4.7.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2024-50453
The Pack Elementor addons <= 2.0.9 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2024-9186
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.2.2 - Unauthenticated SQL Injection
Medium
CVE-2024-9531
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending
Medium
CVE-2024-9943
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Cross-Site Request Forgery to Vendor Updates
Medium
CVE-2024-8667
HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication
Medium
CVE-2024-9864
EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-9865
EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log
Medium
CVE-2024-9583
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.12 - Missing Authorization
Medium
CVE-2024-9829
Download Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download
High
CVE-2024-9947
ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider
Medium
CVE-2024-8852
All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs
Medium
CVE-2024-49686
Landing Page Cat <= 1.7.4 - Missing Authorization
High
CVE-2024-49690
Qi Blocks <= 1.3.2 - Authenticated (Contributor+) Local File Inclusion
Critical
CVE-2024-49701
Mags <= 1.1.6 - Unauthenticated Local File Inclusion
Medium
CVE-2024-49651
WooCommerce Maintenance Mode <= 2.0.1 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.