High
CVE-2024-49684
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2024-49671
AI Image Generator for Your Content & Featured Images – AI Postpix <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
CVE-2024-49626
Shipyaari Shipping Management <= 1.2 - Unauthenticated PHP Object Injection
Critical
CVE-2024-49625
SiteBuilder Dynamic Components <= 1.0 - Unauthenticated PHP Object Injection
High
CVE-2024-49617
Back Link Tracker <= 1.0.0 - Cross-Site Request Forgery to SQL Injection
Critical
CVE-2024-49624
Advanced Advertising System <= 1.3.1 - Unauthenticated PHP Object Injection
High
CVE-2024-49615
SafetyForms <= 1.0.0 - Cross-Site Request Forgery
High
CVE-2024-49608
GERRYWORKS Post by Mail <= 1.0 - Contributor+ Privilege Escalation
Medium
CVE-2023-6243
EventON PRO - WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email
Medium
CVE-2024-10055
Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode
Medium
CVE-2024-9364
SendGrid for WordPress <= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion
High
CVE-2024-10079
WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2024-49332
Giveaway Boost <= 2.1.4 - Unauthenticated PHP Object Injection
Critical
CVE-2024-49328
WP REST API FNS <= 1.0.0 - Privilege Escalation
Medium
CVE-2024-9940
Calculated Fields Form <= 5.2.45 - HTML Injection
High
CVE-2024-9215
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover
Medium
CVE-2024-9347
The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting
Critical
CVE-2024-9263
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover
High
CVE-2024-49317
Point Maker <= 0.1.4 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2024-49288
Email Template Customizer for WooCommerce <= 1.2.9.1 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Critical
CVE-2024-9105
UltimateAI <= 2.8.3 - Authentication Bypass
Critical
CVE-2024-49287
PDF-Rechnungsverwaltung <= 0.0.1 - Unauthenticated Local File Inclusion
Critical
CVE-2024-9634
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution
Critical
CVE-2024-49286
SSV Events <= 3.2.7 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.