Medium
CVE-2024-6799
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2024-5977
GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions
Medium
CVE-2024-6884
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown
High
CVE-2024-5726
Timeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2024-6175
Booking Ultra Pro <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates
Medium
CVE-2024-5703
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization
Medium
CVE-2024-6669
AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2024-6660
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload
High
CVE-2024-6467
BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation
High
CVE-2024-38768
The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) <= 2.0.8.6 - Authenticated (contributor+) Local File Inclusion
Medium
CVE-2024-6565
AForms <= 2.2.6 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-6557
SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-6621
WP RSS Aggregator <= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update
Medium
CVE-2024-6570
Glossary <= 2.2.26 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-6559
XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-6574
Laposta <= 1.12 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-38760
Send Users Email <= 1.5.1 - Unauthenticated Information Exposure
Medium
CVE-2024-6465
WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update
Medium
CVE-2024-38761
Zephyr Project Manager <= 3.3.99 - Unauthenticated Information Exposure
Medium
CVE-2024-6555
WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-38721
EazyDocs <= 2.5.0 - Missing Authorization
Medium
CVE-2024-38738
Change From Email <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-38752
Zoho Campaigns <= 2.0.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2024-38729
MBE eShip <= 2.1.2 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.