Medium
CVE-2024-9898
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2024-8920
Fonto – Custom Web Fonts Manager <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
High
CVE-2024-9184
SendPulse Free Web Push <= 1.3.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-9240
ReDi Restaurant Reservation <= 24.0902 - Reflected Cross-Site Scripting
Critical
CVE-2024-9863
Miniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role Value
Medium
CVE-2024-9213
Persian WooCommerce SMS <= 7.0.2 - Reflected Cross-Site Scripting
Medium
CVE-2024-9940
Calculated Fields Form <= 5.2.45 - HTML Injection
High
CVE-2024-9215
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover
Medium
CVE-2024-7417
Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure
Medium
CVE-2024-9934
Wp-ImageZoom <= 1.1.0 - Reflected Cross-Site Scripting
Medium
CVE-2024-8719
Flexmls® IDX Plugin <= 3.14.22 - Reflected Cross-Site Scripting
Critical
CVE-2024-9862
Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change
Medium
CVE-2024-9351
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation
Medium
CVE-2024-9347
The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting
Medium
CVE-2024-9352
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation
Critical
CVE-2024-9263
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover
Medium
CVE-2024-9951
Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting
High
CVE-2024-9861
Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass
Medium
CVE-2024-8921
Zita Elementor Site Library <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2024-9444
ElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2024-9937
Woo Manage Fraud Orders <= 2.6.1 - Reflected Cross-Site Scripting
Medium
CVE-2024-8541
Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons <= 2.6.5 - Reflected Cross-Site Scripting
Medium
CVE-2024-49306
WP Content Copy Protection & No Right Click <= 3.5.9 - Cross-Site Request Forgery
Medium
CVE-2024-49320
Encyclopedia / Glossary / Wiki <= 1.7.60 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.