Medium
CVE-2024-6929
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2024-8363
Share This Image <= 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcode
Medium
CVE-2024-6719
Offload Videos – Bunny.net, AWS S3 <= 1.0.0 - Cross-Site Request Forgery
Medium
CVE-2022-4529
Security, Antivirus, Firewall – S.A.F <= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypass
Medium
CVE-2024-8618
Page Builder: Pagelayer <= 1.8.9 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-8090
JavaScript Logic <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-5309
Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions
Medium
CVE-2024-7878
WP ULike <= 4.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2024-7627
Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition
Medium
CVE-2024-45429
Advanced Custom Fields <= 6.3.5 - Authenticated Stored Cross-Site Scripting
Medium
CVE-2024-7892
adstxt Plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2022-3556
Cab fare calculator <= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-6845
Chatbot with ChatGPT <= 2.4.5 - Missing Authorization to Unauthenticated OpenAI API Key Exposure
Medium
CVE-2024-7605
HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update
Medium
CVE-2024-8245
GamiPress - Reset User <= 1.0.0 - Cross-Site Request Forgery to GamiPress User Data Removal
Medium
CVE-2024-6835
Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form
Medium
CVE-2024-8318
Attributes for Blocks <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributesForBlocks Parameter
Critical
CVE-2024-7950
WP Job Portal <= 2.1.6 - Missing Authorization to Unauthenticated Local File Inclusion, Arbitrary Settings Update, and User Creation
Medium
CVE-2024-8121
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change
Medium
CVE-2024-8325
Gutenberg Page Builder Blocks & Ready-Made Patterns Library <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-8123
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference
High
CVE-2024-8289
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Arbitrary Vendor Deletion
High
CVE-2024-8102
The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update
Medium
CVE-2024-7870
PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.