Medium
CVE-2024-7817
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2024-6887
Giveaways and Contests by RafflePress <= 1.12.16 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2024-8054
MM-Breaking News <= 0.7.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Critical
CVE-2024-43917
TI WooCommerce Wishlist <= 2.8.2 - Unauthenticated SQL Injection
Medium
CVE-2024-6018
Music Request Manager <= 1.3 - Reflected Cross-Site Scripting
Medium
CVE-2024-7859
Visual Sound <= 1.03 - Cross-Site Request Forgery to Settings Update
High
CVE-2024-6019
Music Request Manager <= 1.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-7862
Blog Introduction <= 0.3.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2024-5799
CM Pop-Up Banners <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6017
Music Request Manager <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-6870
Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload
Medium
CVE-2024-7778
Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
High
CVE-2024-8480
Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload
High
CVE-2024-7384
AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
Medium
CVE-2024-5583
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings
Medium
CVE-2024-7836
Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication
Critical
CVE-2024-6386
WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection
Critical
CVE-2024-28000
LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation
Medium
CVE-2024-7848
User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access
Medium
CVE-2024-5880
Hide My Site <= 2.2 - Unauthenticated Information Exposure
Medium
CVE-2024-6883
Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification
Medium
CVE-2024-6767
WordSurvey <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding_title Parameter
Medium
CVE-2024-7030
Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update
Medium
CVE-2024-7032
Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.