High
CVE-2024-8480
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2024-7384
AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
Medium
CVE-2024-5583
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settings
Medium
CVE-2024-7836
Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplication
Critical
CVE-2024-6386
WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection
Critical
CVE-2024-28000
LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation
Medium
CVE-2024-7848
User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access
Critical
CVE-2024-5335
Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injection
Medium
CVE-2024-5880
Hide My Site <= 2.2 - Unauthenticated Information Exposure
Medium
CVE-2024-6883
Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification
Medium
CVE-2024-6767
WordSurvey <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding_title Parameter
Medium
CVE-2024-7030
Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update
Medium
CVE-2024-7032
Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion
Medium
CVE-2024-7090
LH Add Media From Url <= 1.23 - Reflected Cross-Site Scripting
Medium
CVE-2024-7651
App Builder – Create Native Android & iOS Apps On The Flight <= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search
Medium
CVE-2024-7629
Responsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-7390
WP Testimonial Widget <= 3.1 - Missing Authorization
High
CVE-2024-7134
LiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data Parameter
Critical
CVE-2024-7854
Woo Inquiry <= 0.1 - Unauthenticated SQL Injection
Medium
CVE-2024-6690
WP Content Copy Protection & No Right Click (PRO) <= 15.0 - Open Redirect
Medium
CVE-2024-6568
Flamix: Bitrix24 and Contact Form 7 integrations <= 3.1.0 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-7891
Floating Contact Button <= 2.7 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-8009
Sensei LMS – Online Courses, Quizzes, & Learning <= 4.19.2 - Authenticated (Teacher+) User Email Disclosure
Medium
CVE-2024-7647
OTA Sync Booking Engine Widget 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.