High
CVE-2024-39633
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2024-39631
Contest Gallery <= 23.1.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-6896
AMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
High
CVE-2024-6931
The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-6930
WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode
Medium
CVE-2024-6629
All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode
Medium
CVE-2024-6755
Social Auto Poster <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Medium
CVE-2024-6836
Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update
Medium
CVE-2024-6751
Social Auto Poster <= 5.3.14 - Cross-Site Request Forgery via Multiple Functions
High
CVE-2024-7027
WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor
Medium
CVE-2024-6571
Optimize Images ALT Text (alt tag) & names for SEO using AI <= 3.1.1 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-5818
Royal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget
Medium
CVE-2024-3246
LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-6754
Social Auto Poster <= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw_auto_poster_update_tweet_template
Medium
CVE-2024-6553
WP Meteor Website Speed Optimization Addon <= 3.4.3 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-5861
WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection
High
CVE-2024-6753
Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-6752
Social Auto Poster <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2024-6750
Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions
High
CVE-2024-6756
Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2024-5744
WP eMember <= 10.6.6 - Reflected Cross-Site Scripting via $_SERVER['REQUEST_URI']
High
CVE-2024-6885
MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles <= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2024-6828
Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting
Medium
CVE-2024-5028
CM WordPress Search And Replace Plugin <= 1.3.8 - Cross-Site Request Forgery to Plugin Setting Reset
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.