High
CVE-2024-39633
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 391
Reset filters
Critical
CVE-2024-39620
ListingPro Plugin <= 2.9.4 - Authenticated (Subscriber+) SQL Injection
The ListingPro plugin for WordPress is vulnerable to SQL injection, allowing authenticated users with subscriber-level access or higher to extract sensitive database information.
Medium
CVE-2024-6158
Category Posts Widget <= 4.9.16 & Pro < 4.9.13 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-6588
PowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter
High
CVE-2024-6666
WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id
Medium
CVE-2024-37559
Counterpoint <= 1.8.1 - Reflected Cross-Site Scripting
High
CVE-2024-37410
PowerPack Lite for Beaver Builder <= 1.3.0.3 - Authenticated (Editor+) Local File Inclusion
Medium
CVE-2024-37409
PowerPack Lite for Beaver Builder <= 1.3.0.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2024-5787
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects Widget
High
CVE-2024-3668
PowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege Escalation
Medium
CVE-2024-5327
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
High
CVE-2024-5031
MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode
Medium
CVE-2024-5025
MemberPress <= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter
Critical
CVE-2024-35700
UserPro <= 5.1.8 - Unauthenticated Account Takeover to Privilege Escalation
Medium
CVE-2024-4367
PDF.js < 4.2.67 - Arbitrary JavaScript Execution
High
CVE-2024-1173
WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injection
Critical
CVE-2024-3962
Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file
A critical arbitrary file upload vulnerability in the Product Addons & Fields for WooCommerce WordPress plugin allows unauthenticated attackers to upload arbitrary files and potentially execute remote code when PPOM Pro and a product with a file upload field are present.
Medium
CVE-2024-3312
Easy Custom Auto Excerpt <= 2.4.12 - Sensitive Information Exposure
Medium
CVE-2024-3590
LetterPress – Elevate Your WordPress Site's E-Mail Campaigns and Marketing <= 1.2.2 - Cross-Site Request Forgery
Medium
CVE-2024-3275
eRoom – Zoom Meetings & Webinar <= 1.4.18 - Missing Authorization to Information Exposure
Medium
CVE-2024-32109
WP Matterport Shortcode <= 2.1.9 - Cross-Site Request Forgery
Medium
CVE-2024-2491
PowerPack Addons for Elementor <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag*
Medium
CVE-2024-2492
PowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget
High
CVE-2024-0952
WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.