Medium
CVE-2024-3923
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
Critical
CVE-2024-4606
Ultimate Store Kit Elementor Addons <= 2.0.3 - Unauthenticated PHP Object Injection
High
CVE-2024-3954
Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2024-34389
WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder <= 3.7.4 - Missing Authorization
Critical
CVE-2024-4346
Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2024-34387
WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder <= 3.6.4 - Missing Authorization to Rating Manipulation
Critical
CVE-2024-4345
Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Upload
High
CVE-2024-3240
ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection
Critical
CVE-2024-3070
Last Viewed Posts by WPBeginner <= 1.0.0 - Unauthenticated PHP Object Injection
High
CVE-2024-1895
Event Monster <= 1.3.9 - Authenticated(Contributor+) PHP Object Injection via Custom Meta
High
CVE-2024-1897
Grid Gallery – Photo Image Grid Gallery <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode
High
CVE-2024-1896
Photo Gallery <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcode
High
CVE-2024-30229
GiveWP – Donation Plugin and Fundraising Platform <= 3.4.2 - Authenticated (GiveWP Manager+) PHP Object Injection
Critical
CVE-2024-30225
WP Migrate Pro <= 2.6.10 - Unauthenticated PHP Object Injection
High
CVE-2024-33641
Custom field finder <= 0.3 - Authenticated (Author+) PHP Object Injection
Critical
CVE-2024-33553
XStore Core <= 5.3.8 - Unauthenticated PHP Object Injection
Medium
CVE-2024-33596
Five Star Restaurant Reservations <= 2.6.16 - Missing Authorization
Medium
CVE-2024-33539
WPZOOM Addons for Elementor (Templates, Widgets) <= <=1.1.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2024-3962
Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file
A critical arbitrary file upload vulnerability in the Product Addons & Fields for WooCommerce WordPress plugin allows unauthenticated attackers to upload arbitrary files and potentially execute remote code when PPOM Pro and a product with a file upload field are present.
High
CVE-2024-32817
Import and export users and customers <= 1.26.2 - Authenticated (Admin+) PHP Object Injection
Medium
CVE-2024-32823
Rate My Post – Star Rating Plugin by FeedbackWP <= 3.4.4 - Insecure Direct Object Reference
Medium
CVE-2024-32725
5 Stars Rating Funnel <= 1.2.67 - Missing Authorization
High
CVE-2024-32835
Export and Import Users and Customers <= 2.5.3 - Authenticated (Admin+) PHP Object Injection
High
CVE-2024-3600
Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.