CVEs published March 13, 2024
221 CVEs were published on March 13, 2024: 11 critical, 49 high.
- Published
- 221
- Critical
- 11
- High
- 49
- Medium
- 155
- Low
- 4
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- Cisco IOS XR Software
- 8
- beaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- 6
- Premium Addons for Elementor Premium Addons Pro for Element…
- 6
- wpvibes Addon Elements for Elementor
- 5
- Yooooomi your_spotify
- 5
- themefusecom Brizy – Page Builder
- 4
- timstrifler Exclusive Addons for Elementor
- 4
- Arcserve Unified Data Protection
- 3
- Dell PowerEdge Platform
- 3
- Fortra FileCatalyst
- 3
Critical 11
- CVE-2024-28175Cross-site scripting on application summary component in argo-cdargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2024-27102Improper isolation of server file access in github.com/pterodactyl/wingspterodactyl wings · github.com/pterodactyl/wings
- CVE-2024-0799Authentication Bypass via wizardLogin in Arcserve Unified Data ProtectionArcserve Unified Data Protection
- CVE-2024-28194Authentication Bypass Because of Hardcoded JWT Secret in your_spotifyYooooomi your_spotify
- CVE-2023-6825File Manager And File Manager Pro (Multiple Versions) - Directory Traversalmndpsingh287 File Manager · File Manager Pro
- CVE-2024-2172Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalationcyberlord92 Web Application Firewall – website security · c…
- CVE-2024-1071The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vultimatemember Ultimate Member – User Profile, Registration…
- CVE-2024-25153Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114Fortra FileCatalyst
- CVE-2024-2413Intumit SmartRobot - Use of Hard-coded Cryptographic KeyIntumit SmartRobot
- CVE-2023-41505An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to e
- CVE-2024-25250SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code via the Login page.
High 49
- CVE-2020-11862Insecure renegotiation in SSL protocol caused Denial of service attack in Privileged Account ManagerOpenText NetIQ Privileged Account Manager
- CVE-2023-38534Improper authentication vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.0 and 12.5.1.OpenText™ Exceed Turbo X
- CVE-2024-22167SanDisk PrivateAccess DLL Hijacking VulnerabilitySanDisk PrivateAccess Windows App
- CVE-2024-24693Zoom Rooms Client for Windows - Improper Access ControlZoom Video Communications Zoom Rooms Client for Windows
- CVE-2024-0801Unauthenticated DoS in Arcserve Unified Data ProtectionArcserve Unified Data Protection
- CVE-2024-0800Authentication Bypass via wizardLogin in Arcserve Unified Data ProtectionArcserve Unified Data Protection
- CVE-2024-28195Cross-Site Request Forgery (CSRF) vulnerability in API and login in your_spotifyYooooomi your_spotify
- CVE-2024-20318A vulnerability in the Layer 2 Ethernet services of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause the linCisco IOS XR Software
- CVE-2024-20320A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) Cisco IOS XR Software
- CVE-2024-20327A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation ServicesCisco IOS XR Software
- CVE-2024-27952WordPress Advanced Sermons plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityWP Codeus Advanced Sermons
- CVE-2024-0161Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2024-26630mm: cachestat: fix folio read-after-free in cache walkLinux
- CVE-2024-24549Apache Tomcat: HTTP/2 header handling DoSApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2024-1751Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injectionthemeum Tutor LMS – eLearning and online course solution
- CVE-2024-1793AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL InjectionAWeber – Free Sign Up Form and Landing Page Builder Plugin…
- CVE-2024-1950Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.7 - Authenticated(Contributor+) PHP Object Injectionwpwax Product Carousel Slider & Grid Ultimate for WooCommer…
- CVE-2024-0368Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keyswpmudev Hustle – Email Marketing, Lead Generation, Optins,…
- CVE-2024-2194WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scriptingveronalabs WP Statistics – Simple, privacy-friendly Google…
- CVE-2024-1311Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Uploadthemefusecom Brizy – Page Builder
- CVE-2024-0683Bulgarisation for WooCommerce <= 3.0.14 - Missing Authorizationautopolisbg Bulgarisation for WooCommerce
- CVE-2023-5663News Announcement Scroll <= 9.0.0 - Authenticated (Contributor+) SQL Injection via Shortcodestoreapps News Announcement Scroll
- CVE-2024-1505Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalationkodezen Academy LMS – WordPress LMS Plugin for Complete eLe…
- CVE-2024-1951Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injectionwpwax Logo Showcase Ultimate – Logo Carousel, Logo Slider &…
- CVE-2024-2006Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markupwpwax Post Grid, Slider & Carousel Ultimate – with Shortcod…
- CVE-2024-1772Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Authenticated (Contributor+) PHP Object Injectionhammadh Play.ht – Make Your Blog Posts Accessible With Text…
- CVE-2024-1203Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce <= 7.0.7 - Authenticated (Subscriber+) SQL Injectiontatvic Conversios: Google Analytics (GA4), Google Ads, Conv…
- CVE-2024-2020Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scriptingcodepeople Calculated Fields Form
- CVE-2024-1862WooCommerce Add to Cart Custom Redirect <= 1.2.13 - Authenticated(Contributor+) Missing Authorization to Limited Arbitrary Options Updateforwardflip Add to Cart Custom Redirect for WooCommerce
- CVE-2024-1935Giveaways and Contests by RafflePress <= 1.12.5 - Unauthenticated Stored Cross-Site Scriptingsmub Giveaways and Contests by RafflePress – Get More Websi…
- CVE-2024-1358Elementor Addon Elements <= 1.12.12 - Directory Traversal to Local File Inclusionwpvibes Addon Elements for Elementor
- CVE-2024-1536Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendarwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-25155Reflected Cross-Site Scripting (XSS) in FileCatalyst Direct 3.8.8 and earlierFortra FileCatalyst
- CVE-2024-2247JFrog Artifactory Cross-Site ScriptingJFrog Artifactory
- CVE-2024-2415Command injection vulnerability in Movistar 4G routerRouter Movistar
- CVE-2024-2414Unprotected Primary Channel vulnerability in Movistar 4G routerRouter Movistar
- CVE-2024-2123Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile, Registration…
- CVE-2015-10123Wago: Buffer Copy without Checking Size of Input in wbm of multiple productsWAGO Controller BACnet/IP · WAGO Controller BACnet MS/TP +2
- CVE-2024-2400Use after free in Performance Manager in Google Chrome prior to 122.0.6261.128 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2023-41504SQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary code via the Student Search function.
- CVE-2024-24105SQL Injection vulnerability in Code-projects Computer Science Time Table System 1.0 allows attackers to run arbitrary code via adminFormvali
- CVE-2024-26529An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) via the mmsServer_hand
- CVE-2024-28431DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php.
- CVE-2024-28432DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php.
- CVE-2024-28665DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_add.php
- CVE-2024-28671DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/stepselect_main.php.
- CVE-2024-28673DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php.
- CVE-2024-28675DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php
- CVE-2024-28684DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.php
Medium, low and unrated 161
- CVE-2024-28251Cross-site websocket hijacking in Querybookpinterest querybook
- CVE-2024-2242Contact Form 7 <= 5.9 - Reflected Cross-Site Scriptingrocklobsterinc Contact Form
- CVE-2024-2079WPBakery Page Builder Addons by Livemesh <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeWPBakery Page Builder Addons by Livemesh
- CVE-2023-38536HTML injection in OpenText™ Exceed Turbo X affecting version 12.5.1.OpenText™ Exceed Turbo X
- CVE-2023-38535Use of Hard-coded Cryptographic Key vulnerability in OpenText™ Exceed Turbo X affecting versions 12.5.1 and 12.5.2.OpenText™ Exceed Turbo X
- CVE-2023-50726Users with `create` but not `override` privileges can perform local sync in argo-cdargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2024-27097Potential log injection in reset user endpoint in ckanckan
- CVE-2024-28193Disclosure of Spotify API Access Tokens to Guest Users Using Public Tokens in your_spotifyYooooomi your_spotify
- CVE-2024-28192NoSQL Injection Leading to Authentication Bypass in your_spotifyYooooomi your_spotify
- CVE-2024-24692Zoom Rooms Client for Windows - Race ConditionZoom Video Communications Zoom Rooms Client for Windows
- CVE-2024-2403 Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attaDevolutions Remote Desktop Manager
- CVE-2024-2418SourceCodester Best POS Management System view_order.php sql injectionSourceCodester Best POS Management System
- CVE-2024-2433PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability LossPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-2432GlobalProtect App: Local Privilege Escalation (PE) VulnerabilityPalo Alto Networks GlobalProtect App
- CVE-2024-2431GlobalProtect App: Local User Can Disable GlobalProtectPalo Alto Networks GlobalProtect App
- CVE-2024-28196Clickjacking in your_spotifyYooooomi your_spotify
- CVE-2024-0173Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability.Dell PowerEdge Platform
- CVE-2024-20319A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured mCisco IOS XR Software
- CVE-2024-20262A vulnerability in the Secure Copy Protocol (SCP) and SFTP feature of Cisco IOS XR Software could allow an authenticated, local attacker to Cisco IOS XR Software
- CVE-2024-20315A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allowCisco IOS XR Software
- CVE-2024-20322A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software couldCisco IOS XR Software
- CVE-2024-20266A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trCisco IOS XR Software
- CVE-2024-0154Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability.Dell PowerEdge Platform
- CVE-2024-27953WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.6.8 is vulnerable to Broken Access ControlCool Plugins Cryptocurrency Widgets – Price Ticker & Coins…
- CVE-2024-0163Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability.Dell PowerEdge BIOS Intel
- CVE-2024-0162Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge BIOS Intel
- CVE-2024-25101WordPress Maspik – Spam blacklist Plugin <= 0.10.6 is vulnerable to Cross Site Scripting (XSS)yonifre Maspik – Spam Blacklist
- CVE-2024-25099WordPress Paytium: Mollie payment forms & donations Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)David de Boer Paytium: Mollie payment forms & donations
- CVE-2024-25097WordPress TNC PDF viewer Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)ThemeNcode TNC PDF viewer
- CVE-2024-23672Apache Tomcat: WebSocket DoS with incomplete closing handshakeApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2024-2000Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multi Scroll WidgetPremium Addons for Elementor Premium Addons Pro for Element…
- CVE-2024-1668Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form EntriesThemeFusion Avada | Website Builder For WordPress & WooComm…
- CVE-2024-2238Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Mouse Cursor ModulePremium Addons for Elementor Premium Addons Pro for Element…
- CVE-2024-1997Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Messenger Chat WidgetPremium Addons for Elementor Premium Addons Pro for Element…
- CVE-2024-1996Premium Addons for Elementor PRO <= 2.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget linkPremium Addons for Elementor Premium Addons Pro for Element…
- CVE-2024-2237Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge ModulePremium Addons for Elementor Premium Addons Pro for Element…
- CVE-2024-2239Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll ModulePremium Addons for Elementor Premium Addons Pro for Element…
- CVE-2024-1291Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemefusecom Brizy – Page Builder
- CVE-2024-1894Burst Statistics – Privacy-Friendly Analytics for WordPress <= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_countburstbv Burst Statistics – Privacy-Friendly WordPress Analy…
- CVE-2024-0687Restrict User Access – Ultimate Membership & Content Protection <= 2.5 - Information Exposureintoxstudio Restrict User Access – Ultimate Membership & Co…
- CVE-2024-1413Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widgettimstrifler Exclusive Addons for Elementor
- CVE-2023-6957Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingtechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2024-2252Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingdroitthemes Droit Elementor Addons – Widgets, Blocks, Templ…
- CVE-2024-1489SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgerycozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…
- CVE-2024-1723SiteOrigin Widgets Bundle <= 1.58.7 - Authenticated (Contributor+) Stored Cross-Site Scriptinggpriday SiteOrigin Widgets Bundle
- CVE-2024-1038Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scriptingbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2024-1499Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2024-0827Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Cross-Site Request Forgeryhammadh Play.ht – Make Your Blog Posts Accessible With Text…
- CVE-2024-1080Beaver Builder – WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tagbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2024-2286Sky Addons for Elementor <= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URLwowdevs Sky Addons – Elementor Addons with Widgets & Templa…
- CVE-2024-2028Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widgettimstrifler Exclusive Addons for Elementor
- CVE-2024-1806ProfilePress <= 4.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcodeproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2024-1126EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrievalmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-0377LifterLMS – WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_reviewchrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…
- CVE-2024-1541Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scriptingstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-0829Comments Extra Fields For Post,Pages and CPT <= 5.0 - Missing Authorizationnmedia Comments Extra Fields For Post,Pages and CPT
- CVE-2024-0369Bulk Edit Post Titles <= 5.0.0 - Missing Authorization via bulkUpdatePostTitlespawaryogesh1989 Bulk Edit Post Titles
- CVE-2024-2030Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodecrmperks Database for Contact Form 7, WPforms, Elementor fo…
- CVE-2024-1365YML for Yandex Market <= 4.2.3 - Reflected Cross-Site Scriptingicopydoc YML for Yandex Market
- CVE-2024-1393Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widgetwpvibes Addon Elements for Elementor
- CVE-2024-1497Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attributethemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2024-0700Simple Tweet <= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site Scriptingwokamoto Simple Tweet
- CVE-2024-0898Chat Bubble <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scriptingbluecoral Chat Bubble – Floating Chat with Contact Chat Ico…
- CVE-2024-1074Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widgetbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2024-0681Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypasscyberlord92 Page and Post Restriction
- CVE-2024-0631Duitku Payment Gateway <= 2.11.6 - Missing Authorization via check_duitku_responserayhanduitku Duitku Payment Gateway
- CVE-2023-6809Custom fields shortcode <= 0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodegonahkar Custom fields shortcode
- CVE-2024-1391Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widgetwpvibes Addon Elements for Elementor
- CVE-2024-0896Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2023-7015File Manager Pro <= 8.3.4 - Reflected Cross-Site ScriptingFile Manager Pro
- CVE-2024-1684Otter Blocks PRO <= 2.6.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via File Field CSSThemisle Otter Blocks PRO – Gutenberg Blocks, Page Builder…
- CVE-2024-0830Comments Extra Fields For Post,Pages and CPT <= 5.0 - Cross-Site Request Forgerynmedia Comments Extra Fields For Post,Pages and CPT
- CVE-2024-1985Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scriptingwpinsider-1 Simple Membership
- CVE-2024-1363Easy Accordion – Best Accordion FAQ Plugin for WordPress <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingshapedplugin Easy Accordion – Responsive Accordion FAQ Buil…
- CVE-2024-1854Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2024-0447ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Missing Authorization to Settings UpdateArtiBot Free Chat Bot for WebSites
- CVE-2024-1237Elementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce Ultimate Addons for Elementor
- CVE-2024-2293Site Reviews <= 6.11.4 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display namegeminilabs Site Reviews
- CVE-2024-1537Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Tablewpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2023-6785Download Manager <= 3.2.84 - Missing Authorizationcodename065 Download Manager
- CVE-2024-1380Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log ExportRelevanssi Premium · comesio Relevanssi – A Better Search
- CVE-2024-1691Otter Blocks PRO <= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG UploadThemisle Otter Blocks PRO – Gutenberg Blocks, Page Builder…
- CVE-2023-6969User Shortcodes Plus <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via user_meta Shortcodekbjohnson90 User Shortcodes Plus
- CVE-2024-1321EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypassmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-1680Premium Addons for Elementor <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgetsleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-1414Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widgettimstrifler Exclusive Addons for Elementor
- CVE-2024-1479WP Show Posts <= 1.1.4 - Information Exposureedge22 WP Show Posts
- CVE-2024-1083Simple Restrict <= 1.2.6 - Missing Authorization to Sensitive Information Exposurewpchill Simple Restrict
- CVE-2024-1462Maintenance Page <= 1.0.8 - Security Mechanism Bypass via REST APIthemegrill Maintenance Page
- CVE-2024-1452GenerateBlocks <= 1.8.2 - Sensitive Information Exposureedge22 GenerateBlocks
- CVE-2024-0614Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settingsnetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2023-6880Visual Composer Premium <= 45.6.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingvisualcomposer Visual Composer Website Builder
- CVE-2024-0592Related Posts for WordPress <= 2.2.1 - Cross-Site Request Forgerybarrykooij Related Posts for WordPress
- CVE-2023-6954Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecodename065 Download Manager
- CVE-2024-0591wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.2 - Reflected Cross-Site Scripting.wpDataTables – WordPress Data Table, Dynamic Tables & Table…
- CVE-2024-1293Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemefusecom Brizy – Page Builder
- CVE-2024-0828Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Missing Authorizationhammadh Play.ht – Make Your Blog Posts Accessible With Text…
- CVE-2024-1409Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcodeproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2024-1763Wp Social Login and Register Social Counter <= 3.0.0 - Missing Authorization to Unauthenticated Social Login/Share Status Updateroxnor Wp Social Login and Register Social Counter
- CVE-2024-0976WP Event Manager <= 3.1.41 - Reflected Cross-Site Scripting via pluginwpeventmanager WP Event Manager – Events Calendar, Registra…
- CVE-2024-1422Elementor Addon Elements <= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effetwpvibes Addon Elements for Elementor
- CVE-2024-1640Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form <= 2.10.1 - Unauthenticated Insecure Direct Object Reference to Form Submission Alterationbitpressadmin Bit Form – Custom Contact Form, Multi Step, C…
- CVE-2024-0449ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Authenticated (Admin+) Cross-Site ScriptingArtiBot Free Chat Bot for WebSites
- CVE-2024-1296Brizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemefusecom Brizy – Page Builder
- CVE-2024-1484Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scriptingameliabooking Booking for Appointments and Events Calendar…
- CVE-2024-1127EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Exportmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-1535ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2024-1585Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2024-1392Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widgetwpvibes Addon Elements for Elementor
- CVE-2024-1642MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulkMainWP Dashboard: Self-hosted WordPress Management for Agen…
- CVE-2024-1383WPvivid Backup for MainWP <= 0.9.32 - Reflected Cross-Site Scriptingwpvividplugins WPvivid Backup for MainWP
- CVE-2024-2106MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST routestylemix MasterStudy LMS WordPress Plugin – for Online Cour…
- CVE-2024-0871Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widgetbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2024-0326Premium Addons for Elementor <= 4.10.17 - Authenticated(Contributor+) Stored Cross-Site Scripting via Link Wrapperleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-0897Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2024-1370Maintenance Page <= 1.0.8 - Missing Authorization to Sensitive Information Exposurethemegrill Maintenance Page
- CVE-2024-0839FeedWordPress <= 2022.0222 - Insecure Direct Object Refereceradgeek FeedWordPress
- CVE-2024-0385Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategoryfrenify Categorify – WordPress Media Library Category & Fil…
- CVE-2024-1234Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingtimstrifler Exclusive Addons for Elementor
- CVE-2024-1158Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorizationthemekraft Post Form – Registration Form – Profile Form for…
- CVE-2024-1690TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.4.10 - Missing Authorization to Authenticated (Subscriber+) User Email Exportsubratamal Wallet for WooCommerce
- CVE-2024-1176HT Easy GA4 – Google Analytics WordPress Plugin <= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Updatehtplugins HT Easy GA4 – Google Analytics WordPress Plugin
- CVE-2024-1843Auto Affiliate Links <= 6.4.3 - Missing Authorization via aalAddLinkthedark Auto Affiliate Links
- CVE-2024-2126Orbit Fox by ThemeIsle <= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widgetthemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2024-25154Path Traversal in FileCatalyst Direct 3.8.8 and EarlierFortra FileCatalyst
- CVE-2024-26629nfsd: fix RELEASE_LOCKOWNERLinux
- CVE-2023-52608firmware: arm_scmi: Check mailbox/SMT channel for consistencyLinux
- CVE-2024-1508Prime Slider – Addons For Elementor <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury Widgetbdthemes Prime Slider – Addons for Elementor
- CVE-2024-1507Prime Slider – Addons For Elementor <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rubix Widgetbdthemes Prime Slider – Addons for Elementor
- CVE-2024-2416Cross-Site Request Forgery vulnerability in Movistar 4G routerRouter Movistar
- CVE-2024-1979Quarkus: information leak in annotationquarkus · Red Hat build of Quarkus 3.2.11.Final +2
- CVE-2023-32335IBM Maximo Application Suite information disclosureIBM Maximo Application Suite · IBM Maximo Asset Management
- CVE-2023-43043IBM Maximo Application Suite information disclosureIBM Maximo Application Suite - Maximo Mobile for EAM
- CVE-2023-38723Maximo Asset Management cross-site scriptingIBM Maximo Asset Management
- CVE-2023-28517IBM Sterling Partner Engagement Manager cross-site scriptingIBM Sterling Partner Engagement Manager
- CVE-2018-25090Wago: Improper Neutralization of Input During Web Page Generation in multiple devicesWAGO Controller BACnet/IP · WAGO Controller BACnet MS/TP +2
- CVE-2024-27440The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3.14 don't properly veToyoko Inn IT Solution Co. Toyoko Inn official App for iOS…
- CVE-2015-10130The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0.nik00726 Team Circle Image Slider With Lightbox
- CVE-2024-2412Heimavista Rpage and Epage - Broken Access ControlHeimavista Rpage · Heimavista Epage
- CVE-2024-1582WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpgmaps WP Go Maps
- CVE-2023-4839WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scriptingwpgmaps WP Go Maps
- CVE-2023-36238Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter.bagisto/bagisto
- CVE-2024-27703Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter.
- CVE-2024-28429DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.php
- CVE-2024-28430DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_edit.php.
- CVE-2024-28623RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.
- CVE-2024-28662A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/fu
- CVE-2024-28666DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/media_add.php
- CVE-2024-28667DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/templets_one_edit.php
- CVE-2024-28668DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/mychannel_add.php
- CVE-2024-28669DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_edit.php.
- CVE-2024-28670DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_main.php.
- CVE-2024-28672DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php.
- CVE-2024-28676DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via /dede/article_edit.php.
- CVE-2024-28677DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_main.php.
- CVE-2024-28678DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_description_main.ph
- CVE-2024-28679DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via Photo Collection.
- CVE-2024-28680DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_add.php.
- CVE-2024-28681DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus_edit.php.
- CVE-2024-28682DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys_cache_up.php.
- CVE-2024-28683DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via create file.