CVEs published May 2, 2024
243 CVEs were published on May 2, 2024: 9 critical, 53 high.
- Published
- 243
- Critical
- 9
- High
- 53
- Medium
- 177
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Adobe Acrobat Reader
- 6
- averta Shortcodes and extra features for Phlox theme
- 6
- devitemsllc HT Mega Addons for Elementor – Elementor Widget…
- 6
- Zscaler Client Connector
- 6
- timstrifler Exclusive Addons for Elementor
- 5
- WPBakery Page Builder
- 4
- alimir WP ULike – Like & Dislike Buttons for Engagement and…
- 3
- extendthemes Colibri Page Builder
- 3
- leap13 Premium Addons for Elementor – Powerful Elementor Te…
- 3
- svs-websoft SVS Pricing Tables
- 3
Critical 9
- CVE-2024-2667InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File UploadInstaWP Connect – 1-click WP Staging & Migration
- CVE-2024-2876Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injectionicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2024-3729Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulationshabti Frontend Admin by DynamiApps
- CVE-2024-34144A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allowsJenkins Project Jenkins Script Security Plugin · org.jenkin…
- CVE-2024-33913WordPress Xserver Migrator plugin <= 1.6.1 - CSRF to Arbitrary File Upload vulnerabilityXserver Migrator
- CVE-2024-3955Arbitrary code execution in CraftBeerPi 4PiBrewing CraftBeerPi · CraftBeerPi - Brewing Controller… +1
- CVE-2024-32962XML signature verification bypass due improper verification of signature / signature spoofingnode-saml xml-crypto · xml-crypto
- CVE-2024-32971Defect in query plan cache may cause incorrect operations to be executed in Apollo Routerapollographql router · apollo-router
- CVE-2024-31967A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen
High 53
- CVE-2024-30301ZDI-CAN-23042: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-30303ZDI-CAN-23044: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-30305ZDI-CAN-23043: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-30306ZDI-CAN-23106: Adobe Acrobat Reader DC AcroForm Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-30304ZDI-CAN-23040: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-25047IBM Cognos Analytics log injectionIBM Cognos Analytics
- CVE-2024-4140An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipartrjbs Email-MIME
- CVE-2024-34394libxmljs2 namespaces type confusion RCElibxmljs2
- CVE-2024-34393libxmljs2 attrs type confusion RCElibxmljs2
- CVE-2024-34392libxmljs namespaces type confusion RCElibxmljs
- CVE-2024-34391libxmljs attrs type confusion RCElibxmljs
- CVE-2024-4216XSS vulnerability in /settings/store API response json payload in pgAdmin 4pgadmin.org pgAdmin · pgadmin4
- CVE-2024-4215The Multi Factor Authentication bypass vulnerability in pgAdmin 4pgadmin.org pgAdmin · pgadmin4
- CVE-2024-4097Cost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG UploadStylemixThemes Cost Calculator Builder PRO
- CVE-2024-3849Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File InclusionClick to Chat – HoliThemes
- CVE-2023-7064Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importeraverta Shortcodes and extra features for Phlox theme
- CVE-2024-4033All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured imageplugins360 All-in-One Video Gallery
- CVE-2024-1797WP ULike – Most Advanced WordPress Marketing Toolkit <= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodesalimir WP ULike – Like & Dislike Buttons for Engagement and…
- CVE-2024-2417User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2024-2082EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.7 - Unauthenticated Stored Cross-Site Scriptingcscode EleForms – All In One Form Integration including DB…
- CVE-2023-6961WP Meta SEO <= 4.5.12 - Unauthenticated Stored Cross-Site Scripting via Referer headerjoomunited WP Meta SEO
- CVE-2024-3500ElementsKit Pro <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgetswpmet ElementsKit Pro
- CVE-2024-3715Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scriptingcrmperks Database for Contact Form 7, WPforms, Elementor fo…
- CVE-2024-1173WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Authenticated (AccountingManager+) SQL Injectionwedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…
- CVE-2024-1567Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Uploadwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-3499ElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Moduleroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2023-6214HT Mega – Absolute Addons For Elementor <= 2.4.6 - Sensitive Information Exposure via purchased_productsdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-3895WP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updatefahadmahmood WP Datepicker
- CVE-2024-2661Barcode Scanner with Inventory & Order Manager <= 1.5.4 - Authenticated (Subscriber+) SQL Injectionukrsolution Barcode Scanner (+Mobile App) – Inventory manag…
- CVE-2024-1897Grid Gallery – Photo Image Grid Gallery <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcodeawordpresslife Grid Gallery for Images
- CVE-2024-3045PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Stored Cross-Site Scriptingwpovernight PDF Invoices & Packing Slips for WooCommerce
- CVE-2024-3047PDF Invoices & Packing Slips for WooCommerce <= 3.8.0 - Unauthenticated Server-Side Request Forgerywpovernight PDF Invoices & Packing Slips for WooCommerce
- CVE-2024-1896Photo Gallery <= 1.4.2 - Authenticated(Contributor+) PHP Object Injection via Shortcodeawordpresslife Photo Gallery for Images
- CVE-2024-2831Calendar <= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcodekieranoshea Calendar
- CVE-2024-1945ARForms Form Builder <= 1.6.4 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletionreputeinfosystems Contact Form, Survey, Quiz & Popup Form B…
- CVE-2024-4406Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution VulnerabilityXiaomi Pro
- CVE-2024-4405Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution VulnerabilityXiaomi Pro
- CVE-2024-3544LoadMaster Hardcoded SSH KeyProgress Software LoadMaster
- CVE-2024-30251Denial of service when trying to parse malformed POST requests in aiohttpaio-libs aiohttp · aiohttp
- CVE-2024-34145A sandbox bypass vulnerability involving sandbox-defined classes that shadow specific non-sandbox-defined classes in Jenkins Script SecurityJenkins Project Jenkins Script Security Plugin · org.jenkin…
- CVE-2024-23459Multiple Arbitrary Creates/Overwrites by link followingZscaler Client Connector
- CVE-2024-33911WordPress The School Management Pro plugin <= 10.3.4 - SQL Injection vulnerabilityWeblizar School Management Pro
- CVE-2024-32114Apache ActiveMQ: Jolokia and REST API were not secured with default configurationApache Software Foundation Apache ActiveMQ · org.apache.act…
- CVE-2024-3476Side Menu Lite < 4.2.1 - Menu Deletion via CSRFSide Menu Lite
- CVE-2024-3475Sticky Buttons < 3.2.4 - Button Deletion via CSRFSticky Buttons
- CVE-2024-3474Wow Skype Buttons < 4.0.4 - Button Deletion via CSRFWow Skype Buttons
- CVE-2023-50685An issue in Hipcam Cameras RealServer v.1.0 allows a remote attacker to cause a denial of service via a crafted script to the client_port pa
- CVE-2024-25290An issue in Casa Systems NL1901ACV R6B032 allows a remote attacker to execute arbitrary code via the userName parameter of the add function.
- CVE-2024-29309An issue in Alfresco Content Services v.23.3.0.7 allows a remote attacker to execute arbitrary code via the Transfer Service.
- CVE-2024-31964A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen
- CVE-2024-33303SourceCodester Product Show Room 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" under Add Users.
- CVE-2024-33396An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token cogithub.com/karmada-io/karmada
- CVE-2024-33530In Jitsi Meet before 9391, a logic flaw in password-protected Jitsi meetings (that make use of a lobby) leads to the disclosure of the meeti
Medium, low and unrated 181
- CVE-2024-30302ZDI-CAN-23077: Adobe Acrobat Reader DC AcroForm Use-After-Free Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2024-3681Interactive World Maps <= 2.4.14 - Reflected Cross-Site Scriptingcmoreira Interactive World Maps
- CVE-2024-3473Header Footer Code Manager Pro <= 1.0.16 - Reflected Cross-Site Scripting via message99robots Header Footer Code Manager Pro
- CVE-2024-0710GP Unique ID <= 1.5.5 - Unauthenticated Form Submission Unique ID ModificationGravity Wiz GP Unique ID
- CVE-2024-2324FileOrganizer and FileOrganizer Pro <= 1.0.6 - Authenticated Stored Cross-Site Scriptingsoftaculous FileOrganizer – WordPress File Manager
- CVE-2024-3601Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Email Enumerationays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…
- CVE-2024-2752Where Did You Hear About Us Checkout Field for WooCommerce <= 1.3.1 - Authenticated (Shop Manager+) Stored Cross-Site Scriptingwooassist Where Did You Hear About Us Checkout Field for Wo…
- CVE-2024-3553Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Updatethemeum Tutor LMS – eLearning and online course solution
- CVE-2024-3340Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' Shortcodeextendthemes Colibri Page Builder
- CVE-2024-3936The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorizationtechlabpro1 The Post Grid – Shortcode, Gutenberg Blocks and…
- CVE-2024-4086CM Tooltip Glossary – Powerful Glossary Plugin <= 4.2.11 - Cross-Site Request Forgerycreativemindssolutions CM Tooltip Glossary
- CVE-2024-3743Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpvibes Addon Elements for Elementor
- CVE-2023-7030Collapse-O-Matic <= 1.8.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodebaden03 Collapse-O-Matic
- CVE-2024-2751Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBoxtimstrifler Exclusive Addons for Elementor
- CVE-2024-2273Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scriptingstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-2960SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletionsvs-websoft SVS Pricing Tables
- CVE-2024-3897Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposureays-pro Popup Box – Create Countdown, Coupon, Video, Contac…
- CVE-2023-6731WP Show Posts <= 1.1.5 - Improper Authorization to Information Exposureedge22 WP Show Posts
- CVE-2024-3747Blocksy <= 2.0.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via About Me blockcreativethemeshq Blocksy
- CVE-2024-1716Admin Bar Remover <= 1.0.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Updatelitonice13 Admin Bar Editor – Toolbar Customization with Us…
- CVE-2024-4324WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameterwptipsntricks WP Video Lightbox
- CVE-2024-3607PropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletionpropertyhive Property Hive
- CVE-2024-1415Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Cross-Site Request Forgerythemehunk Lead Form Builder & Contact Form
- CVE-2024-1759WP ULike <= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scriptingalimir WP ULike – Like & Dislike Buttons for Engagement and…
- CVE-2024-4034Virtue <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Authorstellarwp Virtue
- CVE-2024-2328Real Media Library <= 4.22.11 - Authenticated (Author+) Stored Cross-Site Scriptingdevowl Real Media Library: Media Library Folder & File Mana…
- CVE-2024-1416Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Missing Authorizationthemehunk Lead Form Builder & Contact Form
- CVE-2024-3725Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag'themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…
- CVE-2024-3233Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creationvinod-dalvi Ivory Search – WordPress Search Plugin
- CVE-2024-1840WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post AuthorWPBakery Page Builder
- CVE-2024-2349Fancy Elementor Flipbox <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox Widgethosseinhashemi Fancy Elementor Flipbox
- CVE-2024-3307HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-4036Sydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scriptingsmub Sydney Toolbox
- CVE-2024-3588Getwid – Gutenberg Blocks <= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown'jetmonsters Getwid – Gutenberg Blocks
- CVE-2024-2401Admin Page Spider <= 3.31 - Authenticated (Admin+) Stored Cross-Site Scriptingjatacid Admin Page Spider
- CVE-2024-1679Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Authenticated(Subscriber+) Stored Cross-Site Scripting via Templatesukrsolution Print Labels with Barcodes. Create price tags,…
- CVE-2024-4000WordPress Header Builder Plugin – Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodestylemix Pearl – Header Builder
- CVE-2024-0613Delete Custom Fields <= 0.3.1 - Cross-Site Request Forgery to Post Meta Deletiongluten Delete Custom Fields
- CVE-2024-3606ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorizationmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2024-3550WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodegn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2024-06292Checkout Payment Gateway for WooCommerce <= 6.2 - Missing Authorization via sniff_insnmedia 2Checkout Payment Gateway for WooCommerce
- CVE-2024-4085Tabellen von faustball.com <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scriptingdocolli Tabellen von faustball.com
- CVE-2024-3337Colibri Page Builder <= 1.0.272 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' Shortcodeextendthemes Colibri Page Builder
- CVE-2024-3197The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributesposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-3891Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tagsthehappymonster Happy Addons for Elementor
- CVE-2024-3199The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-3215Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgerystrangerstudios Paid Memberships Pro – Content Restriction,…
- CVE-2024-4265Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.5.9 - Contributor+ Stored Cross-Site Scriptinglitonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2024-3517Shortcodes and extra features for Phlox theme <= 2.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Widgetaverta Shortcodes and extra features for Phlox theme
- CVE-2024-0615Content Control <= 2.1.0 - Missing Authorization to Sensitive Information Exposuredanieliser Content Control – The Ultimate Content Restricti…
- CVE-2024-2797MailerLite – Signup forms (official) <= 1.7.6 - Missing AuthorizationMailerLite – Signup forms
- CVE-2024-3287SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorizationwpmudev SmartCrawl SEO checker, analyzer & optimizer
- CVE-2024-3870Contact Form 7 Database Addon – CFDB7 <= 1.2.6.8 - Unauthenticated Sensitive Information Exposurearshidkv12 Database Addon for Contact Form 7 – CFDB7
- CVE-2024-3650The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all verxpeedstudio ElementsKit Elementor addons and Templates Libr…
- CVE-2024-0848AA Cash Calculator <= 1.0 - Reflected Cross-Site Scripting via invoiceaaextention AA Cash Calculator
- CVE-2024-2542Jotform Online Forms <= 1.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via ShortcodeOnline Forms — Customizable Payment, Contact, Quiz, Survey…
- CVE-2024-0908Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page <= 1.13.4 - Missing Authorization to Information Disclosurebplugins Advanced Post Block – Showcase Posts with Grid, Li…
- CVE-2024-2084HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widgetdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-3312Easy Custom Auto Excerpt <= 2.4.12 - Sensitive Information Exposuretodiadiatmo Easy Custom Auto Excerpt
- CVE-2024-1533Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingaverta Shortcodes and extra features for Phlox theme
- CVE-2024-2109Booster Extension <= 1.2.0 - Basic Information Exposure via booster_extension_authorbox_shortcode_displaythemeinwp Booster Extension
- CVE-2024-2765Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile, Registration…
- CVE-2024-3295User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.5 - Missing Authorization to Unauthenticated Media Deletionwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2023-7067ShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_storedevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2024-4092Slider Revolution <= 6.7.7 - Authenticated (Author+) Stored Cross-Site Scripting via htmltag ParameterRevolution Slider Slider Revolution
- CVE-2024-2967Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor <= 4.4.7 - Authenticated (Admin+) Stored Cross-Site Scriptingaharonyan Guest posting / Frontend Posting / Front Editor –…
- CVE-2024-2346FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Referenceninjateam FileBird – WordPress Media Library Folders & File…
- CVE-2024-3724Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, & Horizontal Timelinethehappymonster Happy Addons for Elementor
- CVE-2024-4133ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirectreputeinfosystems ARMember – Membership Plugin, Content Res…
- CVE-2024-1386The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in MailerLite – Signup forms
- CVE-2024-3677Ultimate 410 Gone Status Code <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingtinyweb Ultimate 410 Gone Status Code
- CVE-2024-1809Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) <= 5.2.3 - Missing Authorizationhiddenpearls Analytify – Google Analytics Dashboard For Wor…
- CVE-2024-1805WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attributeWPBakery Page Builder
- CVE-2024-2959SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creationsvs-websoft SVS Pricing Tables
- CVE-2024-3489Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Expired Titletimstrifler Exclusive Addons for Elementor
- CVE-2024-1993Icon Widget <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodeseothemes Icon Widget
- CVE-2024-1677Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 3.4.6 - Improper Authorizationukrsolution Print Labels with Barcodes. Create price tags,…
- CVE-2024-2043EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.7 - Missing Authorization to Sensitive Information Exposurecscode EleForms – All In One Form Integration including DB…
- CVE-2024-3649Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulationsmub WPForms – Easy Form Builder for WordPress – Contact Fo…
- CVE-2024-1842WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Heading tag attributeWPBakery Page Builder
- CVE-2024-2958SVS Pricing Tables <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scriptingsvs-websoft SVS Pricing Tables
- CVE-2024-3942MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorizationstylemix MasterStudy LMS WordPress Plugin – for Online Cour…
- CVE-2024-1688Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrievalshivashankerbhatta Woo Total Sales
- CVE-2024-3670Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) <= 3.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeharmr Leaflet Maps Marker
- CVE-2024-3275eRoom – Zoom Meetings & Webinar <= 1.4.18 - Missing Authorization to Information Exposuredigitalmeactivecampaign eRoom – Webinar & Meeting Plugin fo…
- CVE-2024-1678Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST APIdunhakdis Subway – Private Site Option
- CVE-2024-3991ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _iddevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2024-1396Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag'averta Shortcodes and extra features for Phlox theme
- CVE-2024-2790HT Mega – Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-3674Inline Google Spreadsheet Viewer <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodemeitar Inline Google Spreadsheet Viewer
- CVE-2024-4203Premium Addons for Elementor <= 4.10.30 - Authenticated (Contributor+) Stored Cross-Site Scriptingleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-2867Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2024-1572WP ULike <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodealimir WP ULike – Like & Dislike Buttons for Engagement and…
- CVE-2024-3734FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.8 - Unauthenticated Arbitrary Shortcode Executionrealmag777 FOX – Currency Switcher Professional for WooComm…
- CVE-2024-3599WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletionwplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…
- CVE-2024-3647Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style'leap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-3161Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetjegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2024-3071ACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Updateamaa ACF On-The-Go
- CVE-2024-3819Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Bannerjegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2024-3885Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scriptingleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-3338Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scriptingextendthemes Colibri Page Builder
- CVE-2024-3341Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_gmaps' Shortcodeaverta Shortcodes and extra features for Phlox theme
- CVE-2024-1841WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attributeWPBakery Page Builder
- CVE-2024-3308HT Mega – Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widgetdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-3546WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory TraversalWebToffee WP Backup and Migration
- CVE-2024-3675Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributeswproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-2750Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widgettimstrifler Exclusive Addons for Elementor
- CVE-2024-3021Mhr Post Ticker <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scriptingmdhadid Mhr Post Ticker
- CVE-2024-1584Analytify <= 5.2.1 - Missing Authorization to Unauthenticated Google Analytics Tracking ID Modificationhiddenpearls Analytify – Google Analytics Dashboard For Wor…
- CVE-2024-2503Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Gridtimstrifler Exclusive Addons for Elementor
- CVE-2024-3554All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesmub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…
- CVE-2024-3728Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circlewpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-4156Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-3985Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Actiontimstrifler Exclusive Addons for Elementor
- CVE-2024-3206Different Menu in Different Pages – Control Menu Visibility (All in One) <= 2.3.2 - Missing Authorization to Menu Duplicationrecorp Different Menu in Different Pages – Conditional Menu
- CVE-2024-4003Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-08475280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages5280studios 5280 Bootstrap Modal Contact Form
- CVE-2024-4334Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scriptingdivisupreme Supreme Modules Lite – Divi Theme, Extra Theme…
- CVE-2024-3957Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Executionpluggabl Booster for WooCommerce – PDF Invoices, Abandoned…
- CVE-2024-2840Enhanced Media Library <= 2.8.9 - Authenticated (Author+) Stored Cross-Site Scriptingwebbistro Enhanced Media Library
- CVE-2024-3717Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposureglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2024-4083Easy Restaurant Table Booking <= 1.0.0 - Cross-Site Request Forgeryway2neelam Easy Restaurant Table Booking
- CVE-2024-2345FileBird – WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scriptingninjateam FileBird – WordPress Media Library Folders & File…
- CVE-2024-3107Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversalbrainstormforce Spectra Gutenberg Blocks – Website Builder…
- CVE-2024-1959Social Sharing Plugin – Social Warfare <= 4.4.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcodewarfareplugins Social Sharing Plugin – Social Warfare
- CVE-2024-2085HT Mega – Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size'devitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-1348Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JSaverta Shortcodes and extra features for Phlox theme
- CVE-2024-3074Elementor ImageBox <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingflickdevs Elementor ImageBox
- CVE-2024-3520Country State City Dropdown CF7 <= 2.7.1 - Missing Authorizationtrustyplugins Country State City Dropdown CF7
- CVE-2024-3585Send PDF for Contact Form 7 <= 1.0.2.3 - Missing Authorizationflorent73 Send PDF for Contact Form
- CVE-2024-3581MaxGalleria <= 6.4.2 - Missing Authorizationmaxfoundry MaxGalleria
- CVE-2024-3023AnnounceKit <= 2.0.9 - Authenticated (Admin+) Stored Cross-Site Scriptingrestpack AnnounceKit
- CVE-2023-6962WP Meta SEO <= 4.5.12 - Information Exposure via Meta Descriptionjoomunited WP Meta SEO
- CVE-2024-33948WordPress TweetScroll Widget plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerabilityPixel Industry TweetScroll Widget
- CVE-2024-33949WordPress Min and Max Purchase for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerabilityVark Min and Max Purchase for WooCommerce
- CVE-2024-4433WordPress Simple Image Popup plugin <= 2.4.0 - Cross-Site Scripting (XSS) vulnerabilityMr Digital Simple Image Popup
- CVE-2024-4029Wildfly: no timeout for eap management interface may lead to denial of service (dos)wildfly · Red Hat JBoss Enterprise Application Platform +7
- CVE-2023-47727IBM QRadar Suite Software file manipulationIBM Cloud Pak for Security · IBM QRadar Suite Software
- CVE-2024-3543LoadMaster Reversible Password Encryption AlgorithmProgress Software LoadMaster
- CVE-2024-34061Reflected cross site scripting in changedetection.iodgtlmoon changedetection.io · changedetection-io
- CVE-2024-34148Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is Jenkins Project Jenkins Subversion Partial Release Manager…
- CVE-2024-34147Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins contJenkins Project Jenkins Telegram Bot Plugin · org.jenkins-c…
- CVE-2024-34146Jenkins Git server Plugin 114.v068a_c7cc2574 and earlier does not perform a permission check for read access to a Git repository over SSH, aJenkins Project Jenkins Git server Plugin · org.jenkins-ci.…
- CVE-2024-4128CSRF in firebase-tools emulator suitefirebase-tools · github.com/firebase/firebase-tools
- CVE-2023-37244Privilege escalation in N-Able's AutomationManagerAgentN-Able AutomationManagerAgent
- CVE-2024-23462ZCC Mac validinstaller file integrity check missingZscaler Client Connector
- CVE-2024-23461ZCC macOS Upgrade ZIP Bomb DoSZscaler Client Connector
- CVE-2023-41971Windows ZCC Upgrade DoS And Privilege Escalation Through RPC ControlZscaler Client Connector
- CVE-2023-41970Repair App local code execution with arbitrary privilegesZscaler Client Connector
- CVE-2023-28798Out-of-bounds write to heap in pacparserZscaler Client Connector
- CVE-2024-33950WordPress Archives Calendar Widget plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerabilityAleksei Polechin (alek´) Archives Calendar Widget
- CVE-2024-33951WordPress Perfect Pullquotes plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerabilityAdam DeHaven Perfect Pullquotes
- CVE-2024-33942WordPress Google Typography plugin <= 1.1.2 - Broken Access Control vulnerabilityEric Alli Google Typography
- CVE-2024-33944WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerabilityKestrel WooCommerce AWeber Newsletter Subscription
- CVE-2024-33956WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Broken Access Control vulnerabilityThemeLocation Custom WooCommerce Checkout Fields Editor
- CVE-2024-33952WordPress Unique theme <= 0.3.0 - Cross Site Scripting (XSS) vulnerabilityJustin Tadlock Unique
- CVE-2024-33953WordPress Adventure Journal theme <= 1.7.2 - Cross Site Scripting (XSS) vulnerabilityMatt van Andel Adventure Journal
- CVE-2024-33954WordPress Pliska theme <= 0.3.5 - Cross Site Scripting (XSS) vulnerabilityAtanas Yonkov Pliska
- CVE-2024-33955WordPress Freesia Empire theme <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityTheme Freesia Freesia Empire
- CVE-2024-33938WordPress Sliding Widgets plugin <= 1.5.0 - Broken Access Control to XSS vulnerabilitycodename065 Sliding Widgets
- CVE-2024-33922WordPress WP Media Cleaner plugin <= 6.7.2 - Sensitive Data Exposure via Log File vulnerabilityJordy Meow WP Media Cleaner
- CVE-2024-3005LA-Studio Element Kit for Elementor <= 1.3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widgetchoijun LA-Studio Element Kit for Elementor
- CVE-2024-33930WordPress Share This Image plugin <= 1.97 - Open Redirection vulnerabilityILLID Share This Image
- CVE-2024-32638Apache APISIX: Forward-Auth Request SmugglingApache Software Foundation Apache APISIX
- CVE-2024-38833D FlipBook <= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URLiberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer…
- CVE-2024-3280Follow Us Badges <= 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcodedraftpress Follow Us Badges
- CVE-2024-32882Permission check bypass when editing a model with per-field restrictions in wagtailwagtail
- CVE-2024-3490WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcodebrechtvds WP Recipe Maker
- CVE-2024-3481Counter Box < 1.2.4 - Counter Deletion via CSRFCounter Box
- CVE-2024-3478Herd Effects < 5.2.7 - Effect Deletion via CSRFHerd Effects
- CVE-2024-3477Popup Box < 2.2.7 - Popup Deletion via CSRFPopup Box
- CVE-2024-3472Modal Window < 5.3.10 - Modal Deletion via CSRFModal Window
- CVE-2024-3471Button Generator < 3.0 - Button Deletion via CSRFButton Generator
- CVE-2024-2405Float menu < 6.0.1 - Menu Deletion via CSRFFloat menu
- CVE-2024-31963A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen
- CVE-2024-31965A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen
- CVE-2024-31966A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen
- CVE-2024-32359An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtaigithub.com/carina-io/carina
- CVE-2024-33302SourceCodester Product Show Room 1.0 and before is vulnerable to Cross Site Scripting (XSS) via "Middle Name" under Add Users.
- CVE-2024-33305SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Middle Name" parameter in Create User.
- CVE-2024-33394An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token comkubevirt.io/kubevirt