2024 CVEs (page 295)
Page 295 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4083 | Medium | 4.3 | 2024-05-02 | The Easy Restaurant Table Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to… |
CVE-2024-4036 | Medium | 6.4 | 2024-05-02 | The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the style parameter in all versions up to, and including, 1.30 due to… |
CVE-2024-4034 | Medium | 6.4 | 2024-05-02 | The Virtue theme for WordPress is vulnerable to Stored Cross-Site Scripting via a Post Author's name in all versions up to, and including, 3.4.8 due to insuffi… |
CVE-2024-4033 | High | 8.8 | 2024-05-02 | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the aiovg_create_attachment_fr… |
CVE-2024-4003 | Medium | 6.4 | 2024-05-02 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-4000 | Medium | 6.4 | 2024-05-02 | The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_hb' shortcode in all versio… |
CVE-2024-3991 | Medium | 6.4 | 2024-05-02 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Sto… |
CVE-2024-3985 | Medium | 6.4 | 2024-05-02 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Call to Action widget in all versions up… |
CVE-2024-3957 | Medium | 6.5 | 2024-05-02 | The Booster for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including, 7.1.8. This allows unauthen… |
CVE-2024-3942 | Medium | 6.3 | 2024-05-02 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of da… |
CVE-2024-3936 | Medium | 4.3 | 2024-05-02 | The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to unauthorized modification of data due t… |
CVE-2024-3897 | Medium | 5.3 | 2024-05-02 | The Popup Box – Best WordPress Popup Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_pb_c… |
CVE-2024-3895 | High | 8.8 | 2024-05-02 | The WP Datepicker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpdp_add_new_datepicker_ajax… |
CVE-2024-3891 | Medium | 6.4 | 2024-05-02 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML tags in widgets in all versions up to, and including… |
CVE-2024-3885 | Medium | 6.4 | 2024-05-02 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the subcontainer value parameter in all versions up to… |
CVE-2024-3870 | Medium | 5.3 | 2024-05-02 | The Contact Form 7 Database Addon – CFDB7 plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6.8 via th… |
CVE-2024-3849 | High | 8.8 | 2024-05-02 | The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This makes it possible fo… |
CVE-2024-3819 | Medium | 6.4 | 2024-05-02 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Banner widget in all versions up to, and includ… |
CVE-2024-3747 | Medium | 6.4 | 2024-05-02 | The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and inclu… |
CVE-2024-3743 | Medium | 6.4 | 2024-05-02 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Stack Group, Shape Separator, Content Switcher, In… |
CVE-2024-3734 | Medium | 6.5 | 2024-05-02 | The FOX – Currency Switcher Professional for WooCommerce plugin is vulnerable to Unauthenticated Arbitrary Shortcode Execution in versions up to, and including… |
CVE-2024-3729 | Critical | 9.8 | 2024-05-02 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all ver… |
CVE-2024-3728 | Medium | 6.4 | 2024-05-02 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-3725 | Medium | 6.4 | 2024-05-02 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2024-3724 | Medium | 6.4 | 2024-05-02 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Stack Group, Photo Stack, & Horizontal… |
CVE-2024-3717 | Medium | 5.3 | 2024-05-02 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi… |
CVE-2024-3715 | High | 7.2 | 2024-05-02 | The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includin… |
CVE-2024-3681 | Medium | 6.1 | 2024-05-02 | The Interactive World Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search (s) parameter in all versions up to, and includi… |
CVE-2024-3677 | Medium | 6.4 | 2024-05-02 | The Ultimate 410 Gone Status Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 410 entries in all versions up to, and including, 1… |
CVE-2024-3675 | Medium | 6.4 | 2024-05-02 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Flip Carousel, Flip Box, Post Grid… |
CVE-2024-3674 | Medium | 6.4 | 2024-05-02 | The Inline Google Spreadsheet Viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gdoc' shortcode in all versions up to… |
CVE-2024-3670 | Medium | 6.4 | 2024-05-02 | The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mapsmarker'… |
CVE-2024-3650 | Medium | 6.4 | 2024-05-02 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions 3.0.7 through… |
CVE-2024-3649 | Medium | 5.3 | 2024-05-02 | The Contact Form by WPForms – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to price manipulation in versions up to, and including… |
CVE-2024-3647 | Medium | 6.4 | 2024-05-02 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's post ticker widget in all versions up to, a… |
CVE-2024-3607 | Medium | 4.3 | 2024-05-02 | The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() function in all ver… |
CVE-2024-3606 | Medium | 4.3 | 2024-05-02 | The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capab… |
CVE-2024-3601 | Medium | 5.3 | 2024-05-02 | The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_poll… |
CVE-2024-3599 | Medium | 5.3 | 2024-05-02 | The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the gd… |
CVE-2024-3588 | Medium | 6.4 | 2024-05-02 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown block in all versions up to, and inc… |
CVE-2024-3585 | Medium | 5.3 | 2024-05-02 | The Send PDF for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of form submissions due to a missing capability check on the hooks fu… |
CVE-2024-3581 | Medium | 4.3 | 2024-05-02 | The MaxGalleria plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the add_media_library_images_to_gallery fu… |
CVE-2024-3554 | Medium | 6.4 | 2024-05-02 | The All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripti… |
CVE-2024-3553 | Medium | 6.5 | 2024-05-02 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-3550 | Medium | 6.4 | 2024-05-02 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions… |
CVE-2024-3546 | Medium | 4.3 | 2024-05-02 | The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_po… |
CVE-2024-3520 | Medium | 4.3 | 2024-05-02 | The Country State City Dropdown CF7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tc_csca_pa… |
CVE-2024-3517 | Medium | 6.4 | 2024-05-02 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion Widget in all versions up… |
CVE-2024-3500 | High | 8.8 | 2024-05-02 | The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Menu, Hotspot, and Adv… |
CVE-2024-3499 | High | 8.8 | 2024-05-02 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via the generate_naviga… |
CVE-2024-3489 | Medium | 6.4 | 2024-05-02 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Countdown Expired Title in all versions up to… |
CVE-2024-3473 | Medium | 6.1 | 2024-05-02 | The Header Footer Code Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and in… |
CVE-2024-3341 | Medium | 6.4 | 2024-05-02 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aux_gmaps' shortcode in a… |
CVE-2024-3340 | Medium | 5.4 | 2024-05-02 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri-gallery-slideshow' shortcode in all versio… |
CVE-2024-3338 | Medium | 4.4 | 2024-05-02 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt data parameter in all versions up to, and including, 1… |
CVE-2024-3337 | Medium | 6.4 | 2024-05-02 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibri_breadcrumb_element' shortcode in all versi… |
CVE-2024-3312 | Medium | 5.3 | 2024-05-02 | The Easy Custom Auto Excerpt plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12. This makes it p… |
CVE-2024-3308 | Medium | 6.4 | 2024-05-02 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget's attributes in all ver… |
CVE-2024-3307 | Medium | 6.4 | 2024-05-02 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown widget's attributes in all vers… |
CVE-2024-3295 | Medium | 6.5 | 2024-05-02 | The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data… |
CVE-2024-3287 | Medium | 5.3 | 2024-05-02 | The SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin for WordPress is vulnerable to unauthorized ld+json description injection due to a mis… |
CVE-2024-3275 | Medium | 4.3 | 2024-05-02 | The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.18 via the… |
CVE-2024-3233 | Medium | 4.3 | 2024-05-02 | The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aja… |
CVE-2024-3215 | Medium | 5.3 | 2024-05-02 | The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all… |
CVE-2024-3206 | Medium | 4.3 | 2024-05-02 | The Different Menu in Different Pages – Control Menu Visibility (All in One) plugin for WordPress is vulnerable to unauthorized access due to a missing capabil… |
CVE-2024-3199 | Medium | 6.4 | 2024-05-02 | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget in all versions up to, and includi… |
CVE-2024-3197 | Medium | 6.4 | 2024-05-02 | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom attributes in the plugin's widgets in all versio… |
CVE-2024-3161 | Medium | 6.4 | 2024-05-02 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's attributes in all versions up to, and includ… |
CVE-2024-3107 | Medium | 4.3 | 2024-05-02 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_defaul… |
CVE-2024-3074 | Medium | 6.4 | 2024-05-02 | The Elementor ImageBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image box widget in all versions up to, and including, 1.2.8 d… |
CVE-2024-3071 | Medium | 4.3 | 2024-05-02 | The ACF On-The-Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the acfg_update_fields() functio… |
CVE-2024-3047 | High | 7.2 | 2024-05-02 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.8.0 via… |
CVE-2024-3045 | High | 7.2 | 2024-05-02 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, an… |
CVE-2024-3023 | Medium | 4.4 | 2024-05-02 | The AnnounceKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.0.9 due to insuffi… |
CVE-2024-3021 | Medium | 4.4 | 2024-05-02 | The Mhr Post Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Header Title value in all versions up to, and including, 1.1 due… |
CVE-2024-33949 | Medium | 6.5 | 2024-05-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vark Min and Max Purchase for WooCommerce allows Stored X… |
CVE-2024-33948 | Medium | 5.5 | 2024-05-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixel Industry TweetScroll Widget allows Stored XSS.This… |
CVE-2024-2967 | Medium | 4.4 | 2024-05-02 | The Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… |
CVE-2024-2960 | Medium | 4.3 | 2024-05-02 | The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or… |
CVE-2024-2959 | Medium | 4.3 | 2024-05-02 | The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or… |
CVE-2024-2958 | Medium | 4.4 | 2024-05-02 | The SVS Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via pricing table settings in all versions up to, and including, 1.0.4… |
CVE-2024-2876 | Critical | 9.8 | 2024-05-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injec… |
CVE-2024-2867 | Medium | 6.4 | 2024-05-02 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-2840 | Medium | 5.4 | 2024-05-02 | The Enhanced Media Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via media upload functionality in all versions up to, and includin… |
CVE-2024-2831 | High | 8.8 | 2024-05-02 | The Calendar plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcodes in all versions up to, and including, 1.3.14 due to insufficient e… |
CVE-2024-2797 | Medium | 5.3 | 2024-05-02 | The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized plugin setting changes due to a missing capability check on the tog… |
CVE-2024-2790 | Medium | 6.4 | 2024-05-02 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Accordion widget in all versions up to, and i… |
CVE-2024-2765 | Medium | 5.4 | 2024-05-02 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2024-2752 | Medium | 5.5 | 2024-05-02 | The Where Did You Hear About Us Checkout Field for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via order meta in all versions… |
CVE-2024-2751 | Medium | 6.4 | 2024-05-02 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘exad_infobox_animating_mask_style’ parameter in a… |
CVE-2024-2750 | Medium | 6.4 | 2024-05-02 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of the Button widget in all versions… |
CVE-2024-2667 | Critical | 9.8 | 2024-05-02 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /… |
CVE-2024-2661 | High | 8.8 | 2024-05-02 | The Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader. plugin for WordPress is vulnerable to blind… |
CVE-2024-2542 | Medium | 6.4 | 2024-05-02 | The Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu… |
CVE-2024-2503 | Medium | 6.4 | 2024-05-02 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid Widget in all versions up to, and includ… |
CVE-2024-2417 | High | 8.8 | 2024-05-02 | The User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to privilege escalation due… |
CVE-2024-2401 | Medium | 4.4 | 2024-05-02 | The Admin Page Spider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.31 due to in… |
CVE-2024-2349 | Medium | 6.4 | 2024-05-02 | The Fancy Elementor Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Fancy Elementor Flipbox widget in all versions up to, and… |
CVE-2024-2346 | Medium | 5.4 | 2024-05-02 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… |
CVE-2024-2345 | Medium | 6.4 | 2024-05-02 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the folder name parameter i… |