2024 CVEs (page 319)
Page 319 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2804 | Critical | 9.8 | 2024-04-09 | The Network Summary plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter in all versions up to, and including, 2.0.11 due to insuff… |
CVE-2024-2792 | Medium | 6.4 | 2024-04-09 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in all versions up to, and including, 1.13.2 due to… |
CVE-2024-2789 | Medium | 6.4 | 2024-04-09 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Calendy widget in all versions up to, and inc… |
CVE-2024-2788 | Medium | 6.4 | 2024-04-09 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Title HTML Tag in all versions up to, and includi… |
CVE-2024-2787 | Medium | 6.4 | 2024-04-09 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title HTML Tag in all versions up to, and includi… |
CVE-2024-2786 | Medium | 5.4 | 2024-04-09 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 3.10… |
CVE-2024-2783 | Medium | 6.4 | 2024-04-09 | The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2024-2738 | Medium | 6.1 | 2024-04-09 | The Permalink Manager Lite and Pro plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the ‘s’ parameter in multiple instances in all ve… |
CVE-2024-2693 | High | 8.8 | 2024-04-09 | The Link Whisper Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.7.1 via deserialization of untrusted i… |
CVE-2024-2654 | Medium | 6.8 | 2024-04-09 | The File Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 7.2.5 via the fm_download_backup function. Thi… |
CVE-2024-2650 | Medium | 6.4 | 2024-04-09 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-2623 | Medium | 6.4 | 2024-04-09 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-2543 | Medium | 4.3 | 2024-04-09 | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_uri_editor' function… |
CVE-2024-2536 | Medium | 6.4 | 2024-04-09 | The Rank Math SEO with AI SEO Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HowTo block attributes in all versions up to, and… |
CVE-2024-2513 | Medium | 6.4 | 2024-04-09 | The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageAlt' block attribute in all versions up to, and including, 3.6… |
CVE-2024-2507 | Medium | 6.4 | 2024-04-09 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the widget button URL in all versions up to, and including… |
CVE-2024-2504 | Medium | 6.4 | 2024-04-09 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'attr' parameter in all v… |
CVE-2024-2501 | High | 7.5 | 2024-04-09 | The Hubbub Lite – Fast, Reliable Social Sharing Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.33.1… |
CVE-2024-2492 | Medium | 6.4 | 2024-04-09 | The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Twitter Tweet widget in all versions up to, and in… |
CVE-2024-2457 | Medium | 6.4 | 2024-04-09 | The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up… |
CVE-2024-2456 | Medium | 6.4 | 2024-04-09 | The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and in… |
CVE-2024-2436 | Medium | 6.4 | 2024-04-09 | The Lightweight Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including… |
CVE-2024-2423 | Medium | 6.4 | 2024-04-09 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Stored Cross… |
CVE-2024-2348 | Medium | 6.4 | 2024-04-09 | The Gum Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Meta widget in all versions up to, and including, 1.3.2… |
CVE-2024-2347 | Medium | 6.4 | 2024-04-09 | The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.8 due to insuffi… |
CVE-2024-2344 | High | 7.2 | 2024-04-09 | The Avada theme for WordPress is vulnerable to SQL Injection via the 'entry' parameter in all versions up to, and including, 7.11.6 due to insufficient escapin… |
CVE-2024-2343 | Medium | 6.4 | 2024-04-09 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2024-2342 | High | 8.8 | 2024-04-09 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id paramete… |
CVE-2024-2341 | High | 8.8 | 2024-04-09 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in al… |
CVE-2024-2340 | Medium | 5.3 | 2024-04-09 | The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-… |
CVE-2024-2336 | Medium | 6.4 | 2024-04-09 | The Popup Maker – Popup for opt-ins, lead gen, & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all ve… |
CVE-2024-2335 | Medium | 6.4 | 2024-04-09 | The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget link URLs in all versions up to, and including, 2.16.2… |
CVE-2024-2334 | Medium | 6.4 | 2024-04-09 | The Template Kit – Import plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the template upload functionality in all versions up to, and in… |
CVE-2024-2327 | Medium | 6.4 | 2024-04-09 | The Global Elementor Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link URL in all versions up to, and including, 1… |
CVE-2024-2325 | Medium | 6.1 | 2024-04-09 | The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchll parameter in all versions up to, and including, 7.6.6 du… |
CVE-2024-2311 | Medium | 6.4 | 2024-04-09 | The Avada theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.11.6 due to insu… |
CVE-2024-2306 | Medium | 6.4 | 2024-04-09 | The Revslider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg upload in all versions up to, and including, 6.6.20 due to insufficient… |
CVE-2024-2305 | Medium | 6.4 | 2024-04-09 | The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BootstrapCard link in all versions up to, and including… |
CVE-2024-2302 | Medium | 5.3 | 2024-04-09 | The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Informat… |
CVE-2024-2289 | Medium | 6.4 | 2024-04-09 | The PowerPack Lite for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link in multiple elements in all versions up to… |
CVE-2024-2287 | Medium | 6.4 | 2024-04-09 | The Knight Lab Timeline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3… |
CVE-2024-2261 | Medium | 4.3 | 2024-04-09 | The Event Tickets and Registration plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.2 via the RSV… |
CVE-2024-2226 | Medium | 6.4 | 2024-04-09 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id param… |
CVE-2024-2222 | Medium | 4.3 | 2024-04-09 | The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajax_callback… |
CVE-2024-2200 | Medium | 6.1 | 2024-04-09 | The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ parameter in all versio… |
CVE-2024-2198 | Medium | 6.1 | 2024-04-09 | The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_address’ parameter in all versio… |
CVE-2024-2187 | Medium | 6.4 | 2024-04-09 | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonials widget in all versions up to, and in… |
CVE-2024-2186 | Medium | 6.4 | 2024-04-09 | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Team Members widget in all versions up to, and in… |
CVE-2024-2185 | Medium | 6.4 | 2024-04-09 | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget in all versions up to, and inclu… |
CVE-2024-2183 | Medium | 6.4 | 2024-04-09 | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and includi… |
CVE-2024-2181 | Medium | 6.4 | 2024-04-09 | The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and includin… |
CVE-2024-2165 | Medium | 6.4 | 2024-04-09 | The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt parameter in all versions up to, and including… |
CVE-2024-2138 | Medium | 6.4 | 2024-04-09 | The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Animated Box widget in all versions up to, and including… |
CVE-2024-2125 | High | 8.8 | 2024-04-09 | The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. Th… |
CVE-2024-2117 | Medium | 6.4 | 2024-04-09 | The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Path Widget in… |
CVE-2024-2112 | Medium | 5.9 | 2024-04-09 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2024-2093 | Medium | 6.5 | 2024-04-09 | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.95.0.1 via social… |
CVE-2024-2081 | Medium | 6.4 | 2024-04-09 | The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the foogallery_attachment_modal_save actio… |
CVE-2024-2039 | Medium | 6.4 | 2024-04-09 | The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post(v2) block title tag in all version… |
CVE-2024-2033 | Medium | 4.3 | 2024-04-09 | The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the get_a… |
CVE-2024-2027 | Medium | 6.4 | 2024-04-09 | The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style attributes in all v… |
CVE-2024-2026 | Medium | 6.4 | 2024-04-09 | The Passster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_protector shortcode in all versions up to, and includin… |
CVE-2024-2018 | High | 8.8 | 2024-04-09 | The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due… |
CVE-2024-24245 | High | 7.8 | 2024-04-09 | An issue in Canimaan Software LTD ClamXAV v3.1.2 through v3.6.1 and fixed in v.3.6.2 allows a local attacker to escalate privileges via the ClamXAV helper tool… |
CVE-2024-1999 | Medium | 6.4 | 2024-04-09 | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget's a… |
CVE-2024-1991 | High | 8.8 | 2024-04-09 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to… |
CVE-2024-1990 | High | 8.8 | 2024-04-09 | The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the… |
CVE-2024-1984 | Medium | 5.3 | 2024-04-09 | The Graphene theme for WordPress is vulnerable to unauthorized access of data via meta tag in all versions up to, and including, 2.9.2. This makes it possible… |
CVE-2024-1974 | High | 8.8 | 2024-04-09 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.6 via the rende… |
CVE-2024-1960 | Medium | 6.4 | 2024-04-09 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Sto… |
CVE-2024-1948 | Medium | 6.4 | 2024-04-09 | The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block content in all versions up to, and including, 2.0… |
CVE-2024-1934 | High | 7.5 | 2024-04-09 | The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_c… |
CVE-2024-1904 | Medium | 4.3 | 2024-04-09 | The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all ver… |
CVE-2024-1893 | High | 8.8 | 2024-04-09 | The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to… |
CVE-2024-1852 | High | 7.2 | 2024-04-09 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the X-Forwarded-For header in all versions up to, and in… |
CVE-2024-1850 | Medium | 6.3 | 2024-04-09 | The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability che… |
CVE-2024-1813 | Critical | 9.8 | 2024-04-09 | The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted i… |
CVE-2024-1812 | High | 7.2 | 2024-04-09 | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.7 via the 'font_url' parameter. T… |
CVE-2024-1794 | High | 7.2 | 2024-04-09 | The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1… |
CVE-2024-1792 | High | 7.5 | 2024-04-09 | The CMB2 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.1 via deserialization of untrusted input from th… |
CVE-2024-1790 | Medium | 4.9 | 2024-04-09 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 7.0.1 via the 'type'… |
CVE-2024-1774 | High | 7.2 | 2024-04-09 | The Customily Product Personalizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via user cookies in all versions up to, and including, 1.2… |
CVE-2024-1641 | Medium | 5.4 | 2024-04-09 | The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'accordions_d… |
CVE-2024-1637 | Medium | 4.3 | 2024-04-09 | The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on sever… |
CVE-2024-1587 | Medium | 5.3 | 2024-04-09 | The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsmatic_filter_posts_l… |
CVE-2024-1571 | Medium | 4.4 | 2024-04-09 | The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, and including, 9.2.1… |
CVE-2024-1498 | Medium | 6.4 | 2024-04-09 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Photo Stack Widget in all versions up to, and… |
CVE-2024-1466 | Medium | 6.4 | 2024-04-09 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_style’ attribute of the Posts Multislider wi… |
CVE-2024-1465 | Medium | 6.4 | 2024-04-09 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘carousel_skin’ attribute of the Posts Carousel widg… |
CVE-2024-1464 | Medium | 6.4 | 2024-04-09 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Posts Slider widget in all… |
CVE-2024-1463 | Medium | 4.4 | 2024-04-09 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in a… |
CVE-2024-1461 | Medium | 6.4 | 2024-04-09 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ attribute of the Team Members widget in all… |
CVE-2024-1458 | Medium | 6.4 | 2024-04-09 | The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘text_alignment’ attribute of the Animated Text widg… |
CVE-2024-1424 | Medium | 6.4 | 2024-04-09 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all ve… |
CVE-2024-1412 | Medium | 6.1 | 2024-04-09 | The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘message’ and 'error' parameters in all versions up to, and includ… |
CVE-2024-1387 | Medium | 4.3 | 2024-04-09 | The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the duplicate_thing() fun… |
CVE-2024-1352 | Medium | 6.5 | 2024-04-09 | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a m… |
CVE-2024-1315 | High | 8.8 | 2024-04-09 | The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and… |
CVE-2024-1308 | High | 7.5 | 2024-04-09 | The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permali… |
CVE-2024-1289 | Medium | 6.5 | 2024-04-09 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due… |