2024 CVEs (page 348)
Page 348 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1950 | High | 7.5 | 2024-03-13 | The Product Carousel Slider & Grid Ultimate for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1… |
CVE-2024-1935 | High | 7.2 | 2024-03-13 | The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cros… |
CVE-2024-1894 | Medium | 6.4 | 2024-03-13 | The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'burst_total_pageview… |
CVE-2024-1862 | High | 8.1 | 2024-03-13 | The WooCommerce Add to Cart Custom Redirect plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capabilit… |
CVE-2024-1854 | Medium | 6.4 | 2024-03-13 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId pa… |
CVE-2024-1843 | Medium | 4.3 | 2024-03-13 | The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aalAddLink function i… |
CVE-2024-1806 | Medium | 6.4 | 2024-03-13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-1793 | High | 7.2 | 2024-03-13 | The AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth plugin for WordPress is vulnerable to SQL Inject… |
CVE-2024-1772 | High | 8.8 | 2024-03-13 | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and i… |
CVE-2024-1763 | Medium | 6.5 | 2024-03-13 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th… |
CVE-2024-1751 | High | 8.8 | 2024-03-13 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versio… |
CVE-2024-1723 | Medium | 6.4 | 2024-03-13 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1… |
CVE-2024-1691 | Medium | 6.1 | 2024-03-13 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file upl… |
CVE-2024-1690 | Medium | 4.3 | 2024-03-13 | The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized acces… |
CVE-2024-1684 | Medium | 6.4 | 2024-03-13 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contact… |
CVE-2024-1680 | Medium | 6.4 | 2024-03-13 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Settings URL of the Banner, Team Members, and… |
CVE-2024-1668 | Medium | 6.5 | 2024-03-13 | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 7.1… |
CVE-2024-1642 | Medium | 4.3 | 2024-03-13 | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2024-1640 | Medium | 5.3 | 2024-03-13 | The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulnerable to unauthoriz… |
CVE-2024-1585 | Medium | 6.4 | 2024-03-13 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up t… |
CVE-2024-1541 | Medium | 6.4 | 2024-03-13 | The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmlTag attribute in a… |
CVE-2024-1537 | Medium | 6.4 | 2024-03-13 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-1536 | High | 7.4 | 2024-03-13 | The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2024-1535 | Medium | 6.4 | 2024-03-13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-1505 | High | 8.8 | 2024-03-13 | The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and incl… |
CVE-2024-1499 | Medium | 6.4 | 2024-03-13 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in the $settings['title_tags'] param… |
CVE-2024-1497 | Medium | 6.4 | 2024-03-13 | The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form widget addr2_width attribute in all versions up to, a… |
CVE-2024-1489 | Medium | 4.3 | 2024-03-13 | The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. T… |
CVE-2024-1484 | Medium | 6.1 | 2024-03-13 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date parameters in all v… |
CVE-2024-1479 | Medium | 5.3 | 2024-03-13 | The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the wpsp_display functio… |
CVE-2024-1462 | Medium | 5.3 | 2024-03-13 | The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes… |
CVE-2024-1452 | Medium | 4.3 | 2024-03-13 | The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.2 via Query Loop. This makes… |
CVE-2024-1422 | Medium | 6.4 | 2024-03-13 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the modal popup widget's effect setting in all versions up t… |
CVE-2024-1414 | Medium | 6.4 | 2024-03-13 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in all versions up to, and i… |
CVE-2024-1413 | Medium | 6.4 | 2024-03-13 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer widget in all versions up to, and… |
CVE-2024-1409 | Medium | 6.4 | 2024-03-13 | The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to… |
CVE-2024-1393 | Medium | 6.4 | 2024-03-13 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content Switcher widget in… |
CVE-2024-1392 | Medium | 6.4 | 2024-03-13 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button1_icon' attribute of the Dual Button widget in al… |
CVE-2024-1391 | Medium | 6.4 | 2024-03-13 | The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eae_custom_overlay_switcher’ attribute of the Thumbnail… |
CVE-2024-1383 | Medium | 6.1 | 2024-03-13 | The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including… |
CVE-2024-1380 | Medium | 5.3 | 2024-03-13 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssi_export_l… |
CVE-2024-1370 | Medium | 5.3 | 2024-03-13 | The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_download function hoo… |
CVE-2024-1365 | Medium | 6.1 | 2024-03-13 | The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the feed_id parameter in all versions up to, and including… |
CVE-2024-1363 | Medium | 6.4 | 2024-03-13 | The Easy Accordion – Best Accordion FAQ Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordion_content_sourc… |
CVE-2024-1358 | High | 8.8 | 2024-03-13 | The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. T… |
CVE-2024-1321 | Medium | 5.3 | 2024-03-13 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This i… |
CVE-2024-1311 | High | 8.8 | 2024-03-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all ve… |
CVE-2024-1296 | Medium | 6.4 | 2024-03-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block upload in all versions up to, and including… |
CVE-2024-1293 | Medium | 6.4 | 2024-03-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the embedded media custom block in all versions up to, and inclu… |
CVE-2024-1291 | Medium | 6.4 | 2024-03-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown URL parameter in all versions up to, and including… |
CVE-2024-1237 | Medium | 6.4 | 2024-03-13 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the flyout_layout attribute in all versions up to… |
CVE-2024-1234 | Medium | 6.4 | 2024-03-13 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute in all versions up to, and including, 2… |
CVE-2024-1203 | High | 8.8 | 2024-03-13 | The Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the… |
CVE-2024-1176 | Medium | 5.3 | 2024-03-13 | The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2024-1158 | Medium | 4.3 | 2024-03-13 | The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to un… |
CVE-2024-1127 | Medium | 4.3 | 2024-03-13 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-1126 | Medium | 4.3 | 2024-03-13 | The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t… |
CVE-2024-1083 | Medium | 5.3 | 2024-03-13 | The Simple Restrict plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.6 via the REST API. This mak… |
CVE-2024-1080 | Medium | 6.4 | 2024-03-13 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via the heading tag in all versions up to… |
CVE-2024-1074 | Medium | 6.4 | 2024-03-13 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the audio widget 'link_url' parameter in all… |
CVE-2024-1071 | Critical | 9.8 | 2024-03-13 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL In… |
CVE-2024-1038 | Medium | 5.4 | 2024-03-13 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via a 'playground.wordpress.net' par… |
CVE-2024-0976 | Medium | 6.1 | 2024-03-13 | The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via t… |
CVE-2024-0898 | Medium | 4.4 | 2024-03-13 | The Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2024-0897 | Medium | 6.4 | 2024-03-13 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL parameter in all versions up to… |
CVE-2024-0896 | Medium | 6.4 | 2024-03-13 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button link parameter in all versions up… |
CVE-2024-0871 | Medium | 5.4 | 2024-03-13 | The Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Widget 'fl_builder_data[node_preview][link]' and 'fl_builder_… |
CVE-2024-0839 | Medium | 5.3 | 2024-03-13 | The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validat… |
CVE-2024-0830 | Medium | 4.3 | 2024-03-13 | The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0. Th… |
CVE-2024-0829 | Medium | 4.3 | 2024-03-13 | The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0. This is… |
CVE-2024-0828 | Medium | 5.4 | 2024-03-13 | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to unauthorized access of functionality due to a mis… |
CVE-2024-0827 | Medium | 4.3 | 2024-03-13 | The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to… |
CVE-2024-0700 | Medium | 6.4 | 2024-03-13 | The Simple Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tweet this text value in all versions up to, and including, 1.4.0.2… |
CVE-2024-0687 | Medium | 5.3 | 2024-03-13 | The Restrict User Access – Ultimate Membership & Content Protection plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inclu… |
CVE-2024-0683 | High | 7.3 | 2024-03-13 | The Bulgarisation for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in all versio… |
CVE-2024-0681 | Medium | 5.3 | 2024-03-13 | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to information disclosure in all versions up to, and including… |
CVE-2024-0631 | Medium | 5.3 | 2024-03-13 | The Duitku Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_duitku_respon… |
CVE-2024-0614 | Medium | 4.4 | 2024-03-13 | The Events Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.4.6.4 due to in… |
CVE-2024-0592 | Medium | 5.4 | 2024-03-13 | The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to mi… |
CVE-2024-0591 | Medium | 6.1 | 2024-03-13 | The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'A'… |
CVE-2024-0449 | Medium | 4.4 | 2024-03-13 | The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, an… |
CVE-2024-0447 | Medium | 5.0 | 2024-03-13 | The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2024-0385 | Medium | 4.3 | 2024-03-13 | The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxAddCategory funct… |
CVE-2024-0377 | Medium | 5.3 | 2024-03-13 | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2024-0369 | Medium | 4.3 | 2024-03-13 | The Bulk Edit Post Titles plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulkUpdatePostTitles… |
CVE-2024-0368 | High | 8.6 | 2024-03-13 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i… |
CVE-2024-0326 | Medium | 6.4 | 2024-03-13 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Link Wrapper functionality in all versions… |
CVE-2024-0161 | High | 7.2 | 2024-03-13 | Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacke… |
CVE-2024-25155 | High | 7.2 | 2024-03-13 | In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subs… |
CVE-2024-25154 | Medium | 5.3 | 2024-03-13 | Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files lo… |
CVE-2024-25153 | Critical | 9.8 | 2024-03-13 | A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ director… |
CVE-2024-2247 | High | 8.8 | 2024-03-13 | JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. |
CVE-2024-28684 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.php |
CVE-2024-28675 | High | 8.8 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php |
CVE-2024-26629 | Medium | 5.5 | 2024-03-13 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix RELEASE_LOCKOWNER The test on so_count in nfsd4_release_lockowner() is nonsense… |
CVE-2024-1508 | Medium | 6.4 | 2024-03-13 | The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'settings['title_tags']' attribute of the Mer… |
CVE-2024-1507 | Medium | 6.4 | 2024-03-13 | The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tags' attribute of the Rubix widget in… |
CVE-2024-28668 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/mychannel_add.php |
CVE-2024-28667 | Medium | 6.1 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/templets_one_edit.php |
CVE-2024-28666 | Medium | 5.5 | 2024-03-13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/media_add.php |