Search vulnerabilities

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2024-49224

WordPress Mitm Bug Tracker plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mahesh_9696 Mitm Bug Tracker mitm-bug-tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through <= 1.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Maheshpatel
Products
Mitm Bug Tracker
CVE-2024-49235

WordPress Contact Forms, Live Support, CRM, Video Messages plugin <= 1.10.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Retrieve Embedded Sensitive Data.This issue affects Contact Forms, Live Support, CRM, Video Messages: from n/a through <= 1.10.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Videowhisper
Products
Contact Forms Live Support Crm Video Messages Plugin
CVE-2024-49221

WordPress cSlider plugin <= 2.4.2 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in julian.weinert cSlider cslider allows Cross Site Request Forgery.This issue affects cSlider: from n/a through <= 2.4.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Julianweinert
Products
Cslider
CVE-2024-49218

WordPress Recently plugin <= 1.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through <= 1.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Recently Project
Products
Recently
CVE-2024-49216

WordPress Feed Comments Number plugin <= 0.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in jclay06 Feed Comments Number feed-comments-number allows Upload a Web Shell to a Web Server.This issue affects Feed Comments Number: from n/a through <= 0.2.1.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Joshua Clayton
Products
Feed Comments Number
CVE-2024-49223

WordPress CJ Change Howdy plugin <= 3.3.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Change Howdy cj-change-howdy allows Cross Site Request Forgery.This issue affects CJ Change Howdy: from n/a through <= 3.3.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Shibulijack
Products
Cj Change Howdy
CVE-2024-49220

WordPress Cookie Scanner plugin <= 1.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Nikel Cookie Scanner cookie-scanner allows Cross Site Request Forgery.This issue affects Cookie Scanner: from n/a through <= 1.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Cookie-scanner
Products
Cookie Scanner
CVE-2024-43354

WordPress myCred plugin <= 2.7.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mycred
Products
Mycred
CVE-2024-43242

WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Azzaroco Wpindeed
Products
Ultimate Membership Pro Ultimate Membership Pro
CVE-2024-37927

WordPress Jobmonster theme <= 4.7.5 - Unauthenticated Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in NooTheme Jobmonster noo-jobmonster allows Privilege Escalation.This issue affects Jobmonster: from n/a through <= 4.7.5.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Nootheme Wordpress
Products
Jobmonster Wordpress
CVE-2024-29135

WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Themefic
Products
Tourfic
CVE-2024-37469

WordPress Blocksy theme <= 1.9.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in creativethemeshq Blocksy blocksy allows Cross Site Request Forgery.This issue affects Blocksy: from n/a through <= 2.0.22.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Creativethemes
Products
Blocksy
CVE-2024-21746

WordPress Wp Ultimate Review plugin <= 2.3.6 - IP limit Bypass vulnerability

Authentication Bypass by Spoofing vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Identity Spoofing.This issue affects Wp Ultimate Review: from n/a through <= 2.3.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpmet
Products
Wp Ultimate Review
CVE-2023-49158

WordPress LadiApp plugin <= 4.4 - Broken Access Control lead to XSS vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Binh Nguyen LadiApp ladipage allows Stored XSS.This issue affects LadiApp: from n/a through <= 4.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2023-51360

WordPress Essential Blocks plugin <= 4.2.0 - Multiple Subscriber+ Broken Access Control vulnerability

Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wpdeveloper
Products
Essential Blocks
CVE-2023-49859

WordPress Login With Ajax plugin <= 4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marcus (aka @msykes) Login With Ajax login-with-ajax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login With Ajax: from n/a through <= 4.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2023-50373

WordPress Alt Manager plugin <= 1.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPSAAD Alt Manager alt-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alt Manager: from n/a through <= 1.6.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpsaad
Products
Alt Manager
CVE-2023-5823

WordPress TK Google Fonts GDPR Compliant Plugin <= 2.2.11 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themekraft
Products
Tk Google Fonts Gdpr Compliant
CVE-2023-51359

WordPress Essential Blocks plugin <= 4.2.0 - Multiple Contributor+ Broken Access Control vulnerability

Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpdeveloper
Products
Essential Blocks
CVE-2023-51362

WordPress myStickyElements plugin <= 2.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.1.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Premio
Products
All In One Floating Contact Form My Sticky Elements