Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

CVE-2024-44011

WordPress WP Ticket Ultra plugin <= 1.0.5 - Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ExpressTech Systems WP Ticket Ultra Help Desk & Support Plugin wp-ticket-ultra allows PHP Local File Inclusion.This issue affects WP Ticket Ultra Help Desk & Support Plugin: from n/a through <= 1.0.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-44010

WordPress Full frame theme <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Full frame full-frame allows Stored XSS.This issue affects Full frame: from n/a through <= 2.7.2.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Catchthemes Wordpress
Products
Full Frame Wordpress
CVE-2024-43989

WordPress Justified Image Grid plugin <= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Firsh Justified Image Grid justified-image-grid.This issue affects Justified Image Grid: from n/a through <= 4.6.1.

CVSS 3.1 · 7.5 High EPSS 12.4% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-43959

WordPress Super Testimonials plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Testimonials super-testimonial allows Reflected XSS.This issue affects Testimonials: from n/a through <= 4.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themepoints Wordpress
Products
Testimonials Wordpress
CVE-2024-43944

WordPress Maintenance & Coming Soon Redirect Animation plugin <= 2.3.3 - Bypass Vulnerability vulnerability

Authentication Bypass by Spoofing vulnerability in ilyasine Maintenance & Coming Soon Redirect Animation maintenance-coming-soon-redirect-animation allows Identity Spoofing.This issue affects Maintenance & Coming Soon Redirect Animation: from n/a through <= 2.3.3.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-43353

WordPress myCred plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred.This issue affects myCred: from n/a through <= 2.7.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress
Products
Mycred Wordpress
CVE-2024-43349

WordPress All Bootstrap Blocks plugin <= 1.3.19 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks.This issue affects All Bootstrap Blocks: from n/a through <= 1.3.19.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Areoi Wordpress
Products
All Bootstrap Blocks Wordpress
CVE-2024-43334

WordPress Zilom theme < 1.4.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavias Zilom zilom allows Reflected XSS.This issue affects Zilom: from n/a through < 1.4.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-43243

WordPress JobBoard Job listing plugin <= 1.2.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in themeglow JobBoard Job listing job-board-light allows Upload a Web Shell to a Web Server.This issue affects JobBoard Job listing: from n/a through <= 1.2.6.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-43241

WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in azzaroco Ultimate Membership Pro indeed-membership-pro.This issue affects Ultimate Membership Pro: from n/a through <= 12.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Azzaroco Wordpress
Products
Ultimate Membership Pro Wordpress
CVE-2024-43218

WordPress Mediavine Control Panel plugin <= 2.10.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mediavine Mediavine Control Panel mediavine-control-panel.This issue affects Mediavine Control Panel: from n/a through <= 2.10.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mediavine Wordpress
Products
Mediavine Control Panel Wordpress
CVE-2024-43216

WordPress Filr plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Filr filr-protection.This issue affects Filr: from n/a through <= 1.2.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-43208

WordPress Send Emails with Mandrill plugin <= 1.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Matt Miller Send Emails with Mandrill send-emails-with-mandrill allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Send Emails with Mandrill: from n/a through <= 1.4.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-39663

WordPress WP Fast Total Search plugin <= 1.68.232 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.68.232.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-39637

WordPress Edubin theme <= 9.2.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in pixelcurve Edubin edubin.This issue affects Edubin: from n/a through <= 9.2.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-38790

WordPress Smartsupp plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Smartsupp Smartsupp – live chat, chatbots, AI and lead generation smartsupp-live-chat allows Cross Site Request Forgery.This issue affects Smartsupp – live chat, chatbots, AI and lead generation: from n/a through <= 3.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-38778

WordPress WP Fast Total Search <= 1.69.234 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.69.234.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-38765

WordPress Oceanic theme <= 1.0.48 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in outtheboxthemes Oceanic oceanic allows Cross Site Request Forgery.This issue affects Oceanic: from n/a through <= 1.0.48.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-38753

WordPress Animated Rotating Words Plugin <= 5.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Animated Rotating Words css3-rotating-words allows Cross Site Request Forgery.This issue affects Animated Rotating Words: from n/a through <= 5.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2024-38735

WordPress Event post plugin <= 5.9.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Bastien Ho Event post event-post.This issue affects Event post: from n/a through <= 5.9.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Nousopenusefulandsimple Wordpress
Products
Event Post Wordpress