Medium
CVE-2024-1854
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2024-0856
Appointment Booking Calendar <= 1.3.82 - Cross-Site Request Forgery
Medium
CVE-2023-6785
Download Manager <= 3.2.84 - Missing Authorization
Medium
CVE-2024-1978
Friends <= 2.8.5 - Authenticated (Admin+) Blind Server-Side Request Forgery
Medium
CVE-2024-1680
Premium Addons for Elementor <= 4.10.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets
Medium
CVE-2024-1341
Advanced iFrame <= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-0614
Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings
Medium
CVE-2023-6954
Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-1982
WPvivid Backup and Migration <= 0.9.68 - Missing Authorization
Medium
CVE-2024-1383
WPvivid Backup for MainWP <= 0.9.32 - Reflected Cross-Site Scripting
Medium
CVE-2024-27189
WP Social Widget <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Medium
CVE-2024-1476
Under Construction / Maintenance Mode from Acurax <= 2.6 - Information Exposure
Medium
CVE-2024-1136
Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypass
Medium
CVE-2024-1943
Yuki <= 1.3.14 - Cross-Site Request Forgery to Theme Setting Reset
Medium
CVE-2024-1388
Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset
High
CVE-2023-40000
LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'
Medium
CVE-2024-0377
LifterLMS – WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_review
Medium
CVE-2024-1326
Jeg Elementor Kit <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
Medium
CVE-2024-0767
Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activation
Medium
CVE-2023-6786
Payment Gateway for Telcell <= 2.0.3 - Open Redirect
High
CVE-2024-0786
Conversios <= 7.0.7 - Authenticated (Subscriber+) SQL Injection via ee_syncProductCategory
Medium
CVE-2024-1368
Page Duplicator <= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplication
Medium
CVE-2024-1861
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncation
Medium
CVE-2024-1516
WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.