Medium
CVE-2024-6559
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2024-2691
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode
Medium
CVE-2024-6390
Quiz and Survey Master <= 9.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6477
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.11 - Unauthenticated Information Disclosure via Unprotected Directories
Critical
CVE-2024-38770
Backup and Staging by WP Time Capsule <= 1.22.20 - Authentication Bypass to Account Takeover
High
ghsa-5grr-72f9-678v
Malware package cipherbcrypt
High
CVE-2024-36522
Apache Wicket: Remote code execution via XSLT injection
High
CVE-2024-5902
UserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter
Medium
CVE-2024-38762
Event Tickets <= 5.11.0.4 - Cross-Site Request Forgery
Medium
CVE-2024-5595
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-6574
Laposta <= 1.12 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-38765
Oceanic <= 1.0.53 - Cross-Site Request Forgery
Medium
CVE-2024-38760
Send Users Email <= 1.5.1 - Unauthenticated Information Exposure
Medium
CVE-2024-6465
WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update
Medium
CVE-2024-38763
Popularis Verse <= 1.0.1 - Cross-Site Request Forgery
Medium
CVE-2024-38761
Zephyr Project Manager <= 3.3.99 - Unauthenticated Information Exposure
Medium
CVE-2024-38764
i-transform <= 3.0.9 - Cross-Site Request Forgery
High
CVE-2024-6353
Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]'
Medium
CVE-2024-6625
WP Total Branding <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter
Medium
CVE-2024-6485
Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes
Medium
CVE-2024-6588
PowerPress Podcasting plugin by Blubrry <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter
High
ghsa-gmc6-fwg3-75m5
Mimekit has vulnerable dependency that can lead to denial of service
Medium
CVE-2024-6555
WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure
High
CVE-2024-39317
Wagtail regular expression denial-of-service via search query parsing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.