CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- reputeinfosystems arforms form builder, contact form, survey, quiz & popup form builder – arforms +1 moreARForms <= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_url7.2 High
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by9.8 Critical
- fernandobriano list category postsList category posts <= 0.89.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- alobaidi video popupVideo PopUp <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- daanvandenbergh caos | host google analytics locally, daan complete analytics optimization suite +1 moreCAOS | Host Google Analytics Locally <= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Update6.5 Medium
- webtoffee export and import users and customers, import export wordpress users +1 moreExport and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload7.2 High
- cusrev customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Upload8.8 High
- 3dflipbook 3d flipbook, iberezansky 3d flipbook – pdf embedder, pdf flipbook viewer, flipbook image gallery +1 more3D Flipbook <= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready Function6.4 Medium
- carazo import and export users and customersImport and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode4.9 Medium
- myrecorp export wp page to static html\/css, recorp export wordpress pages to static html & pdf — static site export +1 moreExport WP Page to Static HTML/CSS <= 2.1.9 - Missing Authorization via Multiple AJAX Actions5.4 Medium
- enviragallery envira gallery, smub envira gallery – image photo gallery, albums, video gallery, slideshows & more +1 moreEnvira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_images4.3 Medium
- simple-membership-plugin simple membershipSimple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_mode6.1 Medium
- strangerstudios paid memberships pro – content restriction, user registration, & paid subscriptions, paid memberships pro +1 morePaid Memberships Pro <= 2.12.5 - Missing Authorization via API5.3 Medium
- extend themes colibri page builderColibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion5.4 Medium
- 10web photo gallery, photo gallery by 10web – mobile-friendly image gallery +1 morePhoto Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget4.4 Medium
- themeisle orbit fox, orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more +1 moreOrbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields6.4 Medium
- litespeedtech litespeed cacheLiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- vowelweb ibtana, ibtana – wordpress website builder +1 moreIbtana – WordPress Website Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.5.7 - Command Injection8.1 High
- thehappymonster happy addons for elementor, wedevs happy addons for elementor pro +1 moreHappy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site Scripting6.1 Medium
- backupbliss backup migration, inisev backupbliss – backup & migration with free cloud storage +1 moreBackup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure7.5 High
- freeamigos manage notification e-mailsManage Notification E-mails <= 1.8.5 - Missing Authorization5.3 Medium
- manageengine adselfservice plus, zohocorp manageengine adselfservice plus +1 moreRemote code execution8.8 High
- wpcompress wp compress, aresit wp compress – instant performance & speed optimization +1 moreWP Compress – Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via css9.1 Critical
- melapress wp 2fa – two-factor authentication for wordpress, wpwhitesecurity wp 2fa +1 moreWP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending4.3 Medium
- codepeople calculated fields formCalculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- easysocialfeed easy social feed, sjaved easy social feed – social photos gallery and post feed for wordpress +1 moreEasy Social Feed <= 6.5.2 - Missing Authorization to Settings Modification4.3 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure4.3 Medium
- melapress wp 2fa – two-factor authentication for wordpress, wp 2fa +1 moreWP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgery4.3 Medium
- gnu grub2, fedoraproject fedora, red hat enterprise linux 8 +4 more +6 moreGrub2: bypass the grub password protection feature6.8 Medium
- goauthentik authentikXSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode7.7 High
- rocklobster contact form 7, sevenspark contact form 7 – dynamic text extension +1 moreContact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference4.3 Medium
- avimegladon wp register profile with shortcodeWP Register Profile With Shortcode <= 3.5.9 - Cross-Site Request Forgery to User Password Reset8.8 High
firefoxUbuntufirefox regressionsNo score- ibm security verify access appliance, security verify access docker, security verify access +2 moreIBM Security Access Manager Appliance information disclosure6.2 Medium
- ibm security verify access appliance, security verify access docker, security verify access +2 moreIBM Security Access Manager Container information disclosure5.1 Medium
- pallets jinjaJinja vulnerable to Cross-Site Scripting (XSS)5.4 Medium
- ibm security verify access appliance, security verify access docker, security verify access +2 moreIBM Security Access Manager Container privilege escalation8.4 High
- cyber-domain-ontology cdo-utility-local-uuid, lfprojects case python utilities, cdo local uuid utility +2 morecdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code2.2 Low
- ibm aix, vios +1 moreIBM AIX denial of service6.2 Medium
- ibm aix, vios +1 moreIBM AIX denial of service6.2 Medium
- ibm aix, vios +1 moreIBM AIX denial of service6.2 Medium
- ibm aix, vios +1 moreIBM AIX denial of service6.2 Medium
icuOSS-FuzzStack-buffer-overflow in _canonicalizeNo score- totolink a3300r firmwareTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection...9.8 Critical
- totolink a3300r firmwareTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection...9.8 Critical
- totolink a3300r firmwareTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection...9.8 Critical
- totolink a3300r firmwareTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection...9.8 Critical
- totolink a3300r firmwareTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection...9.8 Critical
- Show moreLoading…