CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- codeastro pos and inventory management systemCodeAstro POS and Inventory Management System New Item Creation Page new_item cross site scripting3.5 Low
- httpdx project httpdxJasper httpdx HTTP POST Request denial of service5.3 Medium
- isharer and upredsun file sharing wizardiSharer and upRedSun File Sharing Wizard GET Request denial of service5.3 Medium
- csdeshang dsshopDeShang DSShop MemberAuth.php path traversal5.4 Medium
- csdeshang dsmallDeShang DSMall MemberAuth.php path traversal5.4 Medium
- csdeshang dsmallDeShang DSMall Image URL TaobaoExport.php access control6.3 Medium
- csdeshang dscmsDeShang DSCMS install.php access control5.3 Medium
- csdeshang dskmsDeShang DSKMS install.php access control5.3 Medium
- gofiber django, template +1 moreDjango Template Engine Vulnerable to XSS9.3 Critical
- 0xjacky nginx-ui, nginxui nginx ui +1 moreAuthenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)7.1 High
- csdeshang dsshopDeShang DSShop HTTP GET Request install.php access control5.3 Medium
- csdeshang dsmallDeShang DSMall HTTP GET Request install.php access control5.3 Medium
- 0xjacky nginx-ui, nginxui nginx ui +1 moreAuthenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)7.7 High
- 0xjacky nginx-ui, nginxui nginx ui +1 moreAuthenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)7.0 High
- bpsoft hex workshop, hex workshop workshop +1 moreBuffer overflow vulnerability on Hex Workshop7.3 High
- kofax capture, tungstenautomation kofax capture +1 moreStored cross-site scripting vulnerability in Kofax Capture software5.4 Medium
- tecnick tcexamMissing authorisation in TCExam6.5 Medium
- oxygen builder builder, soflyy oxygen +1 moreOxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field6.4 Medium
- myeventon eventon, ashanjay eventon – events calendar, eventon (pro) - wordpress virtual event calendar plugin +1 more +3 moreEventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta6.5 Medium
- myeventon eventon, ashanjay eventon – events calendar, eventon (pro) - wordpress virtual event calendar plugin +1 more +3 moreEventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings6.5 Medium
- amd 3rd gen amd epyc™ processors, 4th gen amd epyc™ processors, epyc 7203 firmware +64 more +66 moreDebug Exception Delivery in Secure Nested Paging3.2 Low
- qkmc-rk redbbsqkmc-rk redbbs Post cross site scripting3.5 Low
gstreamer-plugins-badSUSESecurity update for gstreamer-plugins-badNo score- roxnor elementskit elementor addons – advanced widgets & templates addons for elementor, wpmet elements kit elementor addons +1 moreElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information Exposure5.3 Medium
- wpdeveloper essential blocks, wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patterns +1 moreEssential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- onlineoptimisation email encoder – protect email addresses and phone numbers, email encoder +1 moreEmail Encoder – Protect Email Addresses and Phone Numbers <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wclovers wcfm marketplace, wcfm marketplace – multivendor marketplace for woocommerce +1 moreWCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- cozmoslabs profile builder, user profile builder – beautiful user registration forms, user profiles & user role editor +1 moreProfile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode4.3 Medium
- wpexperts post smtp, saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app +1 morePOST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API9.8 Critical
- inpsyde backwpup, wp media backwpup – wordpress backup & restore plugin +1 moreBackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal8.7 High
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivation5.4 Medium
- collect.chat chatbot, collectchat collect.chat chatbot ⚡️ +1 moreThe Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via...4.4 Medium
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installation4.3 Medium
- hostinger, hostinger tools +1 moreHostinger <= 1.9.7 - Missing Authorization to Maintenance Mode Activation7.3 High
- softaculous speedycache, speedycache – cache, optimization, performance +1 moreSpeedyCache <= 1.1.3 - Missing Authorization to Plugin Options Update4.3 Medium
- fifu featured image from url, marceljm featured image from url (fifu) +1 moreFeatured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text6.4 Medium
- gutengeek gg woo feed, wpopal gg woo feed for woocommerce shopping feed on google and other channels +1 moreGTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update6.5 Medium
- shortpixel enable media replaceEnable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting4.7 Medium
- premio my sticky bar, my sticky bar – floating notification bar & sticky header (formerly mystickymenu) +1 moreMy Sticky Bar <= 2.6.6 - Cross-Site Request Forgery to Sensitive Information Exposure3.1 Low
- magazine3 amp for wp, mohammed kaludi amp for wp – accelerated mobile pages +1 moreAMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode6.4 Medium
- wpweaver weaver xtreme, weavertheme weaver xtreme theme support +1 moreWeaver Xtreme <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- themeisle lightstart, lightstart – maintenance mode, coming soon and landing page builder +1 moreLightStart – Maintenance Mode, Coming Soon and Landing Page Builder <= 2.6.8 - Missing Authorization4.3 Medium
- inc2734 mw wp form, mw wp form project wp form +1 moreMW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload9.8 Critical
- piotnet forms, piotnetdotcom piotnet forms +1 morePiotnet Forms <= 1.0.28 - Unauthenticated Arbitrary File Upload8.1 High
- carazo import and export users and customersImport and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality6.6 Medium
- pickplugins post grid, post grid combo +1 morePost Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site Scripting6.4 Medium
- limitloginattempts limit login attempts reloaded, wpchefgadget limit login attempts reloaded – login security, 2fa, brute force protection & firewall +1 moreLimit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- realmag777 fox – currency switcher professional for woocommerce, pluginus fox - currency switcher professional for woocommerce +1 moreFOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting5.4 Medium
- wpsoul greenshift, greenshift – animation and page builder blocks +1 moreGreenshift – animation and page builder blocks <= 7.6.2 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- leechesnutt slick social share buttonsSlick Social Share Buttons <= 2.4.11 - Authenticated (Subscriber+) Arbitrary Option Update8.8 High
- Show moreLoading…