CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- tribulant newslettersNewsletter Lite < 4.9.3 - Admin+ Command Injection7.2 High
- cyberlord92 staff / employee business directory for active directory, miniorange staff \/ employee business directory for active directory +1 moreStaff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entries5.4 Medium
- koalaapps my account page editorMy Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File Upload8.8 High
- unknown user registration & user profile, wpuserplus userplus +1 moreUserPlus <= 2.0 - Stored XSS via CSRF6.5 Medium
- hiweb migration simple, unknown hiweb migration simple +1 morehiWeb Migration Simple <= 2.0.0.1 Reflected Cross-Site Scripting6.1 Medium
- strategy11 formidable formsFormidable Forms < 6.2 - Unauthenticated PHP Object Injection7.5 High
- codepeople calculated fields formCalculated Fields Form < 1.1.151 - Admin+ Stored Cross-Site Scripting via Dropdown Fields4.8 Medium
- themeum qubelyQubely < 1.8.5 - Contributor+ Stored XSS5.4 Medium
- qoders upqode google mapsUpQode Google Maps <= 1.0.5 - Contributor+ Stored XSS5.4 Medium
- unknown directoristDirectorist < 7.5.4 - Admin+ LFI2.7 Low
- lana shortcodes, unknown lana shortcodes +1 moreLana Shortcodes < 1.2.0 - Contributor+ Stored XSS5.4 Medium
- unknown post smtp mailer, wpexperts post smtp +1 morePOST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF4.3 Medium
- hcl software bigfix osd bare metal server webui, hcltechsw bigfix bare osd metal server webui +1 moreHCL BigFix OSD Bare Metal Server WebUI is affected by sensitive information disclosure2.3 Low
- unknown contact form by wd, web-dorado contact form maker +1 moreContact Form by WD <= 1.13.23 - Admin+ SQLi7.2 High
- tychesoftwares print invoice & delivery notes for woocommerce, print invoice \& delivery notes for woocommerce +1 morePrint Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS6.1 Medium
- cusrev customer reviews for woocommerceCustomer Reviews for WooCommerce < 5.17.0 - Contributor+ Stored XSS5.4 Medium
- givewpGiveWP < 2.24.1 - Unauthenticated SQLi9.8 Critical
- thimpress learnpressLearnPress < 4.2.5.5 - Reflected Cross-Site Scripting6.1 Medium
- ashanjay eventonEventON < 2.2 - Admin+ Stored HTML Injection4.8 Medium
- t1 project t1T1 theme <= 19.0 - Open Redirect6.1 Medium
- dmparekh wordpress database administratorWordPress Database Administrator <= 1.0.3 - Unauthenticated SQL Injection9.8 Critical
- indigitall iurny, unknown iurny by indigitall +1 moreIURNY by INDIGITALL < 3.2.3 - Admin+ Stored XSS4.8 Medium
- dokanDokan < 3.6.4 - Vendor Stored Cross-Site Scripting5.4 Medium
- newnine font awesome 4 menusFont Awesome 4 Menus <= 4.7.0 - Admin+ Stored XSS4.8 Medium
- subina wp best quizWP Best Quiz <= 1.0 - Author+ Stored XSS5.4 Medium
- unknown contact form entries, crmperks database for contact form 7\, wpforms\, elementor forms +1 moreContact Form Entries < 1.3.0 - CSV Injection7.8 High
- marcorulicke coru lfmemberCoru LFMember <= 1.0.2 - Stored Cross-Site Scripting via CSRF6.1 Medium
- unknown wp-invoiceWP-Invoice <= 4.3.1 - Stored Cross-Site Scripting via CSRF6.1 Medium
- automattic woocommerceWooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion4.3 Medium
- unknown ark-commenteditor, obg ark wysiwyg comment editor +1 moreArk Comment Editor <= 2.15.6 - Iframe Injection via Comment5.3 Medium
- dd32 core controlCore Control <= 1.2.1 - Arbitrary Settings Update via CSRF4.3 Medium
- weblizar school management, unknown school-management-pro +1 moreThe School Management < 9.9.7 - Unauthenticated RCE via REST api9.8 Critical
- themehunk contact form & lead form elementor builder, contact form \& lead form elementor builder +1 moreContact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings Update4.3 Medium
- themehunk contact form & lead form elementor builder, contact form \& lead form elementor builder +1 moreContact Form & Lead Form Elementor Builder < 1.7.0 - Multiple Admin+ Stored Cross-Site Scripting4.8 Medium
- super-forms super forms, unknown super forms - drag & drop form builder +1 moreSuperforms < 6.0.4 - Reflected Cross-Site Scripting6.1 Medium
- 3dprint project 3dprint3DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF8.1 High
- unknown form vibesForm Vibes < 1.4.5 - Admin+ SQLi7.2 High
- seedwebs seed socialSeed Social < 2.0.4 - Admin+ Stored XSS4.8 Medium
- themely theme demo importTheme-Demo-Importer < 1.1.1 - Admin+ Arbitrary File Upload7.2 High
- wpengine wpgraphql, unknown wp-graphql-woocommerce +1 moreWPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure5.3 Medium
- simonpedge slide anythingSlide Anything < 2.3.47 - Author+ Cross Site Scripting in slide title5.4 Medium
- unknown wp fastest cacheWP Fastest Cache < 0.9.5 - CSRF to Stored Cross-Site Scripting6.1 Medium
- unknown wp fastest cacheWP Fastest Cache < 0.9.5 - Subscriber+ SQL Injection8.8 High
- unknown simple sort&search, yukimichi simple sort\&search +1 moreSimple Sort&Search <= 0.0.3 - Ccontributor+ Stored XSS5.4 Medium
- berocket advanced ajax product filtersAdvanced AJAX Product Filters < 1.5.4.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)6.1 Medium
- lester ‘gamerz’ chan wp-postratingsWP Postratings < 1.86.1 - Admin+ Stored Cross-Site Scripting4.8 Medium
- benjaminprojas wp editorWP Editor < 1.2.7 - Authenticated SQL injection7.2 High
- realmag777 fox, pluginus fox - currency switcher professional for woocommerce +1 moreWooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File Inclusion8.8 High
- patrickposner qyrrQyrr < 0.7 - Authenticated (contributor+) Stored XSS5.4 Medium
- nickmomrik simple postSimple Post <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS)5.4 Medium
- Show moreLoading…