CVEs published in February 2024
2,905 vulnerabilities, 342 critical, 12 exploited.
- hookturn advanced forms for acfAdvanced Forms for ACF <= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings Export5.3 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 morePaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webfactory minimal coming soon – coming soon page, webfactoryltd minimal coming soon \& maintenance mode +1 moreMinimal Coming Soon – Coming Soon Page <= 2.37 - Unauthenticated Maintenance Mode Bypass3.7 Low
- seedprod website builder by seedprod — theme builder, landing page builder, coming soon page, maintenance mode, website builder by seedprod +1 moreWebsite Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode <= 6.15.21 - Missing Authorization via seedprod_lite_new_lpage8.2 High
- ashok rane order delivery date for wp e-commerce, tychesoftwares order delivery date for woocommerce +1 moreOrder Delivery Date for WP e-Commerce <= 1.2 - Unauthenticated Stored Cross-Site Scripting6.5 Medium
- bootstrapped wp recipe makerWP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe Notes6.4 Medium
- jetmonsters getwid – gutenberg blocks, motopress getwid +1 moreGetwid – Gutenberg Blocks <= 2.0.4 - Missing Authorization to Recaptcha API Key Modification4.3 Medium
- learndash, stellarwp learndash lms +1 moreLearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments5.3 Medium
- gpriday siteorigin widgets bundle, siteorigin widgets bundle +1 moreSiteOrigin Widgets Bundle <= 1.58.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webtechstreet elementor addon elementsThe Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting...6.4 Medium
- hwk wp 404 auto redirect to similar postWP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via request6.1 Medium
- wpclubmanager wp club manager – wordpress sports club plugin, wp club manager +1 moreWP Club Manager – WordPress Sports Club Plugin <= 2.2.10 - Missing Authorization to Unauthenticated Event Permalink Update5.3 Medium
- realmag777 wolf – wordpress posts bulk editor and manager professional, pluginus wolf - wordpress posts bulk editor and products manager professional +1 moreWOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Cross-Site Request Forgery5.4 Medium
- learndash, stellarwp learndash lms +1 moreLearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API5.3 Medium
- royal-elementor-addons royal elementor kitRoyal Elementor Kit <= 1.0.116 - Missing Authorization to Arbitrary Transient Update4.3 Medium
- bootstrapped wp recipe makerWP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color6.4 Medium
- amitzy molongui authorship, molongui authorship – author boxes, guest authors & co-authors for wordpress +1 moreAuthor Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug5.3 Medium
- pluginus woot, realmag777 active products tables for woocommerce. use constructor to create tables +1 moreActive Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Cross-Site Request Forgery4.3 Medium
- ninjateam filebird, filebird – wordpress media library folders & file manager +1 moreFileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import5.5 Medium
- mra13 affiliates managerAffiliates Manager <= 2.9.34 - Cross-Site Request Forgery4.3 Medium
- bootstrapped wp recipe makerWP Recipe Maker <= 9.1.0 - Directory Traversal5.4 Medium
- extendify editorskit, munirkamal gutenberg block editor toolkit – editorskit +1 moreEditorsKit <= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl5.4 Medium
- cookieinformation cookie information | free gdpr consent solution, free gdpr consent solution, wp-gdpr-compliance +2 moreCookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- aman086 views for wpforms – display & edit wpforms entries on your site frontend, formviewswp views for wpforms +1 moreViews for WPForms <= 3.2.2 - Missing Authorization via save_view4.3 Medium
- 10web photo gallery by 10web – mobile-friendly image gallery, photo gallery +1 morePhoto Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename9.1 Critical
- aman086 views for wpforms – display & edit wpforms entries on your site frontend, formviewswp views for wpforms +1 moreViews for WPForms <= 3.2.2 - Cross-Site Request Forgery via create_view4.3 Medium
- josevega display custom fields in the frontend – post and user profile fields, vegacorp display custom fields in the frontend - post and user profile fields +1 moreDisplay custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data6.4 Medium
- devscred exclusive addons for elementorExclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- aman086 views for wpforms – display & edit wpforms entries on your site frontend, formviewswp views for wpforms +1 moreViews for WPForms <= 3.2.2 - Missing Authorization via get_form_fields4.3 Medium
- cozmoslabs profile builder, user profile builder – beautiful user registration forms, user profiles & user role editor +1 moreUser Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update8.2 High
- metabox meta boxMeta Box – WordPress Custom Fields Framework <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bootstrapped wp recipe makerWP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag6.4 Medium
- 10web ai assistant – ai content writing assistant, ai assistant +1 more10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation6.5 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options5.5 Medium
- connekthq instant images – one-click image uploads from unsplash, openverse, pixabay, pexels, and giphy, instant images - one click unsplash uploads +1 moreInstant Images <= 6.1.0 - Authenticated (Author+) Arbitrary Options Update8.8 High
- filemanagerpro file managerFile Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames8.1 High
- realmag777 wolf – wordpress posts bulk editor and manager professional, pluginus wolf - wordpress posts bulk editor and products manager professional +1 moreWOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Missing Authorization4.3 Medium
- a. jones (simply) guest author name, shooflysolutions \(simply\) guest author name +1 more(Simply) Guest Author Name <= 4.34 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- pluginus woot, realmag777 active products tables for woocommerce. use constructor to create tables +1 moreActive Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Missing Authorization4.3 Medium
- meowapps ai engine, tigroumeow ai engine – the chatbot, ai framework & mcp for wordpress +1 moreAI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url6.6 Medium
- getshieldsecurity shield security, paultgoodchild shield: blocks bots, protects users, and prevents security breaches +1 moreShield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion9.8 Critical
- josevega display custom fields in the frontend – post and user profile fields, display custom fields in the frontend - post and user profile fields +1 moreDisplay custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure4.3 Medium
- livemesh elementor addons, addons by elementor +1 moreElementor Addons by Livemesh <= 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- allegro.ai clearmlAllegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance6.0 Medium
- m2crypto project m2crypto, red hat enterprise linux 6, enterprise linux 7 +7 more +9 moreM2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-256577.5 High
- cryptlibCryptlib: rsa key exchange ciphersuites in tls vulnerable to marvin attack5.9 Medium
- hashicorp boundary, boundary enterprise +1 moreBoundary Vulnerable to Session Hijacking Through TLS Certificate Tampering8.0 High
- netapp storagegrid, storagegrid (formerly storagegrid webscale) +1 moreDenial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)6.5 Medium
- phpmyfaqphpMyFAQ vulnerable to stored XSS on attachments filename6.5 Medium
- Show moreLoading…