CVEs published in February 2024
2,905 vulnerabilities, 342 critical, 12 exploited.
- livemesh addons by elementor, livemeshelementor addons for elementor +1 moreElementor Addons by Livemesh <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- florent maillefaud wp maintenanceWP Maintenance <= 6.1.6 - Information Exposure5.3 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 moreProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode6.4 Medium
- ideabox powerpack addons for elementor, ideaboxcreations powerpack addons for elementor (free widgets, extensions and templates) +1 morePowerPack Addons for Elementor <= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget6.4 Medium
- wpdeveloper embedpress, wpdevteam embedpress – pdf embedder, embed youtube videos, 3d flipbook, social feeds, docs & more +1 moreEmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- imagerecycle pdf & image compression, pdf \& image compression +1 moreImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in stopOptimizeAll4.3 Medium
- oceanwp ocean extraOcean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 moreProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress, profilepress +1 morePaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting6.5 Medium
- wpdeveloper embedpress, wpdevteam embedpress – pdf embedder, embed youtube videos, 3d flipbook, social feeds, docs & more +1 moreEmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link6.4 Medium
- wpify woo czechWPify Woo Czech <= 4.0.8 - Missing Authorization5.3 Medium
- awordpresslife coming soon maintenance modeComing Soon Maintenance Mode <= 1.0.5 - Information Exposure5.3 Medium
- cusrev customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review5.3 Medium
- elementor website builder, elemntor elementor website builder – more than just a page builder +1 moreElementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt6.4 Medium
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- buildwps ppwp – password protect pages, bwps ppwp, passwordprotectwp password protect wordpress +2 morePPWP – Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass5.3 Medium
- imagerecycle pdf & image compression, pdf \& image compression +1 moreImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Plugin Data Removal in reinitialize4.3 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist4.3 Medium
- webfactory login lockdown & protection, webfactoryltd wp login lockdown +1 moreLogin Lockdown – Protect Login Form <= 2.08 - Missing Authorization5.4 Medium
- sonalsinha21 skt page builder, sktthemes skt templates +1 moreSKT Page Builder <= 4.1 - Missing Authorization to Authenticated(Subscriber+) Content Injection4.3 Medium
- imagerecycle pdf & image compression, pdf \& image compression +1 moreImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Plugin Data Removal in reinitialize4.3 Medium
- matomo, matomoteam matomo analytics – powerful, privacy-first insights for wordpress +1 moreMatomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite6.1 Medium
- infinitewp client, revmakx infinitewp client +1 moreInfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposure5.9 Medium
- leevio happy addons for elementorHappy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- smashballoon custom twitter feeds, smub custom twitter feeds – a tweets widget or x feed widget +1 moreCustom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update4.3 Medium
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A5.4 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- heateor sassy social share, social sharing plugin – sassy social share +1 moreSassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator, rss aggregator by feedzy +1 moreRSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication6.5 Medium
- squirrly starbox, cifi starbox – the author box for humans +1 moreStarbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings6.4 Medium
- athemes sydney toolboxSydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- imagerecycle pdf & image compression, pdf \& image compression +1 moreImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in enableOptimization4.3 Medium
- cozmoslabs paid membership subscriptions – effortless memberships, recurring payments & content restriction, membership \& content restriction - paid member subscriptions +1 morePaid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page4.3 Medium
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jeffparker yarpp – yet another related posts plugin, yarpp yet another related posts plugin +1 moreYet Another Related Posts Plugin (YARPP) <= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings4.4 Medium
- imagerecycle pdf & image compression, pdf \& image compression +1 moreImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in enableOptimization4.3 Medium
- getshortcodes shortcodes ultimate, gn themes wp shortcodes plugin — shortcodes ultimate +1 moreWP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode6.4 Medium
- wpchill passster, passster – password protect pages and content +1 morePassster – Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure5.3 Medium
- openvpn 3 core library, 3 +1 moreThe PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the...6.5 Medium
- hp inc. certain hp enterprise laserjet, hp laserjet managed printers, hp futuresmart 3, futuresmart 4 +1 more +3 moreCertain HP Enterprise LaserJet, HP LaserJet Managed Printers – Potential Information Disclosure6.5 Medium
- linux, linux kernel +1 moreuio: Fix use-after-free in uio_open7.8 High
- linux, linux kernel +1 morebinder: fix use-after-free in shinker's callback7.8 High
- linux, linux kernel +1 moref2fs: explicitly null-terminate the xattr list7.8 High
- element, element-hq element-android +1 moreElement Android can be asked to share internal files.4.0 Medium
- linux, linux kernel +1 morenet: prevent mss overflow in skb_segment()5.5 Medium
- zephyrproject zephyrfs: fuse: buffer overflow vulnerability in the Zephyr FS7.3 High
- hcltech domino, hcl software domino server +1 moreHCL Domino is susceptible to a weak cryptography vulnerability5.9 Medium
- element, element-hq element-android +1 moreElement Android Intent Redirection8.4 High
- ciliumUnencrypted traffic between pods when using Wireguard and an external kvstore6.1 Medium
- debian linux, linux kernel +1 moresmb: client: fix potential OOBs in smb2_parse_contexts()8.1 High
- Show moreLoading…