CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- livemesh addons by elementor, livemeshelementor addons for elementor +1 moreElementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider Widget6.4 Medium
- bestwebsoft contact form by bestwebsoft – advanced wp contact form builder for wordpressContact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_address6.1 Medium
- zaytech woocommerce clover payment gateway, elbanyaoui clover payment gateway by zaytech for woocommerce +1 moreWooCommerce Clover Payment Gateway <= 1.3.1 - Missing Authorization via callback_handler5.3 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builder, form maker +1 moreForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information Exposure5.9 Medium
- colorlib fancybox, colorlibplugins fancybox for wordpress +1 moreThe FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via...4.4 Medium
- smartwp lightweight accordionLightweight Accordion <= 1.5.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- radiustheme classified listing, techlabpro1 classified listing – ai-powered classified ads & business directory plugin +1 moreClassified Listing <= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl_update_user_account8.8 High
- seopress, rainbowgeek seopress – on-site seo & analytics +1 moreSEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- codecabin wp go maps, wpgmaps wp go maps (formerly wp google maps) +1 moreWP Go Maps (formerly WP Google Maps) <= 9.0.34 - Information Exposure to Potential Denial of Service5.3 Medium
- leevio happy addons for elementorHappy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag5.4 Medium
- autowriter ai post generator | autowriterAI Post Generator | AutoWriter <= 3.3 - Missing Authorization6.3 Medium
- code-atlantic popup maker, danieliser popup maker – boost sales, conversions, optins, subscribers with the ultimate wp popup builder +1 morePopup Maker – Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- datafeedr woocommerce cloak affiliate links, datafeedrcom cloak affiliate links for woocommerce +1 moreWooCommerce Cloak Affiliate Links <= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification7.5 High
- qodeinteractive qi addons for elementorQi Addons For Elementor <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jokr network summaryNetwork Summary <= 2.0.11 - Unauthenticated SQL Injection9.8 Critical
- ninjateam wp chat appWP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute6.4 Medium
- melapress wp activity log, wpwhitesecurity wp activity log premium +1 moreWP Activity Log Premium <= 4.6.4 - Authenticated (Subscriber+) SQL Injection8.8 High
- hasthemes shoplentor, devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement plugin +1 moreShopLentor <= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link6.4 Medium
- ayecode userswp, stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp +1 moreUsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- stellarwp event tickets and registrationEvent Tickets and Registration <= 5.8.2 - Improper Authorization to Information Disclosure4.3 Medium
- wpdevteam betterdocs – knowledge base docs & faq solution for elementor & block editorBetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcod…6.4 Medium
- dattateccom envíalosimple: email marketing y newsletters, envialosimple email marketing y newsletters, donweb envialosimple +2 moreEnvíaloSimple: Email Marketing y Newsletters <= 2.3 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- bestwebsoft contact form, contact form by bestwebsoft – advanced wp contact form builder for wordpress +1 moreContact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_subject6.1 Medium
- totalpressorg custom post types, custom fields & moreCustom post types, Custom Fields & more <= 5.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bold-themes bold page builderBold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute6.4 Medium
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload7.2 High
- themeisle otter blocks – gutenberg blocks, page builder for gutenberg editor & fse, otter blocks +1 moreOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- stylemixthemes masterstudy lms, stylemix masterstudy lms wordpress plugin – for online courses and education +1 moreMasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts4.3 Medium
- jtermaat 360 javascript viewer360 Javascript Viewer <= 1.7.12 - Missing Authorization to Plugin Settings Update4.3 Medium
- podsfoundation pods, sc0ttkclark pods – custom content types and fields +1 morePods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode8.8 High
- staxwp stax addons for elementorElementor Addons, Widgets and Enhancements – Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode6.4 Medium
- hasthemes ht mega, devitemsllc ht mega addons for elementor – elementor widgets & template builder, hasthemes ht mega - absolute addons for elementor page builder +2 moreHT Mega – Absolute Addons For Elementor <= 2.4.5 - Authenticated (Contributor+) Directory Traversal8.8 High
- ideabox powerpack addons for elementor, ideaboxcreations powerpack addons for elementor (free widgets, extensions and templates) +1 morePowerPack Addons for Elementor <= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget6.4 Medium
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget6.4 Medium
- customily product personalizerCustomily Product Personalizer <= 1.23.3 - Unauthenticated Stored Cross-Site Scripting7.2 High
- biplob adhikari accordionsAccordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication5.4 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking plugin, nsquared simply schedule appointments +1 moreAppointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode8.8 High
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.6.3 - Insecure Direct Object Reference6.5 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure5.3 Medium
- deepen bajracharya video conferencing with zoomVideo Conferencing with Zoom <= 4.4.5 - Sensitive Information Exposure4.3 Medium
- wpzoom beaver builder addons, addons for beaver builder +1 moreBeaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget6.4 Medium
- butlerblog wp-members, cbutlerjr wp-members membership plugin +1 moreWP-Members Membership Plugin <= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting7.2 High
- wpzoom beaver builder addons, addons for beaver builder +1 moreBeaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget6.4 Medium
- devolutions serverImproper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier...3.6 Low
- redisbloomSpecially crafted CF.RESERVE command can lead to denial-of-service5.5 Medium
- redis redisbloomRedisBloom heap buffer overflow in CF.LOADCHUNK command7.0 High
- rust-lang rust, fedoraproject fedora +1 moreRusts's `std::process::Command` did not properly escape arguments of batch files on Windows10.0 Critical
- yt-dlpyt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows8.4 High
- zoom, zoom video communications, inc. desktop client for linux +1 moreZoom Desktop Client for Linux - Cross Site Scripting4.1 Medium
- Show moreLoading…