CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 moreGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget6.4 Medium
- kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 moreGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF)8.5 High
- knight lab timeline, nuknightlab knight lab timeline +1 moreKnight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- leevio happy addons for elementorHappy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure4.3 Medium
- celomitan gum elementor addon, gum addon for elementor +1 moreGum Elementor Addon <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget6.4 Medium
- bob watu quizWatu Quiz <= 3.4.1 - Sensitive Information Disclosure4.3 Medium
- brainstormforce cards for beaver builderCards for Beaver Builder <= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link6.4 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting4.4 Medium
- oceanwp ocean extraOcean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- merv barrett easy property listingsEasy Property Listings <= 3.5.2 - Authenticated(Contributor+) SQL Injection via Shortcode8.8 High
- crocoblock jetwidgets for elementorJetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL6.4 Medium
- ideaboxcreations powerpack lite for beaver builder, ideabox powerpack for beaver builder +1 morePowerPack Lite for Beaver Builder <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via element link6.4 Medium
- iptanus wordpress file upload, nickboss iptanus file upload +1 moreWordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- cssigniterteam elements plus!Elements Plus! <= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links6.4 Medium
- stylemixthemes masterstudy lms, stylemix masterstudy lms wordpress plugin – for online courses and education +1 moreMasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template9.8 Critical
- david lingren media library assistantMedia Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode6.4 Medium
- comesio relevanssi – a better search, relevanssi, relevanssi premium +1 more +3 moreRelevanssi – A Better Search <= 4.22.1 - Unauthenticated Second Order CSV Injection5.8 Medium
- livemesh addons by elementor, livemeshelementor addons for elementor +1 moreElementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel Widget6.4 Medium
- kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 moreGutenberg Blocks by Kadence Blocks <= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings4.4 Medium
- theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 moreAvada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing5.3 Medium
- presstigers simple job boardSimple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields9.8 Critical
- wpcompress image optimizer, wp compress, aresit wp compress – instant performance & speed optimization +2 moreWP Compress – Image Optimizer <= 6.11.08 - Missing Authorization to Unauthenticated CDN Modification7.5 High
- wpchill passster, passster – password protect pages and content +1 morePassster <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode6.4 Medium
- theme-fusion avada, themefusion avada | website builder for wordpress & woocommerce +1 moreAvada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action6.4 Medium
- dcooney ajax load more – infinite scroll, load more, & lazy loadAjax Load More <= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read4.9 Medium
- linkwhisper link whisper freeLink Whisper Free <= 0.7.1 - Authenticated (Contributor+) PHP Object Injection8.8 High
- rankmath seo, rank math seo – ai seo tools to dominate seo rankings +1 moreRank Math SEO with AI SEO Tools <= 1.0.214 - Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributes6.4 Medium
- wp sharks s2member, clavaque s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptions +1 mores2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 230815 - Information Exposure5.3 Medium
- livemesh addons by elementor, livemeshelementor addons for elementor +1 moreElementor Addons by Livemesh <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider Widget6.4 Medium
- gowebsmarty wp encryption – one click free ssl certificate & ssl / https redirect, security & ssl scan, wp-encryption +1 moreWP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score <= 7.0 - Sensitive Information Exposure via insufficiently protected files7.5 High
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure5.3 Medium
- wpzoom beaver builder addons, addons for beaver builder +1 moreBeaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget6.4 Medium
- wpdeveloper embedpress, wpdevteam embedpress – pdf embedder, embed youtube videos, 3d flipbook, social feeds, docs & more +1 moreEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripti…6.4 Medium
- metagauss registrationmagic, registrationmagic – custom registration forms, user registration, payment, and user login +1 moreRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- imagely nextgen gallery, smub photo gallery, sliders, proofing and themes – nextgen gallery +1 moreWordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure5.3 Medium
- maciej bis permalink manager lite, permalink manager lite project manager lite +1 morePlugin Permalink <= 2.4.3.1 - Missing Authorization via get_uri_editor4.3 Medium
- wow-company modal window, wpcalc modal window – create popup modal window +1 moreModal Window – create popup modal window <= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wpzoom beaver builder addons, addons for beaver builder +1 moreBeaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget6.4 Medium
- leevio happy addons for elementorHappy Addons for Elementor <= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag6.4 Medium
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- gamipress, rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpress +1 moreGamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- maciej bis permalink manager lite, mbis permalink manager pro, permalink manager lite project manager lite +1 more +3 morePermalink Manager Lite and Permalink Manager Pro <= 2.4.3.1 - Reflected Cross-Site Scripting6.1 Medium
- jetmonsters getwid – gutenberg blocks, motopress getwid +1 moreGetwid – Gutenberg Blocks <= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Content6.4 Medium
- bootstrapped wp recipe makerWP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed4.4 Medium
- strangerstudios paid memberships pro – content restriction, user registration, & paid subscriptions, paid memberships pro +1 morePaid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery4.3 Medium
- wpzoom beaver builder addons, addons for beaver builder +1 moreBeaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget6.4 Medium
- webfactory wp resetWP Reset <= 2.0 - Sensitive Information Exposure due to Insufficient Randomness5.9 Medium
- devowl real media library: media library folder & file manager, real media library +1 moreReal Media Library: Media Library Folder & File Manager <= 4.22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- metagauss registrationmagic, registrationmagic – custom registration forms, user registration, payment, and user login +1 moreRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode8.8 High
- envato template kit – importTemplate Kit – Import <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload6.4 Medium
- Show moreLoading…