CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- wp all import import users from csv, wpallimport wp all import +1 moreWordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection4.4 Medium
- activecampaignWordPress ActiveCampaign plugin <= 8.1.14 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- wappointment appointment bookings for zoom googlemeet and more – wappointmentWordPress Wappointment plugin <= 2.6.0 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- rextheme product feed managerWordPress Product Feed Manager plugin <= 7.3.15 - Directory Traversal vulnerability5.5 Medium
- mdempfle advanced iframeWordPress Advanced iFrame plugin <= 2024.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ezplugins ez form calculatorWordPress EZ Form Calculator plugin <= 2.14.0.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- kaizencoders short urlWordPress Short URL plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- libsyn publisher hubWordPress Libsyn Publisher Hub plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pinewise wp google analytics eventsWordPress WP Google Analytics Events – No-Code Custom Event Tracking for Google Analytics plugin <= 2.8.0 - Reflected Cross-Site Scripting vulnerability7.1 High
- form plugin team - ghozylab easy contact form lite, ghozylab contact form +1 moreWordPress Contact Form Plugin plugin <= 1.1.23 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- blueglass jobs for wordpressWordPress Jobs for WordPress plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- jennifer moss mww disclaimer buttonsWordPress MWW Disclaimer Buttons plugin <= 3.0.2 - Stored Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpchill remove footer creditWordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- poeditorWordPress POEditor plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- phpgurukul student record systemPHPGurukul Student Record System edit-subject.php sql injection6.3 Medium
- phpgurukul student record systemPHPGurukul Student Record System sql injection6.3 Medium
- robbychen simple buttons creatorSimple Buttons Creator <= 1.04 - Aribtrary Button Deletion via CSRF4.8 Medium
- robbychen simple buttons creatorSimple Buttons Creator <= 1.04 - Unauthenticated Stored XSS6.1 Medium
- heateor super socializer, unknown social share, social login and social comments plugin +1 moreSuper Socializer < 7.13.64 - Editor+ Stored XSS4.8 Medium
- mndpsingh287 advanced searchAdvance Search <= 1.1.6 - Shortcode Deletion via CSRF8.7 High
- aaron queen wp customer reviewsWP Customer Reviews < 3.7.1 - Malicious Redirect via HTTP-EQUIV Injection5.4 Medium
- unknown responsive tabsResponsive Tabs < 4.0.7 - Contributor+ Stored XSS5.4 Medium
- calliko nps computy, nps computy +1 moreNPS computy <= 2.7.5 - Results Deletion via CSRF8.8 High
- calliko nps computy, nps computy +1 moreNPS computy <= 2.7.5 - Admin+ Stored XSS4.7 Medium
- pickplugins testimonial slider, radiustheme testimonial slider and showcase +1 moreTestimonial Slider < 2.3.8 - Admin+ Stored XSS5.4 Medium
- majeedraza carousel sliderCarousel Slider < 2.2.7 - Editor+ Stored XSS4.7 Medium
- pluginops top barTop Bar < 3.0.5 - Admin+ Stored XSS4.8 Medium
- automattic woocommerceWooCommerce < 8.6 - Contributor+ Private/Draft Products Access4.9 Medium
- rednao smart formsSmart Forms < 2.6.94 - Subscriber+ Edit Entries via Broken Access Control6.5 Medium
- rednao smart formsSmart Forms < 2.6.94 - Edit Entries via CSRF5.4 Medium
- metabox meta boxMeta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure4.3 Medium
- radykal fancy product designerFancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product Title4.8 Medium
- unknown woocommerce customers manager, woocommerce customers manager +1 moreWooCommerce Customers Manager < 29.7 - Subscriber+ SQL Injection8.1 High
- everestthemes everest backupEverest Backup < 2.2.5 - Admin+ Arbitrary File Upload6.5 Medium
- unknown wp user profile avatar, wp event manager user profile avatar +1 moreWP User Profile Avatar <= 1.0.1 - Contributor+ Stored XSS5.4 Medium
- asus expertwifi ebm63, expertwifi ebm68, rt-ax57 go +2 moreASUS WiFi Router - OS Command Injection8.8 High
- phpgurukul student record systemPHPGurukul Student Record System login.php sql injection7.3 High
- ai3 qbibotAi3 QbiBot - Unrestricted File Upload7.2 High
- itsourcecode news portal, phpgurukul news portal project +1 morePHPGurukul/itsourcecode News Portal search.php sql injection5.3 Medium
- ai3 qbibotAi3 QbiBot - Broken Access Control9.8 Critical
- phpgurukul news portal, news portal project +1 morePHPGurukul News Portal edit-post.php sql injection5.3 Medium
- netvision airpassNetvision airPASS - Reflected XSS6.1 Medium
- aenrich a+hrd, a\+hrd +1 moreaEnrich Technology a+HRD - Argument Injection5.3 Medium
- aenrich a+hrd, a\+hrd +1 moreaEnrich Technology a+HRD - Exposure of Sensitive Data5.3 Medium
- pydantic, fedoraproject fedora +1 moreRegular expression denial of service in Pydantic < 2.4.05.9 Medium
- tcpdf project tcpdfTCPDF Cross-site Scripting vulnerability6.1 Medium
- foxit pdf reader, pdf editor +1 moreIn Foxit PDF Reader and Editor before 2024.1, Local Privilege Escalation could occur during...7.8 High
- oretnom23 cosmetics and beauty product online storeA cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers...6.1 Medium
- cosmetics and beauty product online store project and beauty product online store, oretnom23 cosmetics and beauty product online store +1 moreA cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers...6.1 Medium
- cosmetics and beauty product online store project and beauty product online store, oretnom23 cosmetics and beauty product online store +1 moreA cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers...9.6 Critical
- Show moreLoading…