CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- web357 fixed html toolbarWordPress Fixed HTML Toolbar plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- tobias battenberg wp-cufon, wp cufon +1 moreWordPress WP-Cufon plugin <= 1.6.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- organic themes bulk block converterWordPress Bulk Block Converter plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- minoji mj update historyWordPress MJ Update History plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- netgsmWordPress Netgsm plugin <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- canva – design beautiful blog graphicsWordPress Canva – Design beautiful blog graphics plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- adam bowen tax rate uploadWordPress Tax Rate Upload plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- max bond code insert manager (q2w3 inc manager)WordPress Code Insert Manager (Q2W3 Inc Manager) plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability5.8 Medium
- hideki tanaka what's new generator, whats new generator +1 moreWordPress What's New Generator plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- bmi adult & kid calculator adult & kid calculator, mortgage calculator bmi adult & kid calculator +1 moreWordPress BMI Adult & Kid Calculator plugin <= 1.2.1 - CSRF to XSS vulnerability7.1 High
- microkid related posts for wordpressWordPress Related Posts for WordPress plugin <= 4.0.3 - CSRF to XSS vulnerability7.1 High
- prince radio playerWordPress Radio Player plugin <= 2.0.73 - Sensitive Data Exposure vulnerability5.4 Medium
- adtribes product feed pro for woocommerceWordPress Product Feed PRO for WooCommerce plugin <= 13.3.1 - Sensitive Data Exposure vulnerability5.3 Medium
- infotheme wp poll makerWordPress WP Poll Maker plugin <= 3.4 - Authenticated Arbitrary File Upload vulnerability9.9 Critical
- google chrome, fedoraproject fedora +1 moreInsufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote...6.1 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote...4.3 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote...4.3 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a...4.3 Medium
- google chrome, fedoraproject fedora +1 moreInsufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a...4.3 Medium
- google chrome, fedoraproject fedora +1 moreInsufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed...6.1 Medium
- google chrome, fedoraproject fedora +1 moreInsufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed...7.5 High
- google chromeOut of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to...6.5 Medium
- google chromeInappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an...5.5 Medium
- google chromeUse after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had...8.8 High
- google chromeUse after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreObject corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote...8.8 High
- google chrome, fedoraproject fedora +1 moreObject corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to...8.8 High
- loopus wp cost estimation & payment forms builderWordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.76 - Broken Access Control vulnerability6.5 Medium
- qamar sheeraz, nasir ahmad mega addons for elementorWordPress Mega Addons For Elementor plugin <= 1.8 - Broken Access Control vulnerability5.4 Medium
- palscode multi currency for woocommerceWordPress Multi Currency For WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability4.3 Medium
- woocommerce & wordpress tutorials custom thank you page customize for woocommerce by binary carpenterWordPress Custom Thank You Page Customize For WooCommerce by Binary Carpenter plugin <= 1.4.12 - Broken Access Control vulnerability4.3 Medium
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.0.0 - Broken Access Control vulnerability5.3 Medium
- gutengeek gg woo feed for woocommerce, gg woo feed +1 moreWordPress GG Woo Feed for WooCommerce plugin <= 1.2.6 - Broken Access Control vulnerability4.3 Medium
- wpclever wpc grouped product for woocommerceWordPress WPC Grouped Product for WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability4.3 Medium
- ilmosys open close woocommerce storeWordPress Open Close WooCommerce Store plugin <= 4.9.1 - Broken Access Control vulnerability4.3 Medium
- nuggethon custom order statuses for woocommerceWordPress Custom Order Statuses for WooCommerce plugin <= 1.5.2 - Broken Access Control vulnerability4.3 Medium
- jeff farthing theme my login, theme my login my login, thememylogin +2 moreWordPress Theme My Login plugin <= 7.1.6 - Broken Access Control vulnerability4.3 Medium
- siteground speed optimizerWordPress Speed Optimizer plugin <= 7.4.6 - Broken Access Control vulnerability5.3 Medium
- hewlett packard enterprise hpe compute scale-up server 3200 serverHPE Compute Scale-up Server 3200 Server, Disclosure of Sensitive Information6.8 Medium
- unknown wp staging wordpress backup plugin, wp-staging-pro, wp-staging wp staging +2 more +4 moreWP Staging < 3.4.0, 5.4.0 (Pro Version) - Admin+ Stored XSS4.8 Medium
- unknown social media share buttons & social sharing icons, inisev social media share buttons \& social sharing icons +1 moreSocial Media Share Buttons < 2.8.9 - Admin+ Stored XSS via settings5.9 Medium
- dimitri grassi salon booking systemSalon booking system < 9.6.3 - Unauthenticated Stored XSS4.7 Medium
- dimitri grassi salon booking systemWordPress Plugin Salon Booking System < 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS)5.7 Medium
- easy social feed social feed, easysocialfeed easy social feed +1 moreEasy Social Feed < 6.5.6 - Contributor+ Stored XSS5.3 Medium
- dev4press coreactivity, unknown coreactivity: activity logging plugin for wordpress +1 morecoreActivity < 2.1 - Unauthenticated IP Spoofing5.3 Medium
- ibm websphere application server, websphere application server liberty +1 moreIBM WebSphere Application Server server-side request forgery4.3 Medium
- ibm websphere application server, websphere application server liberty +1 moreIBM WebSphere Application Server XML external entity injection7.0 High
- phlex-ruby phlex, ruby fileutils +1 morephlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags7.1 High
matioOSS-FuzzHeap-buffer-overflow in Mat_VarDuplicateNo scoreclamavOSS-FuzzUNKNOWN READ in cli_html_normaliseNo score- Show moreLoading…