CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- repute infosystems bookingpressWordPress BookingPress plugin <= 1.0.74 - Booking Price Manipulation vulnerability8.2 High
- crocoblock jetformbuilderWordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability5.3 Medium
- tenda w15e, w15e firmware +1 moreTenda W15E DelPortMapping formDelPortMapping stack-based overflow8.8 High
- tenda w15e, w15e firmware +1 moreTenda W15E DelDhcpRule formDelDhcpRule stack-based overflow8.8 High
- automattic jetpackWordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability5.4 Medium
- elementor website builderWordPress Elementor plugin <= 3.16.4 - Auth. Arbitrary Attachment Read vulnerability6.5 Medium
- daniel powney multi ratingWordPress Multi Rating plugin <= 5.0.6 - Unauth Arbitrary rating value change5.3 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates), unlimited-elements unlimited elements for elementor +1 more +3 moreWordPress Unlimited Elements For Elementor plugin <= 1.5.60 - Unrestricted Zip Extraction vulnerability9.9 Critical
- xtemos woodmartWordPress WoodMart theme <= 7.0.4 - Unauth Arbitrary Shortcodes Injection5.3 Medium
- foliovision fv flowplayer video player, fv flowplayer video player flowplayer video player +1 moreWordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability4.1 Medium
- ovic team addon toolkitWordPress Ovic Addon Toolkit plugin <= 2.6.1 - Broken Access Control vulnerability4.3 Medium
- tenda w15e, w15e firmware +1 moreTenda W15E AddDnsForward formAddDnsForward stack-based overflow8.8 High
- xfinity soft order limit for woocommerceWordPress Order Limit for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability6.5 Medium
- loginpress proWordPress LoginPress Pro plugin < 3.0.0 - Unauth. License Activation/Deactivation vulnerability6.5 Medium
- trackship for woocommerceWordPress TrackShip for WooCommerce plugin <= 1.7.5 - Broken Access Control vulnerability5.3 Medium
- wordpress yith woocommerce compare, yith woocommerce compare +1 moreWordPress YITH WooCommerce Compare plugin <= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- tenda tx9, tx9 pro firmware +1 moreTenda TX9 PowerSaveSet sub_42C014 stack-based overflow8.8 High
- tenda tx9, tx9 pro firmware +1 moreTenda TX9 SetSysTimeCfg sub_42D4DC stack-based overflow8.8 High
- cozmoslabs paid member subscriptionsWordPress Paid Membership Subscriptions plugin <= 2.11.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wp royal royal elementor kitWordPress Royal Elementor Kit theme <= 1.0.116 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- paid memberships pro memberships pro, strangerstudios paid memberships pro +1 moreWordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- paid memberships pro memberships pro, strangerstudios paid memberships pro +1 moreWordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- revmakx wpcal.io – easy meeting schedulerWordPress WPCal.io <= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- coschedule headline analyzerWordPress Headline Analyzer plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- alumnionline web services llc wp ada compliance check basicWordPress WP ADA Compliance Check Basic plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- giorgos sarigiannidis slash adminWordPress Slash Admin plugin <= 3.8.1 - CSRF to XSS vulnerability7.1 High
- umbraco umbraco.workflow.issuesUmbraco Workflow's Backoffice users can execute arbitrary SQL5.5 Medium
- shoaib saleem wp post ratingWordPress WP Post Rating plugin <= 2.5 - Vote Manipulation Vulnerability5.3 Medium
- metagauss registrationmagicWordPress RegistrationMagic plugin <= 5.1.9.2 - Content Injection5.3 Medium
- tenda tx9, tx9 pro firmware +1 moreTenda TX9 SetVirtualServerCfg sub_42CB94 stack-based overflow8.8 High
- drupal rest views, rest views project views +1 moreREST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-0187.5 High
- tenda tx9, tx9 pro firmware +1 moreTenda TX9 SetLEDCfg sub_42BD7C stack-based overflow8.8 High
- advanced pwa inc push notifications project pwa inc push notifications, drupal advanced pwa inc push notifications +1 moreAdvanced PWA - Critical - Access bypass - SA-CONTRIB-2024-0179.1 Critical
- cosmwasm cosmwasm-stdCosmWasm affected by arithmetic overflows3.7 Low
- checkmkBrute-force protection ineffective for some login methods5.9 Medium
- ays pro quiz maker, quiz maker team maker +1 moreWordPress Quiz Maker plugin <= 6.3.9.4 - Content Spoofing3.7 Low
nssTuxCare,nsprTuxCare,nspr-develTuxCare +10 more +12 moreUpdate of nssNo score- metagauss registrationmagicWordPress RegistrationMagic plugin <= 5.1.9.2 - Arbitrary Price Change7.5 High
- formassembly / drew buschhorn wp-formassembly, formassembly wpformassembly +1 moreWordPress WP-FormAssembly plugin <= 2.0.5 - Auth. Arbitrary File Read vulnerability6.5 Medium
- tribulant newslettersWordPress Newsletters plugin <= 4.9.5 - Arbitrary File Upload vulnerability9.1 Critical
- webangon the pack elementor addonsWordPress The Pack Elementor addons plugin <= 2.0.8.3 - Cross Site Request Forgery (CSRF) to XSS vulnerability7.1 High
- seers, wordpress seers plugin +1 moreWordPress Seers plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) to XSS vulnerability7.1 High
- metagauss profilegrid, wordpress profile grid +1 moreWordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- metagauss profilegridWordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability5.4 Medium
- blazzdev rate my post, feedbackwp rate my post – wp rating system +1 moreWordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- repute info systems arformsWordPress ARForms plugin <= 6.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ghozylab image slider widget, image slider +1 moreWordPress Image Slider plugin <= 1.1.125 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- saad iqbal mycredWordPress myCred plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jegtheme jeg elementor kitWordPress Jeg Elementor Kit plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- coupon & discount code reveal buttonWordPress Coupon & Discount Code Reveal Button plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- Show moreLoading…