CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- brainstorm force ultimate addons for wpbakery page builderWordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 - Local File Inclusion vulnerability7.1 High
- supsystic popup, popup by supsystic +1 moreWordPress Popup by Supsystic plugin <= 1.10.19 - Unauthenticated Subscriber Email Addresses Disclosure5.3 Medium
- themify ultraWordPress Themify Ultra theme <= 7.3.5 - Authenticated Privilege Escalation vulnerability8.8 High
- doublesharp remote content shortcodeWordPress Remote Content Shortcode plugin <= 1.5 - Local File Inclusion vulnerability6.5 Medium
- stylemixthemes cost calculator builder proCost Calculator Builder Pro <= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery6.4 Medium
- wp hive events rich snippets for googleWordPress Events Rich Snippets for Google plugin <= 1.8 - CSRF Leading to Privilege Escalation vulnerability7.1 High
- codepeople cp polls, polls cp +1 moreWordPress Polls CP plugin <= 1.0.71 - Polls Limitation Bypass vulnerability5.3 Medium
- codepeople cp polls, polls cp +1 moreWordPress Polls CP plugin <= 1.0.71 - Content Injection vulnerability5.3 Medium
- unknown defender security, wpmudev defender +1 moreWordPress Defender Security plugin <= 4.4.1 - IP Restriction Bypass vulnerability5.3 Medium
- wp happy coders comments like dislikeWordPress Comments Like Dislike plugin <= 1.2.2 - IP Restriction Bypass Vulnerability vulnerability4.3 Medium
- lionscripts ip blocker liteWordPress LionScripts: IP Blocker Lite plugin <= 11.1.1 - Bypass vulnerability5.3 Medium
- pippin williamson cgc maintenance modeWordPress CGC Maintenance Mode plugin <= 1.2 - IP Filtering Bypass vulnerability3.7 Low
- stefanno lissa newsletterWordPress Newsletter plugin <= 8.2.0 - IP Blacklist Bypass vulnerability5.3 Medium
- tips and tricks hq wp express checkout (accept paypal payments)WordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerability7.5 High
- guido vs contact formWordPress VS Contact Form plugin <= 14.7 - Sum Captcha Bypass vulnerability5.3 Medium
- bestwebsoft captcha by bestwebsoftWordPress Captcha by BestWebSoft plugin <= 5.2.0 - Captcha Bypass vulnerability5.3 Medium
- cozmoslabs profile builderWordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerability5.3 Medium
- codename065 download managerWordPress Download Manager plugin <= 3.2.82 - File Password Lock Bypass vulnerability5.3 Medium
- supsystic pricing table by supsysticWordPress Pricing Table by Supsystic plugin <= 1.9.12 - Content Injection vulnerability4.3 Medium
- aa-team wzoneWordPress WZone plugin <= 14.0.10 - Privilege Escalation vulnerability8.8 High
- jr king/eran schoellhorn wp masqueradeWordPress WP Masquerade plugin <= 1.1.0 - Authenticated Account Takeover vulnerability8.8 High
- 8theme xstore coreWordPress XStore Core plugin <= 5.3.8 - Unauthenticated Account Takeover vulnerability9.8 Critical
- dmitry v. (ceo of "ukr solution") barcode scanner with inventory & order managerWordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.5.3 - Unauthenticated Privilege Escalation vulnerability9.8 Critical
- connekthq instant imagesWordPress Instant Images plugin <= 6.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability7.2 High
- wpcustomify customify site libraryWordPress Customify Site Library plugin <= 0.0.9 - Remote Code Execution (RCE) vulnerability9.9 Critical
- webtechideas wti like postWordPress WTI Like Post plugin <= 1.4.6 - IP Restriction Bypass Vulnerability vulnerability5.3 Medium
- wpfactory ean for woocommerceWordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability7.2 High
- pluginus wordpress meta data and taxonomies filter, realmag777 wordpress meta data and taxonomies filter (mdtf) +1 moreWordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.2 - Arbitrary Shortcode Execution vulnerability6.5 Medium
- yzmcmsA reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp...5.5 Medium
- simple-membership-plugin simple membershipWordPress Simple Membership plugin <= 4.3.4 - Unauthenticated Membership Role Privilege Escalation vulnerability8.6 High
- simple-membership-plugin simple membershipWordPress Simple Membership plugin <= 4.3.4 - Authenticated Account Takeover vulnerability8.8 High
- wpdeveloper essential addons for elementorWordPress Essential Addons for Elementor plugin <= 5.8.8 - Contributor+ Privilege Escalation vulnerability8.8 High
- profilepress membership team profilepressWordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability8.6 High
- givewpWordPress GiveWP plugin <= 2.33.0 - GiveWP Manager+ Privilege Escalation vulnerability8.8 High
- wpvivid backup & migration backup and migration, wpvivid migration\, backup\, staging +1 moreWordPress WPvivid Backup Plugin plugin <= 0.9.90 - Privilege Escalation on Staging Environment vulnerability8.8 High
- averta phlox shopWordPress Phlox Shop plugin <= 2.0.0 - Unauthenticated Local File Inclusion vulnerability8.6 High
- averta phlox portfolioWordPress Phlox Portfolio plugin <= 2.3.1 - Unauthenticated Local File Inclusion vulnerability8.6 High
- hastech ht mega, hasthemes ht mega - absolute addons for elementor page builder +1 moreWordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability9.8 Critical
- averta shortcodes and extra features for phlox themeWordPress Phlox Core Elements plugin <= 2.14.0 - Unauthenticated Local File Inclusion vulnerability7.6 High
- crocoblock jetformbuilderWordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerability7.2 High
- masaakitanaka booking packageWordPress Booking Package SAASPROJECT plugin <= 1.5.98 - Unauthenticated Privilege Escalation vulnerability8.8 High
- stylemixthemes consultingWordPress Consulting theme <= 6.5.6 - Local File Inclusion7.3 High
- woocommerce one page checkoutWordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability7.6 High
- imran sayed headless cmsWordPress Headless CMS plugin <= 2.0.3 - Broken Authentication vulnerability5.3 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 2.8.6 - Sensitive Data Exposure5.3 Medium
- valiano unite gallery liteWordPress Unite Gallery Lite plugin <= 1.7.59 - Local File Inclusion vulnerability6.0 Medium
- aurélien lws lws affiliation, lws affiliation +1 moreWordPress LWS Affiliation plugin <= 2.2.6 - Local File Inclusion vulnerability9.0 Critical
- xtemos woodmart coreWordPress Woodmart Core plugin <= 1.0.36 - Privilege Escalation9.8 Critical
- sparkle wp editorialmagWordPress Editorialmag theme <= 1.1.9 - Authenticated Arbitrary Plugin Activation4.3 Medium
- artbees jupiterxWordPress JupiterX theme <= 3.0.0 - Auth. Local File Inclusion vulnerability7.6 High
- Show moreLoading…