CVEs published in July 2024
3,166 vulnerabilities, 289 critical, 12 exploited.
- mardojai simple alert boxesSimple Alert Boxes <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode6.4 Medium
- pandavideo panda videoPanda Video <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- panda video video, pandavideo panda video +1 morePanda Video <= 1.4.0 - Authenticated (Contributor+) Local File Inclusion8.8 High
- hyumika openstreetmap, mika osm – openstreetmap, osm-openstreetmap +2 moreOSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wpkube social sharing plugin – kiwi, kiwi social share +1 moreSocial Sharing Plugin – Kiwi <= 2.1.7 - Information Disclosure5.3 Medium
- wppuzzle comment images reloadedComment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion4.3 Medium
- stellarwp learndash lms – reportsLearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update5.4 Medium
- idioweb extensions for elementorExtensions for Elementor <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget6.4 Medium
- elfsight pricing tablePricing Table <= 2.0.1 - Cross-Site Request Forgery via ajax()5.3 Medium
- happymonkeyagency scss happy compiler – compile scss to css & automatic enqueue, scss happy compiler +1 moreHappy SCSS Compiler - Compile SCSS to CSS automatically <= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting5.4 Medium
- pickplugins product designer, product designer for woocommerce +1 moreProduct Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion5.3 Medium
- wp2speed, wp2speed faster – optimize pagespeed insights score 90-100 +1 moreWP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials5.3 Medium
- happydevs happy woocommerce faqs – ultimate product faq pluginXPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update4.3 Medium
- aprokopenko just custom fieldsJust Custom Fields <= 3.3.2 - Missing Authorization via AJAX actions4.3 Medium
- cliengo – chatbotCliengo - Chatbot <= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update5.4 Medium
- jevnet easy pixelsEasy Pixels by JEVNET <= 2.13 - Unauthenticated Stored Cross-Site Scripting7.2 High
- dwieeb scrollto top, scroll to top project to top +1 moreScrollTo Top <= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- dwieeb scrollto bottom, scroll to bottom +1 moreScrollTo Bottom <= 1.1.1 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- rmac0001 iq testimonials, rogermacrae iq-testimonials +1 moreIQ Testimonials <= 2.2.7 - Unauthenticated Arbitrary File Upload9.8 Critical
- advanced ajax page loader project ajax page loader, deano1987 advanced ajax page loader +1 moreAdvanced AJAX Page Loader <= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- nikolaystrikhar gutenberg forms, gutenberg forms – wordpress form builder plugin +1 moreGutenberg Forms <= 2.2.9 - Unauthenticated Arbitrary File Upload9.8 Critical
- praveen-rajan attachment file icons (af icons), praveenrajan attachment file icons +1 moreAttachment File Icons (AF Icons) <= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- bitapps bit form, bitpressadmin bit form – custom contact form, multi step, conversational form & payment form builder +1 moreBit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- tranbinhcse webico slider flatsome addonsWebico Slider Flatsome Addons <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcode6.4 Medium
- unknown generate pdf using contact form 7Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion8.8 High
- unknown generate pdf using contact form 7Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- myeventon eventon, ashanjay eventon – events calendar +1 moreEventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates7.2 High
- cliengo – chatbotWordPress Cliengo – Chatbot plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- pjgalbraith default thumbnail plusDefault Thumbnail Plus <= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- unknown generate pdf using contact form 7WordPress Generate PDF using Contact Form 7 plugin <= 4.1.2 - CSRF to Arbitrary File Upload vulnerability9.6 Critical
- ifm smart plc ac14xx firmware, smart plc ac4xxs firmware +1 moreifm: Hardcoded telnet credentials in Smart PLC9.1 Critical
- ifm smart plc ac14xx firmware, smart plc ac4xxs firmware +1 moreifm: Deleting function in Smart PLC allows command injections7.2 High
- ifm smart plc ac14xx firmware, smart plc ac4xxs firmware +1 moreifm: Writing file function in Smart PLC allows command injections7.2 High
- ifm smart plc ac14xx firmware, smart plc ac4xxs firmware +1 moreifm: Reading function in Smart PLC allows command injections7.2 High
- ifm smart plc ac14xx firmware, smart plc ac4xxs firmware +1 moreifm: Use of Hard-coded Credentials9.8 Critical
- zte zxcloud iraiPermissions and Access Control Vulnerability in ZTE ZXCLOUD IRAI6.3 Medium
- magazine3 easy table of contentsEasy Table of Contents < 2.0.67 - Editor+ Stored XSS6.1 Medium
- mythemeshop url shortener, unknown url shortener by mythemeshop +1 moreURL Shortener by MyThemeShop <= 1.0.17 - Admin+ Stored XSS4.8 Medium
- seopressSEOPress < 7.9 - Unauthenticated Object Injection9.8 Critical
- digireturn dn footer contacts, dn-footer-contacts, footer contacts bar +2 moreDN Footer Contacts < 1.6.3 - Admin+ Stored XSS4.3 Medium
- webnus modern events calendar, modern events calendar lite +1 moreModern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- sap enable now[CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now3.3 Low
- sap se netweaver application server for abap and abap platform, sap basis +1 more[CVE-2024-37180] Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform4.1 Medium
- unitecms unlimited elements for elementor, unlimited-elements unlimited elements for elementor \(free widgets\, addons\, templates\) +1 moreUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'6.4 Medium
- unitecms unlimited elements for elementor, unlimited-elements unlimited elements for elementor \(free widgets\, addons\, templates\) +1 moreUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'6.4 Medium
- plugin devs blog, posts and category filter for elementor, plugin-devs blog\, posts and category filter for elementor +1 moreBlog, Posts and Category Filter for Elementor <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter Widget6.4 Medium
- unitecms unlimited elements for elementor, unlimited-elements unlimited elements for elementor \(free widgets\, addons\, templates\) +1 moreUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection8.8 High
- unitecms unlimited elements for elementor, unlimited-elements unlimited elements for elementor \(free widgets\, addons\, templates\) +1 moreUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass5.3 Medium
- sap se enable now[CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable Now4.3 Medium
- sap se netweaver application server for abap and abap platform, sap basis +1 more[CVE-2024-39599] Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform4.7 Medium
- Show moreLoading…