CVEs published in July 2024
3,166 vulnerabilities, 289 critical, 12 exploited.
- tipsandtricks-hq wp emember, unknown wp-emember +1 moreWP eMember < 10.6.6 - Admin+ Arbitrary File Upload8.8 High
- tipsandtricks-hq wp emember, unknown wp-emember, wpemember +2 moreWP eMember < 10.6.7 - Unauthenticated Stored XSS via Member Registration6.1 Medium
- tips and tricks hq wp emember, unknown wp-emember +1 moreWP eMember < 10.6.6 - Stored XSS in Blacklist via CSRF6.8 Medium
- tipsandtricks-hq wp emember, unknown wp-emember +1 moreWP eMember < 10.6.6 - Bulk Delete via CSRF8.8 High
- tipsandtricks-hq wp emember, unknown wp-emember +1 moreWP eMember < 10.6.6 - Reflected XSS5.9 Medium
- tipsandtricks-hq wp emember, unknown wp-emember +1 moreWP eMember < 10.6.6 - Reflected XSS5.4 Medium
- sullySULly < 4.3.1 - Plugin Reset via CSRF8.8 High
- toolstack sullySULly < 4.3.1 - Admin+ Stored XSS via CSRF5.9 Medium
- toolstack sullySULly < 4.3.1 - Reflected XSS4.7 Medium
- creativemindssolutions search and replace, unknown cm wordpress search and replace plugin, cminds cm search and replace +2 moreCM WordPress Search And Replace Plugin < 1.3.9 - Plugin Reset via CSRF6.5 Medium
- jeff starr user submitted postsUser Submitted Posts < 20240516 - Admin+ Stored XSS4.8 Medium
- anynines mysql, plumislandmedia index wp mysql for speed +1 moreIndex WP MySQL For Speed < 1.4.18 - Admin+ Reflected XSS6.8 Medium
- ashanjay eventonEventON < 2.2.15 - Admin+ Stored Cross-Site Scripting via event subtitle5.9 Medium
- info-d-74 embed peertube playlistEmbed Peertube Playlist < 1.10 - Editor+ Stored XSS5.4 Medium
- sayedulsayem support svg, support svg wordpress +1 moreSupport SVG < 1.1.0 - Stored XSS via SVG Upload6.1 Medium
- boldblocks svg blockSVG Block < 1.1.20 - Author+ Stored XSS via SVG File Upload6.1 Medium
- getshortcodes shortcodes ultimate, unknown shortcodes-ultimate-pro +1 moreShortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS4.7 Medium
- gravitymaster product enquiry for woocommerceProduct Enquiry for WooCommerce < 3.1.8 - Admin+ Stored XSS5.9 Medium
- rafflepress giveaways and contests by rafflepress, rafflepress +1 moreRafflePress Lite < 1.12.14 - Editor+ Stored XSS6.5 Medium
- arnesonium openpgp form encryption, unknown openpgp form encryption for wordpress +1 moreOpenPGP Form Encryption for WordPress < 1.5.1 - Contributor+ Stored XSS4.6 Medium
- kibokolabs hostelHostel < 1.1.5.3 - Reflected XSS5.9 Medium
- castos seriously simple podcastingSeriously Simple Podcasting < 3.3.0 - Admin+ Stored XSS4.8 Medium
- machothemes image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid < 3.6.0 - Contributor+ Stored XSS6.8 Medium
- codepeople smart image gallerySmart Image Gallery < 1.0.19 - Update/Delete Google API Key via CSRF6.8 Medium
- maxfoundry maxbuttons, wordpress button plugin maxbuttons +1 moreWordPress Button Plugin MaxButtons < 9.7.8 - Editor+ Stored XSS5.4 Medium
- socialdriver framework framework, swiftideas swift framework, unknown socialdriver-framework +2 moreSwift Framework < 2024.04.30 - Reflected XSS6.1 Medium
- stijnvanderree laposta, laposta signup basic +1 moreLaposta <= 1.12 - Unauthenticated Full Path Disclosure5.3 Medium
opensslOSS-FuzzNull-dereference READNo scorelibavcOSS-FuzzHeap-buffer-overflow in ih264d_format_convertNo scorelibavcOSS-FuzzHeap-buffer-overflow in ih264d_format_convertNo scoreopensslOSS-FuzzNull-dereference READ in evp_mac_finalNo scoreopensslOSS-FuzzNull-dereference READ in do_evp_kdfNo scorelibxml2OSS-FuzzHeap-buffer-overflow in htmlCurrentCharNo score- monsterinsights userfeedback, smub userfeedback – create interactive feedback form, user surveys, and polls in seconds +1 moreUserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter7.2 High
cipherbcryptPyPIMalware package cipherbcryptNo score- silabs bluetooth low energy software development kit, silabs.com simplicity sdk +1 moreLoss of confidentiality due to potential race condition in Bluetooth controller Connection_Handle reuse3.1 Low
- ibm infosphere server, infosphere information server +1 moreIBM InfoSphere Server cross-site scripting5.4 Medium
- rocket.chatLivechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken...6.5 Medium
- neutrinolabs xrdpxrdp allows an ininite number of login attempts7.2 High
- realtyna organic idx plugin, organic idx +1 moreWordPress Realtyna Organic IDX plugin <= 4.14.13 - Arbitrary File Upload vulnerability9.1 Critical
- bastien ho event postWordPress Event post plugin <= 5.9.5 - Local File Inclusion vulnerability7.5 High
- spreadsheetconverter import spreadsheets from microsoft excel, import spreadsheets +1 moreWordPress Import Spreadsheets from Microsoft Excel plugin <= 10.1.4 - Arbitrary File Upload vulnerability9.1 Critical
- booking ultra pro ultra pro, deetronix booking ultra pro +1 moreWordPress Booking Ultra Pro Appointments Booking Calendar plugin <= 1.1.13 - Local File Inclusion vulnerability7.1 High
- blue plugins events calendar for googleWordPress Events Calendar for Google plugin <= 2.1.0 - Local File Inclusion vulnerability6.5 Medium
- fogprojectNFS server misconfiguration allows file access outside the exported directory6.4 Medium
- fogprojectFOG has a command injection in /fog/management/export.php?filename=9.8 Critical
- widgetti solaraLocal File Inclusion in Solara8.6 High
- exs widgetsWordPress ExS Widgets plugin <= 0.3.1 - Local File Inclusion vulnerability6.5 Medium
- milan petrovic gd rating systemWordPress GD Rating System plugin <= 3.6 - Local File Inclusion vulnerability5.3 Medium
- devitems ht megaWordPress HT Mega plugin <= 2.5.7 - JSON Path Traversal vulnerability6.5 Medium
- Show moreLoading…