CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- david de boer paytium: mollie payment forms & donations, paytium +1 morePaytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_account'7.1 High
- andrew shopwpShopWP <= 2.0.4 - Missing Authorization to Stored Cross-Site Scripting7.2 High
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation8.8 High
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update6.5 Medium
- david de boer paytium: mollie payment forms & donations, paytium +1 morePaytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_for_verified_profiles'4.3 Medium
- wordpressWordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function4.9 Medium
- wpindeed indeed membership proIndeed Membership Pro 7.3 - 8.6 - Missing Authorization Checks6.3 Medium
- mainwp dashboard, dashboard: self-hosted wordpress management for agencies +1 moreMainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scripting7.2 High
- david de boer paytium: mollie payment forms & donations, paytium +1 morePaytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_sw_save_api_keys'5.4 Medium
- wp chill download monitorDownload Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Export7.5 High
- wpindeed indeed membership pro, ultimate membership pro +1 moreIndeed Membership Pro 7.3 - 8.6 - Authentication Bypass9.8 Critical
- filemanagerpro file managerFile Manager <= 3.0 - Unauthenticated Arbitrary File Upload/Download9.8 Critical
- bqworks accordion sliderAccordion Slider <= 1.9.11 - Authenticted (Contributor+) Stored Cross-Site Scripting via HTML Attribute6.4 Medium
- pickplugins post gridPost Grid <= 2.1.12 - Contributor+ SQL Injection8.8 High
- wpvivid migration\, backup\, staging, wpvividplugins wpvivid — backup, migration & staging +1 moreMigration, Backup, Staging – WPvivid <= 0.9.35 - Sensitive Information Disclosure4.9 Medium
- strategy11 formidable form builder, formidable forms, strategy11team formidable forms – contact form plugin, survey, quiz, payment, calculator form & custom form builder +2 moreFormidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting8.3 High
- file manager pro, filemanagerpro file manager, file manager pro +2 moreFile Manager Pro <= 8.3.9 - Unauthenticated Backup File Download and Upload7.5 High
- heateor sassy social share, social sharing plugin – sassy social share +1 moreSassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting6.1 Medium
- themegrill demo importerThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset9.9 Critical
- wpfastestcache wp fastest cache, emrevona wp fastest cache – wordpress cache plugin +1 moreWP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion8.0 High
- ari-soft ari adminer, arisoft ari adminer – wordpress database manager +1 moreARI-Adminer <= 1.1.14 - Missing Authorization and No Direct File Access Restrictions7.3 High
- siteground speed optimizer – the all-in-one performance-boosting plugin, speed optimizer +1 moreSiteGround Optimizer <= 5.0.12 - Missing Authorization9.8 Critical
- mapplic, mapplic lite, sekler mapplic lite +1 more +3 moreMapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting8.3 High
- podpirate acf quick edit fieldsACF Quick Edit Fields <= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference6.5 Medium
- advanced access manager project access manager, vasyltech advanced access manager, advanced access manager – access governance for wordpress +2 moreAdvanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read9.8 Critical
- kaswara project kaswara, sayenthemes kaswara modern vc addons +1 moreKaswara Modern VC Addons <= 3.0.1 - Missing Authorization7.3 High
- kentothemes kento-post-view-counterKento Post View Counter <= 2.8 - SQL Injection9.8 Critical
- 5starplugins easy age verify, featured images in rss for mailchimp & more, marijuana age verify +619 more +621 moreFreemius SDK <= 2.4.2 - Missing Authorization Checks6.3 Medium
- nextscripts nextscripts: social networks auto-poster, social networks auto poster +1 moreNextScripts: Social Networks Auto-Poster <= 4.3.17 - Missing Authorization5.0 Medium
- facebook chat plugin – live chat plugin for wordpressFacebook Chat Plugin <= 1.5 - Missing Capabilities Check7.4 High
- flycart discount rules for woocommerceDiscount Rules for WooCommerce <= 2.0.2 - Missing Authorization6.3 Medium
- david de boer paytium: mollie payment forms & donations, paytium +1 morePaytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'update_profile_preference'5.4 Medium
- woobewoo product filter, unknown product filter for woocommerce by wbw +1 moreProduct Filter by WooBeWoo <= 1.4.9 - Missing Authorization7.3 High
- digitalzoomstudio zoomsounds, zoomit zoomsounds - wordpress wave audio player with playlist +1 moreZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload9.8 Critical
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor <= 4.6.4 - Missing Authorization6.3 Medium
- david de boer paytium: mollie payment forms & donations, paytium +1 morePaytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'pt_cancel_subscription'5.4 Medium
- nintechnet ninjafirewall, ninjatechnologiesnetwork ninja firewall, nintechnet ninjafirewall (wp edition) – advanced security plugin and firewall +2 moreNinjaFirewall <= 4.3.3 - Authenticated PHAR Deserialization6.6 Medium
- file manager pro, filemanagerpro file manager, file manager pro +2 moreFile Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File Upload7.4 High
- quadlayers quadmenu – mega menu, wordpress mega menu-quadmenu +1 moreWordPress Mega Menu <= 2.0.6 - Arbitrary File Creation9.8 Critical
- prasidhda woo manage fraud ordersWoo Manage Fraud Orders <= 2.6.1 - Reflected Cross-Site Scripting6.1 Medium
- element invader elementinvader addons for elementor, elementinvader addons for elementor +1 moreElementInvader Addons for Elementor <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- peepso community by peepso – download from peepso.comCommunity by PeepSo <= 6.4.6.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting5.4 Medium
- tecno com.transsion.aivoiceassistantImproper permission control in the mobile application (com.transsion.aivoiceassistant) can lead...9.8 Critical
- tophive ultimate aiUltimateAI <= 2.8.3 - Authentication Bypass9.8 Critical
- givewp, stellarwp givewp – donation plugin and fundraising platform, webdevmattcrom givewp donation plugin and fundraising platform +2 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution9.8 Critical
- tkama kama spamblockKama SpamBlock <= 1.8.2 - Reflected Cross-Site Scripting6.1 Medium
- plainware locatoraid store locatorLocatoraid Store Locator <= 3.9.47 - Reflected Cross-Site Scripting6.1 Medium
- zluck multiline files for contact form 7Multiline files upload for contact form 7 <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation4.3 Medium
- wpulike wp ulike, alimir wp ulike – like & dislike buttons for engagement and feedback +1 moreWP ULike <= 4.7.4 - Cross-Site Request Forgery to Statistic Deletion4.3 Medium
- apppresser, scottopolis apppresser – mobile app framework +1 moreAppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP8.1 High
- Show moreLoading…