CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- gabriele valenti telecash ricaricawebWordPress Telecash Ricaricaweb plugin <= 2.2 - PHP Object Injection vulnerability9.8 Critical
- al imran akash recentlyWordPress Recently plugin <= 1.1 - PHP Object Injection vulnerability9.8 Critical
- taketin to wp membershipWordPress TAKETIN To WP Membership plugin <= 2.8.17 - PHP Object Injection vulnerability8.8 High
- foter free stock photos foterWordPress Free Stock Photos Foter plugin <= 1.5.4 - PHP Object Injection vulnerability8.8 High
- sunjianle ajax-extend, ajax extend +1 moreWordPress ajax-extend plugin <= 1.0 - Remote Code Execution (RCE) vulnerability10.0 Critical
- litespeed technologies cache, litespeedtech litespeed cache +1 moreWordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability8.8 High
- james park analyse uploadsWordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerability8.6 High
- thatplugin iconizeWordPress Iconize plugin <= 1.2.4 - Remote Code Execution (RCE) vulnerability9.1 Critical
- xaraartech external featured image from bingWordPress External featured image from bing plugin <= 1.0.2 - Remote Code Execution (RCE) vulnerability9.9 Critical
- takayuki imanishi acf images search and insertWordPress ACF Images Search And Insert plugin <= 1.1.4 - Arbitrary File Upload vulnerability9.9 Critical
- bdtask pharmacy management systemcode-projects Pharmacy Management System manage_medicine_stock.php sql injection5.3 Medium
- bdtask pharmacy management systemcode-projects Pharmacy Management System add_new_medicine.php sql injection5.3 Medium
- supsystic contact form by supsystic, contact form +1 moreWordPress Contact Form by Supsystic plugin <= 1.7.28 - Remote Code Execution (RCE) vulnerability9.1 Critical
- denis azz anonim postingWordPress Azz Anonim Posting plugin <= 0.9 - Arbitrary File Upload vulnerability10.0 Critical
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates), unlimited-elements unlimited elements for elementor +1 more +3 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.121 - Remote Code Execution (RCE) vulnerability9.1 Critical
- woocommerce smart couponsWooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation5.3 Medium
- oc2ps better-bp-registration, sk buddypress better registration +1 moreWordPress BuddyPress Better Registration plugin <= 1.6 - Broken Authentication vulnerability9.8 Critical
- bdtask pharmacy management systemcode-projects Pharmacy Management System manage_supplier.php sql injection5.3 Medium
- bdtask pharmacy management systemcode-projects Pharmacy Management System manage_purchase.php sql injection5.3 Medium
- dassault systèmes 3dswymerAuthorization Bypass Through User-Controlled Key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x7.7 High
- dassault systèmes enovia collaborative industry innovator, 3ds 3dexperience enovia +1 moreReflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x8.7 High
- wpzita zita site library for elementorZita Elementor Site Library <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- quomodosoft elementsready, elementsready addons for elementor +1 moreElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- google migrate to containersInsecure user permissions in Google Cloud Migrate to Containers for Windows5.9 Medium
- apache cloudstackApache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure8.5 High
- apache cloudstack, apache software foundation cloudstack quota plugin +1 moreApache CloudStack Quota plugin: Access checks not enforced in Quota5.7 Medium
- apache cloudstackApache CloudStack: Incomplete session invalidation on web interface logout6.3 Medium
- apache cloudstackApache CloudStack: Request origin validation bypass makes account takeover possible8.0 High
- apache solrApache Solr: ConfigSets created during a backup restore command are trusted implicitly8.1 High
- apache solrApache Solr: Authentication bypass possible using a fake URL Path ending9.8 Critical
- nik00726 video gridVideo Grid <= 1.21 - Reflected Cross-Site Scripting6.1 Medium
- wpvivid migration\, backup\, staging, wpvividplugins wpvivid — backup, migration & staging +1 moreMigration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- shaonsina sina extension for elementorSina Extension for Elementor <= 3.5.7 - Authenticated (Contributor+) Sensitive Information Exposure via Sina Modal Box Widget Elementor Template4.3 Medium
- strategy11 formidable form builder, formidable forms, strategy11team formidable forms – contact form plugin, survey, quiz, payment, calculator form & custom form builder +2 moreFormidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure5.3 Medium
- gtranslate google language translator, edo888 translate wordpress – google language translator +1 moreGoogle Language Translator <= 6.0.9 - Reflected Cross-Site Scripting7.1 High
- woo product vendorsProduct Vendors <= 2.0.35 - Reflected Cross Site Scripting4.7 Medium
- bigbluebuttonBigBlueButton <= 3.0.0-beta.4 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- jetmonsters timetable and event schedule by motopress, motopress timetable and event schedule +1 moreTimetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization7.3 High
- themehunk wp popup builder – popup forms and marketing lead generation, wp popup builder +1 moreWP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add7.3 High
- najeebmedia frontend file manager, n-media post front-end form, post front-end form +1 more +3 moreFrontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload9.8 Critical
- solarwinds serv-uSolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability7.5 High
- solarwinds serv-uSolarWinds Serv-U Stored XSS Vulnerability4.8 Medium
- solarwinds platformSolarWinds Platform Edit Function Cross-Site Scripting Vulnerability7.1 High
- solarwinds platformSolarWinds Platform Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.8 High
- david de boer paytium: mollie payment forms & donations, paytium +1 morePaytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_profile'7.1 High
- david de boer paytium: mollie payment forms & donations, paytium +1 morePaytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_mollie_account_details'4.3 Medium
- david de boer paytium: mollie payment forms & donations, paytium +1 morePaytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'paytium_notice_dismiss'4.3 Medium
- bc2018 wordpress landing page – squeeze page – responsive landing page builder free – wp lead plus xWP Lead Plus X <= 0.99 - Cross-Site Request Forgery8.3 High
- file manager pro, filemanagerpro file manager, ninja team file manager pro +2 moreFile Manager Pro <= 8.3.9 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- starfish rich review, starfishwp rich reviews by starfish +1 moreRich Reviews <= 1.7.4 - Stored Cross-Site Scripting7.2 High
- Show moreLoading…