CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- streamweasels youtube integrationStreamWeasels YouTube Integration <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode6.4 Medium
- streamweasels kick integrationSW Kick Integration - Blocks and Shortcodes for Embedding Kick Streams <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed Shortcode6.4 Medium
- wpkoi templates for elementor, wpkoithemes wpkoi templates for elementor +1 moreWordPress WPKoi Templates for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- affiliatexblocks affiliatexWordPress AffiliateX plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bob namaste! lms, kibokolabs namaste\! lms +1 moreWordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- bob namaste! lms, kibokolabs namaste\! lms +1 moreWordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bob namaste! lms, kibokolabs namaste\! lms +1 moreWordPress Namaste! LMS plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- litespeed technologies cache, litespeedtech litespeed cache +1 moreWordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability8.1 High
- wpclever wpc smart messages for woocommerceWPC Smart Messages for WooCommerce <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation4.3 Medium
- cservit affiliate-toolkit – multi-network affiliate & amazon product displayaffiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode6.4 Medium
- climaxthemes kata plus – addons for elementor – widgets, extensions and templatesKata Plus – Addons for Elementor – Widgets, Extensions and Templates <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- wpclever wpc smart messages for woocommerceWPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion8.8 High
- zte zxr10 1800-2s, zxr10 160 firmware, zxr10 1800-2s firmware +2 more +4 moreThere is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service...7.5 High
- apache nifiApache NiFi: Improper Neutralization of Input in Parameter Description4.6 Medium
- rafasashi todo custom fieldWordPress Todo Custom Field plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- kevon adonis wp abstractsWordPress WP Abstracts plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- jules colle conditional fields for contact form 7WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- carazo import and export users and customersWordPress Import and export users and customers plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- buttonizer button contact vrWordPress Button contact VR plugin <= 4.7.9.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- pagup ads.txt & app-ads.txt manager for wordpressWordPress Ads.txt & App-ads.txt Manager for WordPress plugin <= 1.1.7.1 - Stored Cross Site Scripting (XSS) vulnerability5.9 Medium
- time slot booking slotWordPress Time Slot plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ays pro survey makerWordPress Survey Maker plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- scott gamon signup pageWordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerability9.8 Critical
- grun software group spendino spendenformularWordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability9.8 Critical
- stack themes bstone demo importerWordPress Bstone Demo Importer plugin <= 1.0.1 - Privilege Escalation vulnerability8.8 High
- udit rawat exam matrixWordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerability9.8 Critical
- lowcage pegapollWordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerability9.8 Critical
- adirectoryWordPress aDirectory plugin <= 1.3 - Arbitrary File Upload vulnerability10.0 Critical
- devsoft baltic surveyjsWordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability9.9 Critical
- ifeelweb post status notifier, worschtebrot post status notifier lite +1 morePost Status Notifier Lite and Premium <= 1.11.6 - Reflected Cross-Site Scripting via page6.1 Medium
- seur oficial oficial, seuroficial seur oficial +1 moreSEUR Oficial <= 2.2.11 - Reflected Cross-Site Scripting6.1 Medium
- ajar productions in5 embedWordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability10.0 Critical
- mattermost, mattermost server +1 moreClient-Side Path Traversal Leading to CSRF in Playbooks4.6 Medium
- mattermost, mattermost server +1 moreDoS via Amplified GraphQL Response in Playbooks4.3 Medium
- mattermost, mattermost server +1 moreArbitrary post deletion via Playbooks /ignore-thread endpoint4.3 Medium
- mattermost, mattermost server +1 morePrivate channel names leaked with Ctrl+K when ElasticSearch is enabled4.3 Medium
- azexo marketing automation by azexoWordPress Marketing Automation by AZEXO plugin <= 1.27.80 - Arbitrary File Upload vulnerability9.9 Critical
- chetan khandla woocommerce product designWordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability10.0 Critical
- lindeni mahlalela multi purpose mail formWordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability10.0 Critical
- masterhomepage automatic translationWordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability10.0 Critical
- amin omer sudan payment gateway for woocommerce, wc sudan payment gateway +1 moreWordPress Sudan Payment Gateway for WooCommerce plugin <= 1.2.2 - Arbitrary File Upload vulnerability10.0 Critical
- exclusiveaddons exclusive addons for elementorExclusive Addons for Elementor <= 2.7.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates4.3 Medium
- masteriyo, masteriyo lms – online course builder for elearning, lms & education +1 moreMasteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality6.4 Medium
- masteriyo, masteriyo lms – online course builder for elearning, lms & education +1 moreMasteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation8.8 High
- zte mf258 pro, mf258 pro firmware, mf258k pro firmware +2 moreZTE MF258 Pro product has a OS Command injection vulnerability6.8 Medium
- linzhaoguan pb-cmsLinZhaoguan pb-cms Theme Management Module admin#themes cross site scripting5.1 Medium
- linux, linux kernel +1 morebtrfs: fix uninitialized pointer free in add_inode_ref()7.8 High
- linux, linux kernel +1 morebtrfs: fix uninitialized pointer free on read_alloc_one_name() error7.8 High
- linux, linux kernel +1 moreksmbd: fix user-after-free from session log off9.8 Critical
- linux, linux kernel +1 moremptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow9.8 Critical
- Show moreLoading…