CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- saad iqbal user managementWordPress User Management plugin <= 1.1 - Arbitrary File Upload vulnerability9.9 Critical
- bigfive cf7 reply manager, contact form 7 +1 moreWordPress CF7 Reply Manager plugin <= 1.2.3 - Arbitrary File Upload vulnerability9.9 Critical
- bikram joshi b-banner sliderWordPress B-Banner Slider plugin <= 1.1 - Arbitrary File Upload vulnerability9.9 Critical
- wibergs web csv to html, cvs to html +1 moreWordPress CSV to html plugin <= 3.26 - Arbitrary File Upload vulnerability9.9 Critical
- basepress migration tools, codesavory basepress migration tools +1 moreWordPress BasePress Migration Tools plugin <= 1.0.0 - Arbitrary File Upload vulnerability9.9 Critical
- pushassist push notifications for wordpress by pushassist, push notifications +1 moreWordPress Push Notifications for WordPress by PushAssist plugin <= 3.0.8 - Arbitrary File Upload vulnerability9.9 Critical
- ajax-random-post project ajax-random-post, phan an ajax random posts +1 moreWordPress AJAX Random Posts plugin <= 0.3.3 - PHP Object Injection vulnerability9.8 Critical
- phoenixheart referrer detectorWordPress Referrer Detector plugin <= 4.2.1.0 - PHP Object Injection vulnerability9.8 Critical
- flowcraft advanced personalizationWordPress Advanced Personalization plugin <= 1.1.2 - PHP Object Injection vulnerability9.8 Critical
- stephen cui xinWordPress Xin theme <= 1.0.8.1 - PHP Object Injection vulnerability9.8 Critical
- dmc airin blogWordPress Airin Blog theme <= 1.6.1 - PHP Object Injection vulnerability9.8 Critical
- anthony carbon wdes responsive mobile menuWordPress WDES Responsive Mobile Menu plugin <= 5.3.18 - PHP Object Injection vulnerability9.8 Critical
- radiustheme classified listingWordPress Classified Listing plugin <= 3.1.16 - Local File Inclusion vulnerability5.3 Medium
- skipstorm sk wp settings backupWordPress SK WP Settings Backup plugin <= 1.0 - CSRF to PHP Object Injection vulnerability8.8 High
- eugen bobrowski debug toolWordPress Debug Tool plugin <= 2.2 - Remote Code Execution vulnerability10.0 Critical
sharkscrates.ioSharks has a Bias of Polynomial Coefficients in Secret Sharing6.0 Medium- aaron13100 404 solution404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure5.3 Medium
- mapster wp mapsMapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- cyberlord92 login using wordpress users, saml idp (identity provider) – login with website users +1 moreLogin using WordPress Users ( WP as SAML IDP ) <= 1.15.6 - Authenticated (Administrator+) SQL Injection7.2 High
- sudiptomahato blogger 301 redirectBlogger 301 Redirect <= 2.5.3 - Unauthenticated SQL Injection via br7.5 High
- cusrev customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation4.3 Medium
- revmakx backup and staging by wp time capsuleBackup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload9.8 Critical
- wpxpo postx, post grid gutenberg blocks for news, magazines, blog websites – postx, postx - gutenberg blocks for post grid +2 morePostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation8.8 High
- ninjateam wp chat appWP Chat App <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation4.3 Medium
- uiuxlab uix slideshowUix Slideshow <= 1.6.5 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- stevehenty drop shadow boxesDrop Shadow Boxes <= 1.7.14 - Authenticated (Subscriber+) Arbitrary Shortcode Execution6.3 Medium
- pepro dev. group peprodev woocommerce receipt uploader, peprodev woocommerce receipt uploader +1 morePeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting6.1 Medium
- maxwellberkel wp log viewerWP Log Viewer <= 1.2.1 - Missing Authorization5.4 Medium
- kasperta bounce handler mailpoet 3Bounce Handler MailPoet 3 <= 1.3.21 - Reflected Cross-Site Scripting6.1 Medium
- augustinfotech svg case studySVG Case Study <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- cscode eleforms – all in one form integration including db for elementor, theinnovs eleforms +1 moreEleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Cross-Site Request Forgery4.3 Medium
- jorisderuiter convertcalculator: build cost, price, quotation, roi interactive calculatorsConvertCalculator for WordPress <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and type Parameter6.4 Medium
- engelen bulkpressBulkPress <= 0.3.5 - Reflected Cross-Site Scripting6.1 Medium
- starverte steelSteel <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn Shortcode6.4 Medium
- wpmariocom exclusive divi – divi preloader, modules for divi & extra themeExclusive Divi – Divi Preloader, Modules for Divi & Extra Theme <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- petrichorpost svgplusSVGPlus <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- bilbud 404 error monitor404 Error Monitor <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update via updatePluginSettings Function5.3 Medium
- dhoppe gallery managerGallery Manager <= 1.6.58 - Reflected Cross-Site Scripting6.1 Medium
- redefiningtheweb pdf generator addon for elementor page builder, pdf generator for wordpress elementor +1 morePDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download7.5 High
- pressaholic wordpress video robot - the ultimate video importer, wordpress video robot +1 moreWP Video Robot <= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update8.8 High
- westi pjw mime configPJW Mime Config <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- creativeinteractivemedia real3d flipbook, real 3d flipbook – 3d flipbook, pdf flipbook, pdf viewer, pdf embedder +1 moreReal3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder <= 4.8 - Authenticated (Author+) Arbitrary File Upload8.8 High
- simpleform contact form submissionsSimpleForm Contact Form Submissions <= 2.1.0 - Reflected Cross-Site Scripting6.1 Medium
- simpleform, simpleform – contact form made simple +1 moreSimpleForm – Contact form made simple <= 2.2.0 - Reflected Cross-Site Scripting6.1 Medium
- 10up simple local avatarsSimple Local Avatars <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing4.3 Medium
- ays-pro popup box – create countdown, coupon, video, contact form popups, popup box +1 morePopup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 4.9.7 - Missing Authorization to Unauthenticated Limited Options Update5.3 Medium
- themes4wp popularis extraPopularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- zephyrproject zephyrarch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y9.4 Critical
- phpgurukul student record management systemSourceCodester Student Record Management System View All Student Marks main stack-based overflow4.8 Medium
- google androidIn ElementaryStreamQueue::dequeueAccessUnitMPEG4Video of ESQueue.cpp, there is a possible...6.5 Medium
- Show moreLoading…