CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- jeroen schmit theater for wordpressTheater for WordPress <= 0.18.6.2 - Reflected Cross-Site Scripting6.1 Medium
- mdedev run contests, raffles, and giveaways with contestswpRun Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site Scripting6.1 Medium
- greg winiarski wpadverts – classifieds pluginWPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scripting6.1 Medium
- themeum tutor lms, tutor lms – elearning and online course solution +1 moreTutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter7.5 High
- themeum tutor lms, tutor lms – elearning and online course solution +1 moreTutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration5.3 Medium
- taskbuilderTaskbuilder < 3.0.5 - Admin+ SQL Injection4.1 Medium
- strategy11 formidable formsFormidable Forms < 6.14.1 - Admin+ Stored XSS4.8 Medium
- metaphorcreations dittyDitty < 3.1.47 - Author+ Stored XSS4.8 Medium
- unknown alphabetical list, alain gonzalez alphabetical-list +1 moreAlphabetical List <= 1.0.3 - Settings Update via CSRF4.3 Medium
- cminds cm table of contentsCM Table Of Contents – WordPress TOC Plugin < 1.2.4 - Stored XSS via CSRF4.8 Medium
- tinysolutions media library tools, unknown media file rename, find unused file, add alt text, caption, desc for image seo +1 moreMedia Library Tools < 1.5.0 - Author+ Stored XSS via SVG5.4 Medium
- brocade fabric os, broadcom fabric operating system +1 morePrivileged escalation via crafted use of portcfg command8.5 High
- brocade fabric os, broadcom fabric operating system +1 moreSFTP/FTP password could be captured in plain text in Supportsave generated from SANnav5.9 Medium
- bplugins button block, button block – design stylish, interactive, and multi-functional buttons +1 moreButton Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- luydjmi my contador lesrMy Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export4.3 Medium
- elemntor activity log – monitor & record user changes, pojo activity log +1 moreActivity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context7.2 High
- jburleigh1 streamweasels online status barStreamWeasels Online Status Bar <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- blockswp theme builder for elementorTheme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update4.3 Medium
- wpmudev branda – white label & branding, free login page customizerBranda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting6.1 Medium
- ifso if-so dynamic content personalizationIf-So Dynamic Content Personalization <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- enginethemes forumengineForumEngine <= 1.8 - Reflected Cross-Site Scripting6.1 Medium
- kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 moreGutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- broadcom brocade sannav, brocade sannav +1 moreBrocade SANnav Information Disclosure Vulnerability5.7 Medium
- broadcom brocade sannav, brocade sannav +1 moreBrocade Fabric OS switch passwords when debugging is enabled6.8 Medium
- greyowl0015 grey owl lightboxGrey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- markkinchin beds24 online bookingBeds24 Online Booking <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode6.4 Medium
- hedge3 crypto and defi widgets, securityforce crypto and defi widgets – web3 cryptocurrency shortcodes +1 moreCrypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting6.1 Medium
- alexvtn wip incoming liteWIP Incoming Lite <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- krishaweb contact form 7 email add on, email addon for cf7 +1 moreContact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusion8.8 High
- voidcoders wpbakery visual composer whmcs elements, innovs wpbakery visual composer whmcs elements +1 moreWPBakery Visual Composer WHMCS Elements <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode6.4 Medium
- safi-mohammad pure css circle progress barPure CSS Circle Progress bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- f4dev f4 improvementsF4 Improvements <= 1.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- tahmid-ul dino game, tahmidulkarim dino game – embed google chrome dinosaur game in your website +1 moreDino Game – Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- priyajain2802 grid view galleryGrid View Gallery <= 1.0 - Authenticated (Editor+) PHP Object Injection7.2 High
- pengbos slick sitemapSlick Sitemap <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- benhuson page partsPage Parts <= 1.4.3 - Reflected Cross-Site Scripting6.1 Medium
- codeastrology ultraaddons, codersaiful ultraaddons for elementor +1 moreUltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.8 - Insecure Direct Object Reference to Sensitive Informat…4.3 Medium
- emendo seb co-marquage service-public.frCo-marquage service-public.fr <= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameter6.1 Medium
- babatechs lock user accountLock User Account <= 1.0.5 - User Lock Bypass4.2 Medium
- goback2 salavat counter pluginsalavat counter Plugin <= 0.9.4 - Reflected Cross-Site Scripting6.1 Medium
- sabbirislam397 shine pdf embederShine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- alexvtn suevafree essential kitSuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- aishan lazy load videos and sticky controlLazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- codelizarplugs ultimate youtube video & shorts player with vimeo, codelizar ultimate youtube video \& shorts player with vimeo +1 moreUltimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion4.3 Medium
- mainichiweb friendly functions for welcartFriendly Functions for Welcart <= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- mediaticus subaccounts for woocommerceSubaccounts for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting6.1 Medium
- pickplugins product designer for woocommerceProduct Designer <= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- wolfgang include mastodon feedInclude Mastodon Feed <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wproyal bard extraBard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import4.3 Medium
- Show moreLoading…