CVE-2024-30xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

726 records · Page 3 of 8

• CVE-2024-30567: An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via the Network Troubleshooting functionality. 6.3 Medium

  An issue in JNT Telecom JNT Liftcom UMS V1.J Core Version JM-V15 allows a remote attacker to execute arbitrary code via the Network Troubleshooting functionality.

  Updated 2024-08-02
• CVE-2024-30565: An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php. 8.8 High

  An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php.

  Updated 2024-08-28
• CVE-2024-30564: An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of t 9.8 Critical

  An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method.

  Updated 2024-08-22
• CVE-2024-30561: WordPress Appointment Calendar plugin <= 2.9.6 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scientech It Solution Appointment Calendar allows Reflected XSS.This issue affects Appointment Calendar: from n/a through 2.9.6.

  Updated 2026-04-28
• CVE-2024-30560: WordPress DX-Watermark plugin <= 1.0.4 - CSRF to Arbitrary File Upload and XSS vulnerability 9.6 Critical

  Cross-Site Request Forgery (CSRF) vulnerability in 大侠WP DX-Watermark.This issue affects DX-Watermark: from n/a through 1.0.4.

  Updated 2026-04-28
• CVE-2024-30559: WordPress Spin 360 deg and 3D Model Viewer plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maurice Spin 360 deg and 3D Model Viewer allows Stored XSS.This issue affects Spin 360 deg and 3D Model Viewer: from n/a through 1.2.7.

  Updated 2026-04-28
• CVE-2024-30558: WordPress Add Shortcodes Actions And Filters plugin <= 2.10 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Simpson Add Shortcodes Actions And Filters allows Reflected XSS.This issue affects Add Shortcodes Actions And Filters: from n/a through 2.10.

  Updated 2026-04-28
• CVE-2024-30557: WordPress Aesop Story Engine plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aesopinteractive Aesop Story Engine allows Stored XSS.This issue affects Aesop Story Engine: from n/a through 2.3.2.

  Updated 2026-04-28
• CVE-2024-30556: WordPress Mighty Classic Pros And Cons plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MightyThemes Mighty Classic Pros And Cons allows Stored XSS.This issue affects Mighty Classic Pros And Cons: from n/a through 2.0.9.

  Updated 2026-04-28
• CVE-2024-30555: WordPress Ultimate Social Comments plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayan Datta Ultimate Social Comments – Email Notification & Lazy Load allows Stored XSS.This issue affects Ultimate Social Comments – Email Notification & Lazy Load: from n/a through 1.4.8.

  Updated 2026-04-28
• CVE-2024-30554: WordPress DD Rating plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wouter Dijkstra DD Rating allows Stored XSS.This issue affects DD Rating: from n/a through 1.7.1.

  Updated 2026-04-28
• CVE-2024-30553: WordPress WP Twitter Mega Fan Box Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joby Joseph WP Twitter Mega Fan Box Widget allows Stored XSS.This issue affects WP Twitter Mega Fan Box Widget : from n/a through 1.0.

  Updated 2026-04-28
• CVE-2024-30552: WordPress Responsive flipbook plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wppdf.Org Responsive flipbook allows Stored XSS.This issue affects Responsive flipbook: from n/a through 1.0.0.

  Updated 2026-04-28
• CVE-2024-30551: WordPress Sticky Anything plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Sticky Anything.This issue affects Sticky Anything: from n/a through 2.1.5.

  Updated 2026-04-28
• CVE-2024-30550: WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Reflected XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

  Updated 2026-04-28
• CVE-2024-30549: WordPress Contact Forms by Cimatti plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cimatti Contact Forms by Cimatti contact-forms.This issue affects Contact Forms by Cimatti: from n/a through <= 1.8.0.

  Updated 2026-04-28
• CVE-2024-30548: WordPress underConstruction plugin <= 1.21 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Kagan underConstruction allows Stored XSS.This issue affects underConstruction: from n/a through 1.21.

  Updated 2026-04-28
• CVE-2024-30547: WordPress Header Image Slider plugin <= 0.3 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shazdeh Header Image Slider header-image-slider allows DOM-Based XSS.This issue affects Header Image Slider: from n/a through 0.3.

  Updated 2026-04-28
• CVE-2024-30546: WordPress Login With Ajax plugin <= 4.1 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Login With Ajax.This issue affects Login With Ajax: from n/a through 4.1.

  Updated 2026-04-28
• CVE-2024-30545: WordPress Social Author Bio plugin <= 2.4 - Stored XSS via Cross Site Request Forgery (CSRF) vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Nick Powers Social Author Bio allows Stored XSS.This issue affects Social Author Bio: from n/a through 2.4.

  Updated 2026-04-28
• CVE-2024-30544: WordPress Whizzy plugin <= 1.1.18 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in UPQODE Whizzy.This issue affects Whizzy: from n/a through 1.1.18.

  Updated 2026-04-28
• CVE-2024-30543: WordPress Whizzy plugin <= 1.1.18 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.

  Updated 2026-04-28
• CVE-2024-30542: WordPress WholesaleX plugin <= 1.3.2 - Unauthenticated Privilege Escalation vulnerability 9.8 Critical

  Improper Privilege Management vulnerability in Wholesale WholesaleX allows Privilege Escalation.This issue affects WholesaleX: from n/a through 1.3.2.

  Updated 2026-04-28
• CVE-2024-30541: WordPress LWS Optimize plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Optimize.This issue affects LWS Optimize: from n/a through 1.9.1.

  Updated 2026-04-28
• CVE-2024-30540: WordPress VS Contact Form plugin <= 14.7 - Sum Captcha Bypass vulnerability 5.3 Medium

  Guessable CAPTCHA vulnerability in Guido VS Contact Form allows Functionality Bypass.This issue affects VS Contact Form: from n/a through 14.7.

  Updated 2026-04-28
• CVE-2024-30539: WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.

  Updated 2026-04-28
• CVE-2024-30538: WordPress DELUCKS SEO plugin <= 2.5.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in DELUCKS GmbH DELUCKS SEO.This issue affects DELUCKS SEO: from n/a through 2.5.4.

  Updated 2026-04-28
• CVE-2024-30537: WordPress WPC Badge Management for WooCommerce plugin <= 2.4.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0.

  Updated 2026-04-28
• CVE-2024-30536: WordPress Slugs Manager plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Slugs Manager.This issue affects Slugs Manager: from n/a through 2.6.7.

  Updated 2026-04-28
• CVE-2024-30535: WordPress Easy Form Builder plugin <= 3.7.4 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhiteStudio Easy Form Builder.This issue affects Easy Form Builder: from n/a through 3.7.4.

  Updated 2026-04-28
• CVE-2024-30534: WordPress Calendarista Basic Edition plugin <= 3.0.5 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.5.

  Updated 2026-05-11
• CVE-2024-30533: WordPress Layouts for Elementor plugin < 1.8 - Arbitrary File Upload vulnerability 7.5 High

  Unrestricted Upload of File with Dangerous Type vulnerability in Techeshta Layouts for Elementor.This issue affects Layouts for Elementor: from n/a before 1.8.

  Updated 2026-04-28
• CVE-2024-30532: WordPress Builderall Builder for WordPress plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability 4.9 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Builderall Team Builderall Builder for WordPress.This issue affects Builderall Builder for WordPress: from n/a through 2.0.1.

  Updated 2026-04-28
• CVE-2024-30531: WordPress Nelio Content plugin <= 3.2.0 - Server Side Request Forgery (SSRF) vulnerability 4.9 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content.This issue affects Nelio Content: from n/a through 3.2.0.

  Updated 2026-04-28
• CVE-2024-30530: WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.1.

  Updated 2026-04-28
• CVE-2024-30529: WordPress Tainacan plugin <= 0.20.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: from n/a through <= 0.20.7.

  Updated 2026-04-28
• CVE-2024-30528: WordPress Spiffy Calendar plugin <= 4.9.10 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar.This issue affects Spiffy Calendar: from n/a through 4.9.10.

  Updated 2026-04-28
• CVE-2024-30527: WordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerability 7.5 High

  Improper Validation of Specified Quantity in Input vulnerability in Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) allows Manipulating Hidden Fields.This issue affects WP Express Checkout (Accept PayPal Payments): from n/a through 2.3.7.

  Updated 2026-04-28
• CVE-2024-30526: WordPress Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin <= 6.5.6 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Easy Social Feed.This issue affects Easy Social Feed: from n/a through 6.5.6.

  Updated 2026-04-28
• CVE-2024-30525: WordPress Move Addons for Elementor plugin <= 1.2.9 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in moveaddons Move Addons for Elementor.This issue affects Move Addons for Elementor: from n/a through 1.2.9.

  Updated 2026-04-28
• CVE-2024-30524: WordPress PDF Viewer for Elementor plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedLettuce Plugins PDF Viewer for Elementor allows Stored XSS.This issue affects PDF Viewer for Elementor: from n/a through 2.9.3.

  Updated 2026-04-28
• CVE-2024-30523: WordPress Paid Memberships Pro – Mailchimp Add On plugin <= 2.3.4 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Mailchimp Add On pmpro-mailchimp.This issue affects Paid Memberships Pro – Mailchimp Add On: from n/a through 2.3.4.

  Updated 2026-04-28
• CVE-2024-30522: WordPress Newsletter plugin <= 8.2.0 - IP Blacklist Bypass vulnerability 5.3 Medium

  Authentication Bypass by Spoofing vulnerability in Stefano Lissa & The Newsletter Team Newsletter allows Functionality Bypass.This issue affects Newsletter: from n/a through 8.2.0.

  Updated 2026-04-28
• CVE-2024-30521: WordPress Landingi Landing Pages plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Landingi Landingi Landing Pages.This issue affects Landingi Landing Pages: from n/a through 3.1.1.

  Updated 2026-04-28
• CVE-2024-30520: WordPress Carousel Anything For WPBakery Page Builder plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labib Ahmed Carousel Anything For WPBakery Page Builder allows Stored XSS.This issue affects Carousel Anything For WPBakery Page Builder: from n/a through 2.1.

  Updated 2026-04-28
• CVE-2024-30519: WordPress Lordicon Animated Icons plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lordicon Lordicon Animated Icons allows Stored XSS.This issue affects Lordicon Animated Icons: from n/a through 2.0.1.

  Updated 2026-04-28
• CVE-2024-30518: WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.

  Updated 2026-04-28
• CVE-2024-30517: WordPress Sliced Invoices plugin <= 3.9.2 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Sliced Invoices.This issue affects Sliced Invoices: from n/a through 3.9.2.

  Updated 2026-04-28
• CVE-2024-30516: WordPress Booking Package plugin <= 1.6.27 - Price Manipulation vulnerability 7.5 High

  Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booking Package: from n/a through 1.6.27.

  Updated 2026-04-28
• CVE-2024-30515: WordPress Events Manager plugin <= 6.4.6.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.6.4.

  Updated 2026-04-28
• CVE-2024-30514: WordPress Paid Memberships Pro – Payfast Gateway Add On plugin <= 1.4.1 - Sensitive Data Exposure via Log File vulnerability 5.3 Medium

  Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Payfast Gateway Add On.This issue affects Paid Memberships Pro – Payfast Gateway Add On: from n/a through 1.4.1.

  Updated 2026-04-28
• CVE-2024-30513: WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.

  Updated 2026-04-28
• CVE-2024-30512: WordPress weForms plugin <= 1.6.20 - Broken Access Control vulnerability 3.7 Low

  Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.20.

  Updated 2026-04-28
• CVE-2024-30511: WordPress FG PrestaShop to WooCommerce plugin <= 4.45.1 - Sensitive Data Exposure via Log File vulnerability 5.3 Medium

  Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.45.1.

  Updated 2026-04-28
• CVE-2024-30510: WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability 10.0 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 9.5.

  Updated 2026-04-28
• CVE-2024-30509: WordPress SellKit plugin <= 1.8.1 - Arbitrary File Download vulnerability 6.5 Medium

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Artbees SellKit allows Relative Path Traversal.This issue affects SellKit: from n/a through 1.8.1.

  Updated 2026-04-28
• CVE-2024-30508: WordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.

  Updated 2026-04-28
• CVE-2024-30507: WordPress Molongui Authorship plugin <= 4.7.7 - Insecure Direct Object References (IDOR) vulnerability 2.7 Low

  Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7.

  Updated 2026-04-28
• CVE-2024-30506: WordPress All In One Redirection plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Stored XSS.This issue affects All In One Redirection: from n/a through 2.2.0.

  Updated 2026-04-28
• CVE-2024-30505: WordPress Church Admin plugin <= 4.1.18 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18.

  Updated 2026-04-28
• CVE-2024-30504: WordPress WP Travel Engine plugin <= 5.7.9 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.

  Updated 2026-04-28
• CVE-2024-30503: WordPress Mailster plugin <= 4.0.6 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.This issue affects Mailster: from n/a through <= 4.0.6.

  Updated 2026-04-28
• CVE-2024-30502: WordPress WP Travel Engine plugin <= 5.7.9 - Unauth. Blind SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.

  Updated 2026-04-28
• CVE-2024-30501: WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.

  Updated 2026-04-28
• CVE-2024-30500: WordPress CubeWP plugin <= 1.1.12 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.12.

  Updated 2026-04-28
• CVE-2024-30499: WordPress CRM Perks Forms plugin <= 1.1.4 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.

  Updated 2026-04-28
• CVE-2024-30498: WordPress CRM Perks Forms plugin <= 1.1.4 - Unauthenticated SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.

  Updated 2026-04-28
• CVE-2024-30497: WordPress WP Responsive Tabs horizontal vertical and accordion Tabs plugin <= 1.1.17 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs.This issue affects WP Responsive Tabs horizontal vertical and accordion Tabs: from n/a through 1.1.17.

  Updated 2026-04-28
• CVE-2024-30496: WordPress Element Pack Lite plugin <= 5.5.3 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.5.3.

  Updated 2026-04-28
• CVE-2024-30495: WordPress Falang multilanguage for WordPress plugin <= 1.3.47 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Faboba Falang multilanguage.This issue affects Falang multilanguage: from n/a through 1.3.47.

  Updated 2026-04-28
• CVE-2024-30494: WordPress OSS Aliyun plugin <= 1.4.10 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 沈唁 OSS Aliyun.This issue affects OSS Aliyun: from n/a through 1.4.10.

  Updated 2026-04-28
• CVE-2024-30493: WordPress Church Admin plugin <= 4.1.7 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7.

  Updated 2026-04-28
• CVE-2024-30492: WordPress Export and Import Users and Customers plugin <= 2.5.2 - Path Traversal vulnerability 4.3 Medium

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.

  Updated 2026-04-28
• CVE-2024-30491: WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

  Updated 2026-04-28
• CVE-2024-30490: WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

  Updated 2026-04-28
• CVE-2024-30489: WordPress WP Cost Estimation & Payment Forms Builder plugin <= 10.1.75 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75.

  Updated 2026-04-28
• CVE-2024-30488: WordPress Zotpress plugin <= 7.3.7 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from n/a through <= 7.3.7.

  Updated 2026-04-28
• CVE-2024-30487: WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1 - Broken Access Control vulnerability 7.6 High

  Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.1.

  Updated 2026-04-28
• CVE-2024-30486: WordPress Media Library Folders plugin <= 8.1.7 - Auth. SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.7.

  Updated 2026-04-28
• CVE-2024-30485: WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability 8.8 High

  Missing Authorization vulnerability in XLPlugins Finale Lite.This issue affects Finale Lite: from n/a through 2.18.0.

  Updated 2026-04-28
• CVE-2024-30484: WordPress RT Easy Builder plugin <= 2.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in RT Easy Builder – Advanced addons for Elementor.This issue affects RT Easy Builder – Advanced addons for Elementor: from n/a through 2.0.

  Updated 2026-04-28
• CVE-2024-30483: WordPress Sponsors plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Sponsorships Sponsors allows Stored XSS.This issue affects Sponsors: from n/a through 3.5.1.

  Updated 2026-04-28
• CVE-2024-30482: WordPress Simple Revisions Delete plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Brice CAPOBIANCO Simple Revisions Delete.This issue affects Simple Revisions Delete: from n/a through 1.5.3.

  Updated 2026-04-28
• CVE-2024-30481: WordPress JCH Optimize plugin <= 4.0.0 - Broken Access Control vulnerability 6.5 Medium

  Broken Access Control vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.0.0.

  Updated 2026-04-28
• CVE-2024-30480: WordPress CGC Maintenance Mode plugin <= 1.2 - IP Filtering Bypass vulnerability 3.7 Low

  Authentication Bypass by Spoofing vulnerability in Pippin Williamson CGC Maintenance Mode allows Functionality Bypass.This issue affects CGC Maintenance Mode: from n/a through 1.2.

  Updated 2026-04-28
• CVE-2024-30479: WordPress LionScripts: IP Blocker Lite plugin <= 11.1.1 - Bypass vulnerability 5.3 Medium

  Authentication Bypass by Spoofing vulnerability in LionScripts IP Blocker Lite allows Functionality Bypass.This issue affects IP Blocker Lite: from n/a through 11.1.1.

  Updated 2026-04-28
• CVE-2024-30478: WordPress Announcement & Notification Banner – Bulletin plugin <= 3.8.5 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bulletin WordPress Announcement & Notification Banner Plugin – Bulletin.This issue affects WordPress Announcement & Notification Banner Plugin – Bulletin: from n/a through 3.8.5.

  Updated 2026-04-28
• CVE-2024-30477: WordPress Klarna Payments for WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Klarna Klarna Payments for WooCommerce.This issue affects Klarna Payments for WooCommerce: from n/a through 3.2.4.

  Updated 2026-04-28
• CVE-2024-30476: PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentially exploit this vuln 5.4 Medium

  PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentially exploit this vulnerability, it could lead to script execution in the client browser.

  Updated 2026-06-16
• CVE-2024-30473: Dell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management. A remote high privileged attacker could potentially exploit this vulnerability, g 4.9 Medium

  Dell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management. A remote high privileged attacker could potentially exploit this vulnerability, gaining access to unauthorized end points.

  Updated 2024-08-02
• CVE-2024-30472: Telemetry Dashboard v1.0.0.8 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability. An unauthenticated user with local access to the device could exploit t 7.5 High

  Telemetry Dashboard v1.0.0.8 for Dell ThinOS 2402 contains a sensitive information disclosure vulnerability. An unauthenticated user with local access to the device could exploit this vulnerability leading to information disclosure.

  Updated 2024-08-02
• CVE-2024-30471: Apache StreamPipes: Potential creation of multiple identical accounts 5.3 Medium

  Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request the creation of multiple accounts with the same email address until the email address is registered, creating many identical users and corrupting StreamPipe's user management. This issue affects Apache StreamPipes: through 0.93.0. Users ar

  Updated 2024-09-13
• CVE-2024-30470: WordPress YITH WooCommerce Account Funds Premium plugin <= 1.32.0 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in YITH YITH WooCommerce Account Funds Premium.This issue affects YITH WooCommerce Account Funds Premium: from n/a through 1.33.0.

  Updated 2026-04-28
• CVE-2024-30469: WordPress Wholesale For WooCommerce plugin <= 2.3.0 - Unauthenticated Sensitive Data Exposure vulnerability 5.3 Medium

  Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.

  Updated 2026-04-28
• CVE-2024-30468: WordPress All-In-One Security (AIOS) – Security and Firewall plugin <= 5.2.6 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6.

  Updated 2026-04-28
• CVE-2024-30467: WordPress Essential Blocks plugin <= 4.4.9 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg.This issue affects Essential Blocks for Gutenberg: from n/a through 4.4.9.

  Updated 2026-04-28
• CVE-2024-30466: WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.4 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.4.

  Updated 2026-04-28
• CVE-2024-30465: WordPress PageLayer plugin <= 1.8.1 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Pagelayer Team PageLayer.This issue affects PageLayer: from n/a through 1.8.1.

  Updated 2026-04-28
• CVE-2024-30464: WordPress Social Icons Widget & Block by WPZOOM plugin <= 4.2.15 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in WPZOOM Social Icons Widget & Block by WPZOOM.This issue affects Social Icons Widget & Block by WPZOOM: from n/a through 4.2.15.

  Updated 2026-04-28
• CVE-2024-30463: WordPress BEAR plugin <= 1.1.4.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4.3.

  Updated 2026-04-28

Search a CVE ID or check dependency files →