Total
397416 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-2253 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via URL values the plugin's carousel widgets in all versions up to, and including, 10.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-2252 | 2026-06-17 | N/A | 5.4 MEDIUM | ||
| The Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping on user supplied attributes such as URL. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-2250 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| The 130+ Widgets | Best Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-2249 | 1 La-studioweb | 1 La-studio Element Kit For Elementor | 2026-06-17 | N/A | 6.4 MEDIUM |
| The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widgets in all versions up to, and including, 1.3.7.4 due to insufficient input sanitization and output escaping the user supplied attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-2248 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email. | |||||
| CVE-2024-2247 | 1 Jfrog | 1 Artifactory | 2026-06-17 | N/A | 8.8 HIGH |
| JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnerable to DOM-based cross-site scripting due to improper handling of the import override mechanism. | |||||
| CVE-2024-2245 | 1 Mozilo | 1 Mozilocms | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross-Site Scripting vulnerability in moziloCMS version 2.0. By sending a POST request to the '/install.php' endpoint, a JavaScript payload could be executed in the 'username' parameter. | |||||
| CVE-2024-2244 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| REST service authentication anomaly with “valid username/no password” credential combination for batch job processing resulting in successful service invocation. The anomaly doesn’t exist with other credential combinations. | |||||
| CVE-2024-2243 | 1 Csutils | 1 Csmock | 2026-06-17 | N/A | 7.6 HIGH |
| A vulnerability was found in csmock where a regular user of the OSH service (anyone with a valid Kerberos ticket) can use the vulnerability to disclose the confidential Snyk authentication token and to run arbitrary commands on OSH workers. | |||||
| CVE-2024-2242 | 1 Rocklobster | 1 Contact Form 7 | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | |||||
| CVE-2024-2241 | 1 Devolutions | 1 Workspace | 2026-06-17 | N/A | 6.3 MEDIUM |
| Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintended actions via specific permissions | |||||
| CVE-2024-2240 | 1 Broadcom | 1 Brocade Sannav | 2026-06-17 | N/A | 7.2 HIGH |
| Docker daemon in Brocade SANnav before SANnav 2.3.1b runs without auditing. The vulnerability could allow a remote authenticated attacker to execute various attacks. | |||||
| CVE-2024-2239 | 1 Leap13 | 1 Premium Addons | 2026-06-17 | N/A | 6.4 MEDIUM |
| The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Premium Magic Scroll module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-2238 | 1 Leap13 | 1 Premium Addons | 2026-06-17 | N/A | 6.4 MEDIUM |
| The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Mouse Cursor module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-2237 | 1 Leap13 | 1 Premium Addons | 2026-06-17 | N/A | 6.4 MEDIUM |
| The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-2236 | 2026-06-17 | N/A | 5.9 MEDIUM | ||
| A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts. | |||||
| CVE-2024-2235 | 1 2code | 1 Himer | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those they don't have access to via a CSRF attack | |||||
| CVE-2024-2234 | 1 2code | 1 Himer | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2024-2233 | 1 2code | 1 Himer | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group | |||||
| CVE-2024-2232 | 1 2code | 1 Himer | 2026-06-17 | N/A | 8.1 HIGH |
| The lacks CSRF checks allowing a user to invite any user to any group (including private groups) | |||||