Explore CVE records

HighPublished 31 Dec 2024, 20:35 WIB

CVE-2024-56070

WordPress WP SuperBackup plugin <= 2.3.3 - Multiple Subscriber+ Broken Access Control vulnerabilities

Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3.

Excerpt language: en.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 31 Dec 2024, 20:33 WIB

CVE-2024-56207

WordPress EditionGuard for WooCommerce – eBook Sales with DRM plugin <= 3.4.2 - CSRF to Privilege Escalation vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in EditionGuard EditionGuard for WooCommerce – eBook Sales with DRM editionguard-for-woocommerce-ebook-sales-with-drm allows Privilege Escalation.This issue affects EditionGuard for WooCommerce – eBook Sales with DRM: from n/a through <= 3.4.2.

Excerpt language: en.

HighPublished 31 Dec 2024, 20:29 WIB

CVE-2024-56206

WordPress gap-hub-user-role. plugin <= 3.4.1 - CSRF to Broken Authentication vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in krishankakkar gap-hub-user-role gap-hub-user-role allows Authentication Bypass.This issue affects gap-hub-user-role: from n/a through <= 3.4.1.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 31 Dec 2024, 20:26 WIB

CVE-2024-56204

WordPress Sinking Dropdowns plugin <= 1.25 - CSRF to Privilege Escalation vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in yonisink Sinking Dropdowns sinking-dropdowns allows Privilege Escalation.This issue affects Sinking Dropdowns: from n/a through <= 1.25.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 31 Dec 2024, 20:21 WIB

CVE-2024-56203

WordPress Wayne Audio Player plugin <= 1.0 - CSRF to Privilege Escalation vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in gholme4 Wayne Audio Player wayne-audio-player allows Privilege Escalation.This issue affects Wayne Audio Player: from n/a through <= 1.0.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 05:31 WIB

Official record

CritPublished 31 Dec 2024, 20:20 WIB

CVE-2024-56066

WordPress Agency Toolkit plugin <= 1.0.23 - Privilege Escalation vulnerability

Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Privilege Escalation.This issue affects Agency Toolkit: from n/a through <= 1.0.23.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 31 Dec 2024, 20:18 WIB

CVE-2024-56061

WordPress RepairBuddy plugin <= 3.8119 - Account Takeover vulnerability

Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through <= 3.8119.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 20:17 WIB

CVE-2024-56045

WordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 20:17 WIB

CVE-2024-56044

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 20:15 WIB

CVE-2024-56043

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 20:15 WIB

CVE-2024-56040

WordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 19:57 WIB

CVE-2024-56042

WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 31 Dec 2024, 19:57 WIB

CVE-2024-56041

WordPress VibeBP plugin < 1.9.9.5.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.5.1.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 19:55 WIB

CVE-2024-56039

WordPress VibeBP plugin < 1.9.9.7.7 - Unauthenticated SQL Injection vulnerability

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 19:54 WIB

CVE-2024-56064

WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through <= 2.3.3.

Excerpt language: en.

CVSS10v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 31 Dec 2024, 19:53 WIB

CVE-2024-56046

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through <= 1.9.9.

Excerpt language: en.

CVSS10v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 31 Dec 2024, 19:51 WIB

CVE-2024-56068

WordPress WP SuperBackup plugin <= 2.3.3 - Subscriber+ PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup.This issue affects WP SuperBackup: from n/a through <= 2.3.3.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 31 Dec 2024, 19:51 WIB

CVE-2024-55991

WordPress CRM Plugin – WP-CRM System plugin <= 3.2.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.2.9.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 31 Dec 2024, 19:49 WIB

CVE-2024-56031

WordPress Smart Shopify Product plugin <= 1.0.2 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in Yulio Aleman Jimenez Smart Shopify Product smart-shopify-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart Shopify Product: from n/a through <= 1.0.2.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 31 Dec 2024, 19:48 WIB

CVE-2024-56067

WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage