CVE-2024-30088 — Microsoft Windows_10_1507: Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability CVSSv3.1 7.0 (HIGH) · EPSS 99th percentile
7.0
CVSS v3.1
100
Edit Score
Latest intel// live feed
25 results//sorted by published//last sync 2026-10-24 21:52Z
CVE-2024-30085 — Microsoft Windows_10_1809: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability CVSSv3.1 7.8 (HIGH) · EPSS 96th percentile
7.8
CVSS v3.1
94
Edit Score
CVE-2024-30080 — Microsoft Windows_10_1507: Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2024-30078 — Microsoft Windows_10_1507: Windows Wi-Fi Driver Remote Code Execution Vulnerability
Windows Wi-Fi Driver Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile
8.8
CVSS v3.1
96
Edit Score
CVE-2024-30077 — Microsoft Windows_10_1507: Windows OLE Remote Code Execution Vulnerability
Windows OLE Remote Code Execution Vulnerability CVSSv3.1 8.0 (HIGH) · EPSS 76th percentile
8.0
CVSS v3.1
91
Edit Score
CVE-2024-30075 — Microsoft Windows_server_2008: Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability CVSSv3.1 8.0 (HIGH) · EPSS 55th percentile
8.0
CVSS v3.1
90
Edit Score
CVE-2024-30074 — Microsoft Windows_server_2008: Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability CVSSv3.1 8.0 (HIGH) · EPSS 64th percentile
8.0
CVSS v3.1
90
Edit Score
CVE-2024-30068 — Microsoft Windows_10_1507: Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 52th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-3549 — Adenion Blog2social: The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to SQL Injection via the 'b2sSortPostType' parameter in all versions up to, and including, 7.4.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used t CVSSv3.1 9.9 (CRITICAL) · EPSS 70th percentile
9.9
CVSS v3.1
100
Edit Score
CVE-2023-7264 — Buildapp Build_app_online: The Build App Online plugin for WordPress is vulnerable to account takeover due to
The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22. This makes it possible for unauthenticated attackers to reset the password of arbitrary users by guessing an 4-digit numeric reset code. CVSSv3.1 8.1 (HIGH) · EPSS 83th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2024-3668 — Ideabox Powerpack_addons_for_elementor: The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in
The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with administrator set as the default role and then register as an administrator. CVSSv3.1 8.8 (HIGH) · EPSS 40th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-3592 — Expresstech Quiz_and_survey_master: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'question_id' parameter in all versions up to, and including, 9.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing quer CVSSv3.1 9.9 (CRITICAL) · EPSS 68th percentile
9.9
CVSS v3.1
100
Edit Score
CVE-2024-3166 — Mintplexlabs Anythingllm_desktop: A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version
A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, CVSSv3.1 9.6 (CRITICAL) · EPSS 57th percentile
9.6
CVSS v3.1
98
Edit Score
CVE-2024-5329 — Unlimited-elements Unlimited_elements_for_elementor: The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parameter in all versions up to, and including, 1.5.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing CVSSv3.1 8.8 (HIGH) · EPSS 70th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-5153 — Web-shop-host Startklar_elmentor_addons: The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all
The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory. CVSSv3.1 9.1 (CRITICAL) · EPSS 90th percentile
9.1
CVSS v3.1
97
Edit Score
CVE-2024-5324 — Xootix Login\/signup_popup: Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of
Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2024-5179 — Codeless Cowidgets_elementor_addons: The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion
The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.2 via the 'item_style' and 'style' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in c CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2023-6968 — Themoneytizer The_moneytizer: The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all
The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due to missing or incorrect nonce validation on multiple AJAX functions. This makes it possible for unauthenticated attackers to to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions via a forged request granted they can trick a site administrator CVSSv3.1 8.1 (HIGH) · EPSS 36th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2023-6966 — Themoneytizer The_moneytizer: The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification
The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.6.3. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lowe CVSSv3.1 8.1 (HIGH) · EPSS 65th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2024-4743 — Lifterlms Lifterlms: The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to
The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites shortcode in all versions up to, and including, 7.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing CVSSv3.1 8.8 (HIGH) · EPSS 59th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-4295 — Icegram Email_subscribers_\&_newsletters: The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, and including, 5.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2024-35700 — Userproplugin Userpro: Incorrect Privilege Assignment vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through
Incorrect Privilege Assignment vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.8. CVSSv3.1 9.8 (CRITICAL)
9.8
CVSS v3.1
99
Edit Score
CVE-2024-33568 — Bdthemes Element_pack: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BdThemes
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in BdThemes Element Pack Pro bdthemes-element-pack.This issue affects Element Pack Pro: from n/a through < 7.19.3. CVSSv3.1 8.5 (HIGH)
8.5
CVSS v3.1
93
Edit Score
CVE-2024-4552 — Social: The Social Login Lite For WooCommerce plugin for WordPress is vulnerable to authentication bypass
The Social Login Lite For WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.6.0. This is due to insufficient verification on the user being supplied during the social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. CVSSv3.1 9.8 (CRITICAL) · EPSS 45th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2024-23668 — Fortinet Fortiwebmanager: An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager
An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker to execute unauthorized code or commands via HTTP requests or CLI. CVSSv3.1 8.8 (HIGH) · EPSS 47th percentile
8.8
CVSS v3.1
94
Edit Score