PatchTheCVEwondercms vulnerabilities and fixes
Recent CVEs affecting wondercms, with upgrade or downgrade steps. 14 tracked.
wondercms has 14 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-04-02. Highest priority: CVE-2024-32340 (score 52/100).
- CVE-2025-3123 MEDIUM 4.7 DOWNGRADE A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0
- CVE-2024-41305 MEDIUM 4.7 DOWNGRADE A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the app
- CVE-2024-41304 MEDIUM 5.4 DOWNGRADE An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers
- CVE-2024-32746 MEDIUM 4.6 DOWNGRADE A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to exe
- CVE-2024-32745 MEDIUM 5.9 DOWNGRADE A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to exe
- CVE-2024-32744 MEDIUM 4.6 DOWNGRADE A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to exe
- CVE-2024-32743 MEDIUM 5.5 DOWNGRADE A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to exe
- CVE-2024-32341 MEDIUM 5.4 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in the Home page of WonderCMS v3.4.3 allows attackers to e
- CVE-2024-32340 CRITICAL 9.6 DOWNGRADE A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to exe
- CVE-2024-32339 MEDIUM 6.1 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to
- CVE-2024-32338 MEDIUM 5.4 DOWNGRADE A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to exe
- CVE-2024-32337 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to exe
- CVE-2024-27563 MEDIUM 5.3 DOWNGRADE A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to f
- CVE-2024-27561 HIGH 8.1 DOWNGRADE A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows
FAQ
How do I fix wondercms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is wondercms being exploited right now?
None of the tracked wondercms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which wondercms CVE should I patch first?
CVE-2024-32340 currently ranks highest (52/100): A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to exe.