Skip to content
OpenAdvisories

Archive

February 2024

Vulnerabilities first published in this month (UTC), newest first.

← January 2024 2024 / February March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

1,283 results · Clear filters · Feed

  • Medium 5.9
    CVE-2023-51691

    WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This issue affects Comments – wpDiscuz: from n/a through 7.6.12.

    gVectors Team Comments — wpDiscuz
  • Medium 6.5
    CVE-2023-51690

    WordPress Advanced iFrame Plugin <= 2023.8 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.8.

    Advanced iFrame Advanced iFrame
  • Medium 6.5
    CVE-2023-51689

    WordPress Easy Video Player Plugin <= 1.2.2.10 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 Easy Video Player allows Stored XSS.This issue affects Easy Video Player: from n/a through 1.2.2.10.

    naa986 Easy Video Player
  • Medium 5.9
    CVE-2023-51685

    WordPress WP Review Slider Plugin <= 12.7 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LJ Apps WP Review Slider allows Stored XSS.This issue affects WP Review Slider: from n/a through 12.7.

    LJ Apps WP Review Slider
  • Medium 6.5
    CVE-2023-51684

    WordPress Easy Digital Downloads Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital D…

    Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy)
  • Medium 5.9
    CVE-2023-51534

    WordPress Brave Popup Builder Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content allows Stored XSS.This issue affects Brave – Create Popup,…

    Brave Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
  • Medium 6.5
    CVE-2023-51677

    WordPress Schema & Structured Data for WP & AMP Plugin <= 1.23 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.23.

    Magazine3 Schema & Structured Data for WP & AMP
  • Medium 5.9
    CVE-2023-51536

    WordPress CRM Perks Forms Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms – WordPress Form Builder allows Stored XSS.This issue affects CRM Perks Forms – WordPress Form Builder: from n/a through 1.1.2.

    CRM Perks CRM Perks Forms – WordPress Form Builder Web / CMS
  • Medium 6.5
    CVE-2023-51674

    WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Re…

    AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
  • Medium 6.5
    CVE-2023-51669

    WordPress Product Code for WooCommerce Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artios Media Product Code for WooCommerce allows Stored XSS.This issue affects Product Code for WooCommerce: from n/a through 1.4.4.

    Artios Media Product Code for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-51666

    WordPress Related Post Plugin <= 2.0.53 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored XSS.This issue affects Related Post: from n/a through 2.0.53.

    PickPlugins Related Post
  • Medium 5.9
    CVE-2023-51548

    WordPress SlickNav Mobile Menu Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Neil Gee SlickNav Mobile Menu allows Stored XSS.This issue affects SlickNav Mobile Menu: from n/a through 1.9.2.

    Neil Gee SlickNav Mobile Menu
  • Medium 6.5
    CVE-2023-52118

    WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS.This issue affects WP User Profile Avatar: from n/a through 1.0.

    WP Event Manager WP User Profile Avatar
  • Medium 6.5
    CVE-2023-52175

    WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Uno (miunosoft) Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Aff…

    Michael Uno (miunosoft) Auto Amazon Links – Amazon Associates Affiliate Plugin
  • Medium 6.5
    CVE-2023-52188

    WordPress Footer Putter Plugin <= 1.17 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter allows Stored XSS.This issue affects Footer Putter: from n/a through 1.17.

    Russell Jamieson Footer Putter
  • Medium 6.5
    CVE-2023-52189

    WordPress Ideal Interactive Map Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jhayghost Ideal Interactive Map allows Stored XSS.This issue affects Ideal Interactive Map: from n/a through 1.2.4.

    Jhayghost Ideal Interactive Map
  • Medium 6.5
    CVE-2023-52191

    WordPress Infogram Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Torbjon Infogram – Add charts, maps and infographics allows Stored XSS.This issue affects Infogram – Add charts, maps and infographics: from n/a through 1.6.…

    Torbjon Infogram – Add charts, maps and infographics
  • Medium 6.5
    CVE-2023-52192

    WordPress Keap Official Opt-in Forms Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through 1.0.11.

    Keap Keap Official Opt-in Forms
  • Medium 5.5
    CVE-2024-22430

    Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability. A local l…

    Dell PowerScale OneFS
  • Medium 6.5
    CVE-2023-52193

    WordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 1.5.23.

    Live Composer Team Page Builder: Live Composer
  • Medium 6.6
    CVE-2024-22449

    Dell PowerScale OneFS versions 9.0.0.x through 9.6.0.x contains a missing authentication for critical function vulnerab…

    Dell PowerScale OneFS
  • Medium 6.5
    CVE-2023-52194

    WordPress oEmbed Gist Plugin <= 4.9.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takayuki Miyauchi oEmbed Gist allows Stored XSS.This issue affects oEmbed Gist: from n/a through 4.9.1.

    Takayuki Miyauchi oEmbed Gist
  • Medium 6.5
    CVE-2023-52195

    WordPress Posts to Page Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Posts to Page Kerry James allows Stored XSS.This issue affects Kerry James: from n/a through 1.7.

    Posts to Page Kerry James
  • Medium 5.3
    CVE-2024-1130

    NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()

    The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_read() function in all versions up to, and including, 8.5.6. This makes it possible for …

    webaways NEX-Forms – Ultimate Forms Plugin for WordPress Web / CMS
  • Medium 5.3
    CVE-2024-0907

    NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()

    The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the restore_records() function in all versions up to, and including, 8.5.6. This makes it possib…

    webaways NEX-Forms – Ultimate Forms Plugin for WordPress Web / CMS
  • Medium 5.3
    CVE-2024-1129

    NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()

    The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_starred() function in all versions up to, and including, 8.5.6. This makes it possible f…

    webaways NEX-Forms – Ultimate Forms Plugin for WordPress Web / CMS
  • Medium 5.4
    CVE-2024-23941

    Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, whi…

    Intermesh Group-Office
  • Medium 6.4
    CVE-2023-7069

    Advanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2023.10 due to insufficient input sanitization and output escaping on user supplied attrib…

    mdempfle Advanced iFrame Web / CMS
  • Medium 4.5
    CVE-2024-0831

    Vault May Expose Sensitive Information When Configuring An Audit Log Device

    Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.

    HashiCorp Vault Enterprise Vault github.com/hashicorp/vault Go
  • Medium 6.8
    CVE-2023-51835

    An issue in TRENDnet TEW-822DRE v.1.03B02 allows a local attacker to execute arbitrary code via the parameters ipv4_pin…

  • Medium 5.5
    CVE-2023-47256

    ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of…

  • Medium 5.4
    CVE-2024-24062

    springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role.

  • Medium 6.1
    CVE-2024-24059

    springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded fil…

  • Medium 5.4
    CVE-2024-24061

    springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add.

  • Medium 6.1
    CVE-2024-24041

    A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows at…

  • Medium 5.4
    CVE-2024-24060

    springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user.

  • Medium 6.1
    CVE-2024-24945 Public exploit

    A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows at…

  • Medium 6.1
    CVE-2024-23031

    Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbit…

  • Medium 6.1
    CVE-2024-23034

    Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary …

  • Medium 6.1
    CVE-2024-23033

    Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary c…