Skip to content
OpenAdvisories

Archive

29 March 2024

Vulnerabilities first published on this day (UTC), newest first.

← February 2024 2024 / March /29 April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

87 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-30432

    WordPress B Slider plugin <= 1.1.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider - Slider for your block editor allows Stored XSS.This issue affects B Slider - Slider for your block editor: from n/a through 1.1.12.

    bPlugins B Slider - Slider for your block editor
  • Medium 6.5
    CVE-2024-30433

    WordPress MultiVendorX Marketplace plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX WC Marketplace allows Stored XSS.This issue affects WC Marketplace: from n/a through 4.1.3.

    MultiVendorX WC Marketplace
  • Medium 5.9
    CVE-2024-30434

    WordPress WP-CRM System plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-CRM System allows Stored XSS.This issue affects WP-CRM System: from n/a through 3.2.9.

  • Medium 6.5
    CVE-2024-30436

    WordPress Collect.chat plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Collect.Chat Inc. Collectchat allows Stored XSS.This issue affects Collectchat: from n/a through 2.4.1.

    Collect.chat collectchat
  • Medium 6.5
    CVE-2024-30437

    WordPress Webinar and Video Conference with Jitsi Meet plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference with Jitsi Meet: from n/a through 2.6.3.

    WPPOOL Webinar and Video Conference with Jitsi Meet
  • Medium 6.5
    CVE-2024-30438

    WordPress Print Page block plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Print Page block allows Stored XSS.This issue affects Print Page block: from n/a through 1.0.8.

    bPlugins Print Page block
  • Medium 5.9
    CVE-2024-30440

    WordPress Themify Event Post plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Themify Event Post allows Stored XSS.This issue affects Themify Event Post: from n/a through 1.2.7.

    Themify Themify Event Post
  • Medium 6.5
    CVE-2024-30442

    WordPress Bold Page Builder plugin <= 4.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 4.8.0.

    Bold Themes Bold Page Builder
  • Medium 6.5
    CVE-2024-30443

    WordPress GS Testimonial Slider plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Testimonial Slider allows Stored XSS.This issue affects GS Testimonial Slider: from n/a through 3.1.4.

    GS Plugins GS Testimonial Slider
  • Medium 5.9
    CVE-2024-30444

    WordPress WordPress Page Builder – Zion Builder plugin <= 3.6.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zionbuilder.Io WordPress Page Builder – Zion Builder allows Stored XSS.This issue affects WordPress Page Builder – Zion Builder: from n/a through 3.6.9.

    zionbuilder.io WordPress Page Builder – Zion Builder Web / CMS
  • Medium 6.5
    CVE-2024-30445

    WordPress Web Icons plugin <= 1.0.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab, Inc. Web Icons allows Stored XSS.This issue affects Web Icons: from n/a through 1.0.0.10.

    GhozyLab Web Icons
  • Medium 6.5
    CVE-2024-30446

    WordPress CRM Perks Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms allows Stored XSS.This issue affects CRM Perks Forms: from n/a through 1.1.4.

    CRM Perks CRM Perks Forms
  • Medium 5.9
    CVE-2024-30448

    WordPress Slider by Supsystic plugin <= 1.8.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic Slider by Supsystic allows Stored XSS.This issue affects Slider by Supsystic: from n/a through 1.8.10.

    supsystic Slider by Supsystic
  • Medium 6.5
    CVE-2024-30450

    WordPress OpenStreetMap for Gutenberg and WPBakery Page Builder plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Step-Byte-Service GmbH OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) allows Stored XSS.This issue affects OpenStreetMap fo…

    Step-Byte-Service OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
  • Medium 6.5
    CVE-2024-30451

    WordPress Geo Controller plugin <= 8.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INFINITUM FORM Geo Controller allows Stored XSS.This issue affects Geo Controller: from n/a through 8.6.4.

    INFINITUM FORM Geo Controller
  • Medium 5.9
    CVE-2024-30452

    WordPress Landing Page Builder plugin <= 1.5.1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Stored XSS.This issue affects Landing Page Builder: from n/a through 1.5.1.7.

    PluginOps Landing Page Builder
  • Medium 5.4
    CVE-2024-30453

    WordPress Brave plugin <= 0.6.5 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.6.5.

    Brave Brave Popup Builder
  • Medium 4.3
    CVE-2024-30455

    WordPress GamiPress plugin <= 6.8.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 6.8.5.

    GamiPress GamiPress
  • Medium 4.3
    CVE-2024-30460

    WordPress Tumult Hype Animations plugin <= 1.9.11 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tumult Inc Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through 1.9.11.

    Tumult Tumult Hype Animations
  • Medium 4.3
    CVE-2024-30454

    WordPress WP SMS plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.6.2.

    VeronaLabs WP SMS
  • Medium 5.7
    CVE-2024-25944

    Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. An unauthenticated remote attack…

    Dell Dell OpenManage Enterprise
  • Medium 4.3
    CVE-2024-30462

    WordPress HUSKY plugin <= 1.3.5.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.1.

    RealMag777 HUSKY – Products Filter for WooCommerce (formerly WOOF) Web / CMS
  • Medium 4.3
    CVE-2024-30463

    WordPress BEAR plugin <= 1.1.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4.3.

    RealMag777 BEAR
  • Medium 4.3
    CVE-2024-30468

    WordPress All-In-One Security (AIOS) – Security and Firewall plugin <= 5.2.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6.

    All In One WP Security & Firewall Team All In One WP Security & Firewall
  • Medium 5.3
    CVE-2024-30477

    WordPress Klarna Payments for WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Klarna Klarna Payments for WooCommerce.This issue affects Klarna Payments for WooCommerce: from n/a through 3.2.4.

    Klarna Klarna Payments for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2024-30482

    WordPress Simple Revisions Delete plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Brice CAPOBIANCO Simple Revisions Delete.This issue affects Simple Revisions Delete: from n/a through 1.5.3.

    Brice Capobianco Simple Revisions Delete
  • Medium 4.3
    CVE-2024-30518

    WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.

    themelocation Custom WooCommerce Checkout Fields Editor Web / CMS
  • Medium 5.4
    CVE-2024-30521

    WordPress Landingi Landing Pages plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Landingi Landingi Landing Pages.This issue affects Landingi Landing Pages: from n/a through 3.1.1.

    Landingi Landingi Landing Pages
  • Medium 6.5
    CVE-2024-30513

    WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.

    Metagauss ProfileGrid
  • Medium 5.3
    CVE-2024-30469

    WordPress Wholesale For WooCommerce plugin <= 2.3.0 - Unauthenticated Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.

    WP Experts Wholesale For WooCommerce Web / CMS
  • Medium 5.3
    CVE-2024-30511

    WordPress FG PrestaShop to WooCommerce plugin <= 4.45.1 - Sensitive Data Exposure via Log File vulnerability

    Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.45.1.

    Frédéric GILLES FG PrestaShop to WooCommerce Web / CMS
  • Medium 5.3
    CVE-2024-30514

    WordPress Paid Memberships Pro – Payfast Gateway Add On plugin <= 1.4.1 - Sensitive Data Exposure via Log File vulnerability

    Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Payfast Gateway Add On.This issue affects Paid Memberships Pro – Payfast Gateway Add On: from n/a through 1.4.1.

    Paid Memberships Pro Paid Memberships Pro – Payfast Gateway Add On
  • Medium 4.3
    CVE-2024-30492

    WordPress Export and Import Users and Customers plugin <= 2.5.2 - Path Traversal vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.

    WebToffee Import Export WordPress Users Web / CMS
  • Medium 4.8
    CVE-2024-29901

    @workos-inc/authkit-nextjs session replay vulnerability

    The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.

    workos authkit-nextjs @workos-inc/authkit-nextjs npm
  • Medium 6.5
    CVE-2024-29893

    Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the …

    argoproj Argo CD github.com/argoproj/argo-cd/v2 Go
  • Medium 4.6
    CVE-2024-29020

    JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked

    JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the playbook_id of another user. This breach of c…

    jumpserver jumpserver
  • Medium 4.6
    CVE-2024-29024

    JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality

    JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability in the file manager's bulk transfer by manipulating job IDs to upload…

    jumpserver jumpserver
  • Medium 5.9
    CVE-2024-28867

    Swift Prometheus un-sanitized metric name or labels can be used to take over exported metrics

    Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string values into metric names or labels_, an attacker could make use of this and send a `?lang` query pa…

    swift-server swift-prometheus github.com/swift-server/swift-prometheus SwiftURL
  • Medium 6.5
    CVE-2024-30508

    WordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.

    ThimPress WP Hotel Booking
  • Medium 5.4
    CVE-2024-30505

    WordPress Church Admin plugin <= 4.1.18 - Broken Access Control vulnerability

    Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18.

    andy_moyle Church Admin