Skip to content
OpenAdvisories

Archive

March 2024

Vulnerabilities first published in this month (UTC), newest first.

← February 2024 2024 / March April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

1,626 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-30524

    WordPress PDF Viewer for Elementor plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RedLettuce Plugins PDF Viewer for Elementor allows Stored XSS.This issue affects PDF Viewer for Elementor: from n/a through 2.9.3.

    RedLettuce Plugins PDF Viewer for Elementor
  • Medium 6.5
    CVE-2024-30530

    WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Stored XSS.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar…

    SONAAR MUSIC MP3 Audio Player for Music, Radio & Podcast by Sonaar
  • Medium 5.9
    CVE-2024-30548

    WordPress underConstruction plugin <= 1.21 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Kagan underConstruction allows Stored XSS.This issue affects underConstruction: from n/a through 1.21.

    Noah Kagan underConstruction
  • Medium 5.9
    CVE-2024-30549

    WordPress Contact Forms by Cimatti plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cimatti Contact Forms by Cimatti contact-forms.This issue affects Contact Forms by Cimatti: from n/a through <= 1.8.0.

    cimatti Contact Forms by Cimatti
  • Medium 6.5
    CVE-2024-30552

    WordPress Responsive flipbook plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wppdf.Org Responsive flipbook allows Stored XSS.This issue affects Responsive flipbook: from n/a through 1.0.0.

    wppdf.org Responsive flipbook
  • Medium 5.9
    CVE-2024-30553

    WordPress WP Twitter Mega Fan Box Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joby Joseph WP Twitter Mega Fan Box Widget allows Stored XSS.This issue affects WP Twitter Mega Fan Box Widget : from n/a through 1.0.

    Joby Joseph WP Twitter Mega Fan Box Widget
  • Medium 5.9
    CVE-2024-30554

    WordPress DD Rating plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wouter Dijkstra DD Rating allows Stored XSS.This issue affects DD Rating: from n/a through 1.7.1.

    Wouter Dijkstra DD Rating
  • Medium 6.5
    CVE-2024-30555

    WordPress Ultimate Social Comments plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sayan Datta Ultimate Social Comments – Email Notification & Lazy Load allows Stored XSS.This issue affects Ultimate Social Comments – Email Notification & La…

    Sayan Datta Ultimate Social Comments – Email Notification & Lazy Load
  • Medium 6.5
    CVE-2024-30556

    WordPress Mighty Classic Pros And Cons plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MightyThemes Mighty Classic Pros And Cons allows Stored XSS.This issue affects Mighty Classic Pros And Cons: from n/a through 2.0.9.

    MightyThemes Mighty Classic Pros And Cons
  • Medium 6.5
    CVE-2024-30557

    WordPress Aesop Story Engine plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aesopinteractive Aesop Story Engine allows Stored XSS.This issue affects Aesop Story Engine: from n/a through 2.3.2.

    Aesopinteractive Aesop Story Engine
  • Medium 6.5
    CVE-2024-30559

    WordPress Spin 360 deg and 3D Model Viewer plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maurice Spin 360 deg and 3D Model Viewer allows Stored XSS.This issue affects Spin 360 deg and 3D Model Viewer: from n/a through 1.2.7.

    Maurice Spin 360 deg and 3D Model Viewer
  • Medium 5.9
    CVE-2024-31089

    WordPress Platinum SEO plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Techblissonline.Com (Rajesh) Platinum SEO allows Stored XSS.This issue affects Platinum SEO: from n/a through 2.4.0.

    Techblissonline.com (Rajesh) Platinum SEO
  • Medium 6.5
    CVE-2024-31101

    WordPress AI Twitter Feeds (Twitter widget & shortcode) plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech AI Twitter Feeds (Twitter widget & shortcode) allows Stored XSS.This issue affects AI Twitter Feeds (Twitter widget & shortcode): from n/a th…

    August Infotech AI Twitter Feeds (Twitter widget & shortcode)
  • Medium 5.9
    CVE-2024-31102

    WordPress Prenotazioni plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scimone Ignazio Prenotazioni allows Stored XSS.This issue affects Prenotazioni: from n/a through 1.7.4.

    Scimone Ignazio Prenotazioni
  • Medium 6.5
    CVE-2024-31104

    WordPress GetResponse for WordPress plugin <= 5.5.33 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GetResponse GetResponse for WordPress allows Stored XSS.This issue affects GetResponse for WordPress: from n/a through 5.5.33.

    GetResponse GetResponse for WordPress Web / CMS
  • Medium 6.5
    CVE-2024-31108

    WordPress iFlyChat plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iFlyChat Team iFlyChat – WordPress Chat iflychat allows Stored XSS.This issue affects iFlyChat – WordPress Chat: from n/a through 4.7.2.

    iFlyChat Team iFlyChat – WordPress Chat Web / CMS
  • Medium 6.5
    CVE-2024-31117

    WordPress WooCommerce Bookings Calendar plugin <= 1.0.36 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moises Heberle WooCommerce Bookings Calendar.This issue affects WooCommerce Bookings Calendar: from n/a through 1.0.36.

    Moises Heberle WooCommerce Bookings Calendar Web / CMS
  • Medium 6.5
    CVE-2024-31120

    WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Stored XSS.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

    wpdevart Responsive Image Gallery, Gallery Album
  • Medium 6.5
    CVE-2024-31121

    WordPress HeartThis plugin <= 0.1.0 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in HeartThis <= 0.1.0 versions.

    WP Site Care HeartThis
  • Medium 5.8
    CVE-2024-31122

    WordPress User Rights Access Manager plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Prism IT Systems User Rights Access Manager allows Reflected XSS.This issue affects User Rights Access Manager: from n/a through 1.1.2.

    Prism IT Systems User Rights Access Manager
  • Medium 4.3
    CVE-2024-30526

    WordPress Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin <= 6.5.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Easy Social Feed.This issue affects Easy Social Feed: from n/a through 6.5.6.

    Easy Social Feed Easy Social Feed
  • Medium 4.3
    CVE-2024-30536

    WordPress Slugs Manager plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Slugs Manager.This issue affects Slugs Manager: from n/a through 2.6.7.

    WPFactory Slugs Manager
  • Medium 4.3
    CVE-2024-30541

    WordPress LWS Optimize plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Optimize.This issue affects LWS Optimize: from n/a through 1.9.1.

    LWS LWS Optimize
  • Medium 4.3
    CVE-2024-31096

    WordPress Nictitate theme <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in kopatheme Nictitate.This issue affects Nictitate: from n/a through 1.1.4.

    Kopa Theme Nictitate
  • Medium 5.4
    CVE-2024-31100

    WordPress Popup Cart Lite for WooCommerce plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Festi-Team Popup Cart Lite for WooCommerce.This issue affects Popup Cart Lite for WooCommerce: from n/a through 1.1.

    Festi-Team Popup Cart Lite for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2024-30543

    WordPress Whizzy plugin <= 1.1.18 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in UPQODE Whizz.This issue affects Whizzy: from n/a through 1.1.18.

    UPQODE Whizzy
  • Medium 5.3
    CVE-2024-31095

    WordPress Thumbs Rating plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.1.0.

    Ricard Torres Thumbs Rating
  • Medium 5.3
    CVE-2024-30523

    WordPress Paid Memberships Pro – Mailchimp Add On plugin <= 2.3.4 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Mailchimp Add On pmpro-mailchimp.This issue affects Paid Memberships Pro – Mailchimp Add On: from n/a through 2.3.4.

    Paid Memberships Pro Paid Memberships Pro – Mailchimp Add On
  • Medium 5.3
    CVE-2023-50959

    IBM Cloud Pak for Business Automation information disclosure

    IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2,19.0.1, 19.0.2, 19.0.3,20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1,2 2.0.2, 23.0.1, and 23.0.2 may allow end users to query more documents than expected from a connected Enterprise Conten…

    IBM Cloud Pak for Business Automation
  • Medium 5.9
    CVE-2024-22353

    IBM WebSphere Application Server Liberty denial of service

    IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-F…

    IBM WebSphere Application Server - Liberty
  • Medium 6.2
    CVE-2024-25027

    IBM Security Verify Access Container information disclosure

    IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption. IBM X-Force ID: 281607.

    IBM Security Verify Access Docker
  • Medium 6.3
    CVE-2024-3118

    Dreamer CMS Attachment permission

    A vulnerability, which was classified as critical, has been found in Dreamer CMS up to 4.1.3. This issue affects some unknown processing of the component Attachment Handler. The manipulation leads to permission issues. The attack may be initiated remotely. Th…

    Dreamer CMS
  • Medium 4.7
    CVE-2024-3117

    YouDianCMS ChannelAction.class.php unrestricted upload

    A vulnerability classified as critical was found in YouDianCMS up to 9.5.12. This vulnerability affects unknown code of the file App\Lib\Action\Admin\ChannelAction.class.php. The manipulation of the argument file leads to unrestricted upload. The attack can b…

  • Medium 6.5
    CVE-2024-27609

    Bonita cross-site scripting vulnerability

    Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel.

    org.bonitasoft.platform:platform-resources org.bonitasoft.console:bonita-web-server Maven
  • Medium 4.3
    CVE-2024-3089

    PHPGurukul Emergency Ambulance Hiring Portal Manage Ambulance Page manage-ambulance.php cross-site request forgery

    A vulnerability has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/manage-ambulance.php of the component Manage Ambulance Page. The manipulation of the a…

    PHPGurukul Emergency Ambulance Hiring Portal
  • Medium 6.4
    CVE-2024-2491

    PowerPack Addons for Elementor <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag*

    The PowerPack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the *_html_tag* attribute of multiple widgets in all versions up to, and including, 2.7.17 due to insufficient input sanitization and output escaping. Thi…

    IdeaBox Creations PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) Web / CMS
  • Medium 4.3
    CVE-2024-3086

    PHPGurukul Emergency Ambulance Hiring Portal Ambulance Tracking Page ambulance-tracking.php cross site scripting

    A vulnerability classified as problematic was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this vulnerability is an unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation o…

    PHPGurukul Emergency Ambulance Hiring Portal
  • Medium 6.4
    CVE-2024-2948

    Favorites <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Favorites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user_favorites' shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes such…

    Kyle Phillips Favorites Web / CMS
  • Medium 4.3
    CVE-2024-3084

    PHPGurukul Emergency Ambulance Hiring Portal Hire an Ambulance Page cross site scripting

    A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been rated as problematic. This issue affects some unknown processing of the component Hire an Ambulance Page. The manipulation of the argument Patient Name/Relative Name/Re…

    PHPGurukul Emergency Ambulance Hiring Portal
  • Medium 6.4
    CVE-2024-2140

    Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget

    The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Icons widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it…

    Brainstorm Force Ultimate Addons for Beaver Builder – Lite Web / CMS