Skip to content
OpenAdvisories

Archive

March 2024

Vulnerabilities first published in this month (UTC), newest first.

← February 2024 2024 / March April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

1,626 results · Clear filters · Feed

  • Medium 6.4
    CVE-2024-2142

    Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget

    The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Info Table widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it pos…

    Brainstorm Force Ultimate Addons for Beaver Builder – Lite Web / CMS
  • Medium 6.4
    CVE-2024-2141

    Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

    The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possibl…

    Brainstorm Force Ultimate Addons for Beaver Builder – Lite Web / CMS
  • Medium 6.4
    CVE-2024-2143

    Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget

    The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possib…

    Brainstorm Force Ultimate Addons for Beaver Builder – Lite Web / CMS
  • Medium 6.4
    CVE-2024-2144

    Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget

    The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Separator widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes i…

    Brainstorm Force Ultimate Addons for Beaver Builder – Lite Web / CMS
  • Medium 6.4
    CVE-2024-1238

    ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button ID parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for a…

    roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor Web / CMS
  • Medium 6.4
    CVE-2024-1051

    List category posts <= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.6 due to insufficient input sanitization and output escaping on user supplied attributes …

    fernandobt List category posts Web / CMS
  • Medium 6.4
    CVE-2024-0367

    Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link

    The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link field of an installed widget (e.g., 'Button Link') in all versions up to, and including, 1.5.96 due to insufficient input sanitization and outp…

    unitecms Unlimited Elements For Elementor Web / CMS
  • Medium 6.4
    CVE-2024-2794

    Gutenberg Block Editor Toolkit – EditorsKit <= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Gutenberg Block Editor Toolkit – EditorsKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'editorskit' shortcode in all versions up to, and including, 1.40.4 due to insufficient input sanitization and output escaping o…

    Munir Kamal Gutenberg Block Editor Toolkit – EditorsKit Web / CMS
  • Medium 6.4
    CVE-2024-1692

    BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description

    The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the meta description field in all versions up to, and including, 1.6.13 due to insufficient input sanitization and output escaping on user s…

    Bold Grid BoldGrid Easy SEO – Simple and Effective SEO Web / CMS
  • Medium 6.5
    CVE-2024-29278 Public exploit

    funboot v1.1 is vulnerable to Cross Site Scripting (XSS) via the title field in "create a message ."

  • Medium 6.5
    CVE-2024-30432

    WordPress B Slider plugin <= 1.1.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider - Slider for your block editor allows Stored XSS.This issue affects B Slider - Slider for your block editor: from n/a through 1.1.12.

    bPlugins B Slider - Slider for your block editor
  • Medium 6.5
    CVE-2024-30433

    WordPress MultiVendorX Marketplace plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX WC Marketplace allows Stored XSS.This issue affects WC Marketplace: from n/a through 4.1.3.

    MultiVendorX WC Marketplace
  • Medium 5.9
    CVE-2024-30434

    WordPress WP-CRM System plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-CRM System allows Stored XSS.This issue affects WP-CRM System: from n/a through 3.2.9.

  • Medium 6.5
    CVE-2024-30436

    WordPress Collect.chat plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Collect.Chat Inc. Collectchat allows Stored XSS.This issue affects Collectchat: from n/a through 2.4.1.

    Collect.chat collectchat
  • Medium 6.5
    CVE-2024-30437

    WordPress Webinar and Video Conference with Jitsi Meet plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference with Jitsi Meet: from n/a through 2.6.3.

    WPPOOL Webinar and Video Conference with Jitsi Meet
  • Medium 6.5
    CVE-2024-30438

    WordPress Print Page block plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Print Page block allows Stored XSS.This issue affects Print Page block: from n/a through 1.0.8.

    bPlugins Print Page block
  • Medium 5.9
    CVE-2024-30440

    WordPress Themify Event Post plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Themify Event Post allows Stored XSS.This issue affects Themify Event Post: from n/a through 1.2.7.

    Themify Themify Event Post
  • Medium 6.5
    CVE-2024-30442

    WordPress Bold Page Builder plugin <= 4.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 4.8.0.

    Bold Themes Bold Page Builder
  • Medium 6.5
    CVE-2024-30443

    WordPress GS Testimonial Slider plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Testimonial Slider allows Stored XSS.This issue affects GS Testimonial Slider: from n/a through 3.1.4.

    GS Plugins GS Testimonial Slider
  • Medium 5.9
    CVE-2024-30444

    WordPress WordPress Page Builder – Zion Builder plugin <= 3.6.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zionbuilder.Io WordPress Page Builder – Zion Builder allows Stored XSS.This issue affects WordPress Page Builder – Zion Builder: from n/a through 3.6.9.

    zionbuilder.io WordPress Page Builder – Zion Builder Web / CMS
  • Medium 6.5
    CVE-2024-30445

    WordPress Web Icons plugin <= 1.0.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab, Inc. Web Icons allows Stored XSS.This issue affects Web Icons: from n/a through 1.0.0.10.

    GhozyLab Web Icons
  • Medium 6.5
    CVE-2024-30446

    WordPress CRM Perks Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms allows Stored XSS.This issue affects CRM Perks Forms: from n/a through 1.1.4.

    CRM Perks CRM Perks Forms
  • Medium 5.9
    CVE-2024-30448

    WordPress Slider by Supsystic plugin <= 1.8.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic Slider by Supsystic allows Stored XSS.This issue affects Slider by Supsystic: from n/a through 1.8.10.

    supsystic Slider by Supsystic
  • Medium 6.5
    CVE-2024-30450

    WordPress OpenStreetMap for Gutenberg and WPBakery Page Builder plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Step-Byte-Service GmbH OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) allows Stored XSS.This issue affects OpenStreetMap fo…

    Step-Byte-Service OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
  • Medium 6.5
    CVE-2024-30451

    WordPress Geo Controller plugin <= 8.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INFINITUM FORM Geo Controller allows Stored XSS.This issue affects Geo Controller: from n/a through 8.6.4.

    INFINITUM FORM Geo Controller
  • Medium 5.9
    CVE-2024-30452

    WordPress Landing Page Builder plugin <= 1.5.1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Stored XSS.This issue affects Landing Page Builder: from n/a through 1.5.1.7.

    PluginOps Landing Page Builder
  • Medium 5.4
    CVE-2024-30453

    WordPress Brave plugin <= 0.6.5 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.6.5.

    Brave Brave Popup Builder
  • Medium 4.3
    CVE-2024-30455

    WordPress GamiPress plugin <= 6.8.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 6.8.5.

    GamiPress GamiPress
  • Medium 4.3
    CVE-2024-30460

    WordPress Tumult Hype Animations plugin <= 1.9.11 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tumult Inc Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through 1.9.11.

    Tumult Tumult Hype Animations
  • Medium 4.3
    CVE-2024-30454

    WordPress WP SMS plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.6.2.

    VeronaLabs WP SMS
  • Medium 5.7
    CVE-2024-25944

    Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. An unauthenticated remote attack…

    Dell Dell OpenManage Enterprise
  • Medium 4.3
    CVE-2024-30462

    WordPress HUSKY plugin <= 1.3.5.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.5.1.

    RealMag777 HUSKY – Products Filter for WooCommerce (formerly WOOF) Web / CMS
  • Medium 4.3
    CVE-2024-30463

    WordPress BEAR plugin <= 1.1.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in realmag777 BEAR.This issue affects BEAR: from n/a through 1.1.4.3.

    RealMag777 BEAR
  • Medium 4.3
    CVE-2024-30468

    WordPress All-In-One Security (AIOS) – Security and Firewall plugin <= 5.2.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6.

    All In One WP Security & Firewall Team All In One WP Security & Firewall
  • Medium 5.3
    CVE-2024-30477

    WordPress Klarna Payments for WooCommerce plugin <= 3.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Klarna Klarna Payments for WooCommerce.This issue affects Klarna Payments for WooCommerce: from n/a through 3.2.4.

    Klarna Klarna Payments for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2024-30482

    WordPress Simple Revisions Delete plugin <= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Brice CAPOBIANCO Simple Revisions Delete.This issue affects Simple Revisions Delete: from n/a through 1.5.3.

    Brice Capobianco Simple Revisions Delete
  • Medium 4.3
    CVE-2024-30518

    WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeLocation Custom WooCommerce Checkout Fields Editor.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through 1.3.0.

    themelocation Custom WooCommerce Checkout Fields Editor Web / CMS
  • Medium 5.4
    CVE-2024-30521

    WordPress Landingi Landing Pages plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Landingi Landingi Landing Pages.This issue affects Landingi Landing Pages: from n/a through 3.1.1.

    Landingi Landingi Landing Pages
  • Medium 6.5
    CVE-2024-30513

    WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.

    Metagauss ProfileGrid
  • Medium 5.3
    CVE-2024-30469

    WordPress Wholesale For WooCommerce plugin <= 2.3.0 - Unauthenticated Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.

    WP Experts Wholesale For WooCommerce Web / CMS