Skip to content
OpenAdvisories

Archive

March 2024

Vulnerabilities first published in this month (UTC), newest first.

← February 2024 2024 / March April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

3,317 results · Feed

  • Medium 6.4
    CVE-2024-2142

    Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget

    The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Info Table widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it pos…

    Brainstorm Force Ultimate Addons for Beaver Builder – Lite Web / CMS
  • Medium 6.4
    CVE-2024-2141

    Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget

    The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possibl…

    Brainstorm Force Ultimate Addons for Beaver Builder – Lite Web / CMS
  • Medium 6.4
    CVE-2024-2143

    Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget

    The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes it possib…

    Brainstorm Force Ultimate Addons for Beaver Builder – Lite Web / CMS
  • Medium 6.4
    CVE-2024-2144

    Ultimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget

    The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Separator widget in all versions up to, and including, 1.5.7 due to insufficient input sanitization and output escaping. This makes i…

    Brainstorm Force Ultimate Addons for Beaver Builder – Lite Web / CMS
  • Medium 6.4
    CVE-2024-1238

    ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button ID parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for a…

    roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor Web / CMS
  • Medium 6.4
    CVE-2024-1051

    List category posts <= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.89.6 due to insufficient input sanitization and output escaping on user supplied attributes …

    fernandobt List category posts Web / CMS
  • Critical 10.0
    CVE-2024-2086

    Integrate Google Drive <= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and Export

    The Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a …

    princeahmed File Manager for Google Drive – Integrate Google Drive Web / CMS
  • Medium 6.4
    CVE-2024-0367

    Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link

    The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link field of an installed widget (e.g., 'Button Link') in all versions up to, and including, 1.5.96 due to insufficient input sanitization and outp…

    unitecms Unlimited Elements For Elementor Web / CMS
  • Medium 6.4
    CVE-2024-2794

    Gutenberg Block Editor Toolkit – EditorsKit <= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Gutenberg Block Editor Toolkit – EditorsKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'editorskit' shortcode in all versions up to, and including, 1.40.4 due to insufficient input sanitization and output escaping o…

    Munir Kamal Gutenberg Block Editor Toolkit – EditorsKit Web / CMS
  • Medium 6.4
    CVE-2024-1692

    BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description

    The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the meta description field in all versions up to, and including, 1.6.13 due to insufficient input sanitization and output escaping on user s…

    Bold Grid BoldGrid Easy SEO – Simple and Effective SEO Web / CMS
  • High 8.8
    CVE-2024-2047

    ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw

    The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.6 via the render_raw function. This makes it possible for authenticated attackers, with contributor-level access and above, t…

    roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor Web / CMS
  • Critical 9.8
    CVE-2024-28288

    Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrat…

  • Medium 6.5
    CVE-2024-29278 Public exploit

    funboot v1.1 is vulnerable to Cross Site Scripting (XSS) via the title field in "create a message ."

  • High 7.1
    CVE-2024-30431

    WordPress Mang Board WP plugin <= 1.8.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hometory Mang Board WP allows Reflected XSS.This issue affects Mang Board WP: from n/a through 1.8.0.

    Hometory Mang Board WP
  • Medium 6.5
    CVE-2024-30432

    WordPress B Slider plugin <= 1.1.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider - Slider for your block editor allows Stored XSS.This issue affects B Slider - Slider for your block editor: from n/a through 1.1.12.

    bPlugins B Slider - Slider for your block editor
  • Medium 6.5
    CVE-2024-30433

    WordPress MultiVendorX Marketplace plugin <= 4.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MultiVendorX WC Marketplace allows Stored XSS.This issue affects WC Marketplace: from n/a through 4.1.3.

    MultiVendorX WC Marketplace
  • Medium 5.9
    CVE-2024-30434

    WordPress WP-CRM System plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP-CRM System allows Stored XSS.This issue affects WP-CRM System: from n/a through 3.2.9.

  • High 7.1
    CVE-2024-30435

    WordPress Nexter Blocks plugin <= 3.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor.This issue affects Nexter Blocks: from n/a through <= 3.2.5.

    POSIMYTH Nexter Blocks
  • Medium 6.5
    CVE-2024-30436

    WordPress Collect.chat plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Collect.Chat Inc. Collectchat allows Stored XSS.This issue affects Collectchat: from n/a through 2.4.1.

    Collect.chat collectchat
  • Medium 6.5
    CVE-2024-30437

    WordPress Webinar and Video Conference with Jitsi Meet plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Webinar and Video Conference with Jitsi Meet allows Stored XSS.This issue affects Webinar and Video Conference with Jitsi Meet: from n/a through 2.6.3.

    WPPOOL Webinar and Video Conference with Jitsi Meet
  • Medium 6.5
    CVE-2024-30438

    WordPress Print Page block plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Print Page block allows Stored XSS.This issue affects Print Page block: from n/a through 1.0.8.

    bPlugins Print Page block
  • High 7.1
    CVE-2024-30439

    WordPress Limit Attempts by BestWebSoft plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BestWebSoft Limit Attempts by BestWebSoft allows Reflected XSS.This issue affects Limit Attempts by BestWebSoft: from n/a through 1.2.9.

    bestwebsoft Limit Attempts by BestWebSoft
  • Medium 5.9
    CVE-2024-30440

    WordPress Themify Event Post plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Themify Event Post allows Stored XSS.This issue affects Themify Event Post: from n/a through 1.2.7.

    Themify Themify Event Post
  • High 7.1
    CVE-2024-30441

    WordPress Combo Blocks plugin <= 2.2.74 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid allows Reflected XSS.This issue affects Post Grid: from n/a through 2.2.74.

    PickPlugins Post Grid
  • Medium 6.5
    CVE-2024-30442

    WordPress Bold Page Builder plugin <= 4.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldThemes Bold Page Builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 4.8.0.

    Bold Themes Bold Page Builder
  • Medium 6.5
    CVE-2024-30443

    WordPress GS Testimonial Slider plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Testimonial Slider allows Stored XSS.This issue affects GS Testimonial Slider: from n/a through 3.1.4.

    GS Plugins GS Testimonial Slider
  • Medium 5.9
    CVE-2024-30444

    WordPress WordPress Page Builder – Zion Builder plugin <= 3.6.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zionbuilder.Io WordPress Page Builder – Zion Builder allows Stored XSS.This issue affects WordPress Page Builder – Zion Builder: from n/a through 3.6.9.

    zionbuilder.io WordPress Page Builder – Zion Builder Web / CMS
  • Medium 6.5
    CVE-2024-30445

    WordPress Web Icons plugin <= 1.0.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab, Inc. Web Icons allows Stored XSS.This issue affects Web Icons: from n/a through 1.0.0.10.

    GhozyLab Web Icons
  • Medium 6.5
    CVE-2024-30446

    WordPress CRM Perks Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms allows Stored XSS.This issue affects CRM Perks Forms: from n/a through 1.1.4.

    CRM Perks CRM Perks Forms
  • High 7.1
    CVE-2024-30447

    WordPress Creative Image Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Solutions Creative Image Slider – Responsive Slider Plugin allows Reflected XSS.This issue affects Creative Image Slider – Responsive Slider Plugin:…

    Creative-Solutions Creative Image Slider – Responsive Slider Plugin
  • Critical 10.0
    CVE-2024-3094 Public exploit EPSS 91%

    Xz: malicious code in distributed source

    Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is the…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Alpine
  • Medium 5.9
    CVE-2024-30448

    WordPress Slider by Supsystic plugin <= 1.8.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Supsystic Slider by Supsystic allows Stored XSS.This issue affects Slider by Supsystic: from n/a through 1.8.10.

    supsystic Slider by Supsystic
  • High 7.1
    CVE-2024-30449

    WordPress Booking Activities plugin <= 1.15.19 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Activities Team Booking Activities allows Reflected XSS.This issue affects Booking Activities: from n/a through 1.15.19.

    Booking Activities Team Booking Activities
  • Medium 6.5
    CVE-2024-30450

    WordPress OpenStreetMap for Gutenberg and WPBakery Page Builder plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Step-Byte-Service GmbH OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) allows Stored XSS.This issue affects OpenStreetMap fo…

    Step-Byte-Service OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer)
  • Medium 6.5
    CVE-2024-30451

    WordPress Geo Controller plugin <= 8.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INFINITUM FORM Geo Controller allows Stored XSS.This issue affects Geo Controller: from n/a through 8.6.4.

    INFINITUM FORM Geo Controller
  • Medium 5.9
    CVE-2024-30452

    WordPress Landing Page Builder plugin <= 1.5.1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder allows Stored XSS.This issue affects Landing Page Builder: from n/a through 1.5.1.7.

    PluginOps Landing Page Builder
  • Medium 5.4
    CVE-2024-30453

    WordPress Brave plugin <= 0.6.5 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.6.5.

    Brave Brave Popup Builder
  • Medium 4.3
    CVE-2024-30455

    WordPress GamiPress plugin <= 6.8.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in GamiPress.This issue affects GamiPress: from n/a through 6.8.5.

    GamiPress GamiPress
  • Medium 4.3
    CVE-2024-30460

    WordPress Tumult Hype Animations plugin <= 1.9.11 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tumult Inc Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through 1.9.11.

    Tumult Tumult Hype Animations
  • Medium 4.3
    CVE-2024-30454

    WordPress WP SMS plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.6.2.

    VeronaLabs WP SMS