Skip to content
OpenAdvisories

Archive

8 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /8 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

114 results · Feed

  • Medium 4.3
    CVE-2024-24833

    WordPress Happy Addons for Elementor plugin <= 3.10.1 - Broken Access Control on Post Clone vulnerability

    Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons.This issue affects Happy Addons for Elementor: from n/a through <= 3.10.1.

    HappyMonster Happy Addons for Elementor
  • High 7.6
    CVE-2024-31270

    WordPress ARForms Form Builder plugin <= 1.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Repute InfoSystems ARForms Form Builder.This issue affects ARForms Form Builder: from n/a through 1.6.1.

    Repute InfoSystems ARForms Form Builder
  • Medium 5.3
    CVE-2024-30459

    WordPress AI WP Writer plugin <= 3.6.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AIpost AI WP Writer.This issue affects AI WP Writer: from n/a through 3.6.5.

    aipost AI WP Writer
  • Medium 4.3
    CVE-2024-4233

    Broken Access Control vulnerability in multiple WordPress plugins by Tyche Softwares

    Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce, Tyche Softwares Arconix Shortcodes, Tyche Softwares Arconix FAQ.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4.8.1; A…

    Tyche Softwares Arconix Shortcodes Print Invoice & Delivery Notes for WooCommerce Arconix FAQ Web / CMS
  • High 7.7
    CVE-2024-1438

    WordPress Rolo Slider plugin <= 1.0.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PressFore Rolo Slider.This issue affects Rolo Slider: from n/a through 1.0.9.

    pressfore Rolo Slider
  • Low 3.5
    CVE-2024-4648

    Campcodes Complete Web-Based School Management System student_exam_mark_update_form.php cross site scripting

    A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /view/student_exam_mark_update_form.php. The manipulation of the argumen…

    Campcodes Complete Web-Based School Management System
  • Low 3.5
    CVE-2024-4647

    Campcodes Complete Web-Based School Management System student_first_payment.php cross site scripting

    A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /view/student_first_payment.php. The manipulation of the argume…

    Campcodes Complete Web-Based School Management System
  • Low 3.5
    CVE-2024-4646

    Campcodes Complete Web-Based School Management System student_payment_details.php cross site scripting

    A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /view/student_payment_details.php. The manipulation of the argument index leads to cross…

    Campcodes Complete Web-Based School Management System
  • Low 3.5
    CVE-2024-4645

    SourceCodester Prison Management System changepassword.php cross site scripting

    A vulnerability was found in SourceCodester Prison Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /Admin/changepassword.php. The manipulation of the argument txtold_password/txtnew_password/txtconfi…

    SourceCodester Prison Management System
  • Medium 6.5
    CVE-2022-40218

    WordPress TH Advance Product Search plugin <= 1.1.4 - Unauthenticated Plugin Settings Change vulnerability

    Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.1.4.

    ThemeHunk Advance WordPress Search Plugin Web / CMS
  • Medium 6.5
    CVE-2024-34414

    WordPress Raindrops theme <= 1.600 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nobita allows Stored XSS.This issue affects raindrops: from n/a through 1.600.

    Nobita raindrops
  • Medium 5.9
    CVE-2024-34546

    WordPress Sticky Social Link plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Sticky Social Link sticky-social-link allows DOM-Based XSS.This issue affects Sticky Social Link: from n/a through <= 2.0.1.

    Habibur Rahman Sticky Social Link
  • Medium 6.5
    CVE-2024-34547

    WordPress Magical Addons For Elementor plugin <= 1.1.34 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor alam Magical Addons For Elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through 1.1.34.

    Noor Alam Magical Addons For Elementor
  • Low 3.5
    CVE-2024-4644

    SourceCodester Prison Management System changepassword.php cross site scripting

    A vulnerability has been found in SourceCodester Prison Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /Employee/changepassword.php. The manipulation of the argument txtold_password/txtnew_password/txt…

    SourceCodester Prison Management System
  • Medium 6.5
    CVE-2024-34548

    WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit allows Stored XSS.This issue affects WidgetKit: from n/a through 2.4.8.

    Themesgrove WidgetKit
  • High 7.1
    CVE-2024-34553

    WordPress Stockholm Core plugin <= 2.4.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core allows Reflected XSS.This issue affects Stockholm Core: from n/a through 2.4.1.

    Select-Themes Stockholm Core
  • Medium 5.9
    CVE-2024-34558

    WordPress WOLF plugin <= 1.0.8.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WOLF allows Stored XSS.This issue affects WOLF: from n/a through 1.0.8.2.

    RealMag777 WOLF
  • Medium 5.9
    CVE-2024-34560

    WordPress gee Search Plus plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GOMO gee Search Plus allows Stored XSS.This issue affects gee Search Plus: from n/a through 1.4.4.

    GOMO gee Search Plus
  • Medium 5.9
    CVE-2024-34561

    WordPress Real3D Flipbook PDF Viewer Lite plugin <= 3.71 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin allows Stored XSS.This issue affects 3D FlipBook, PDF Vi…

    Creative interactive media 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin Web / CMS
  • Medium 6.5
    CVE-2024-34562

    WordPress Move Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moveaddons Move Addons for Elementor allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through 1.3.0.

    moveaddons Move Addons for Elementor
  • Medium 6.5
    CVE-2024-34563

    WordPress Gold Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoldAddons Gold Addons for Elementor allows Stored XSS.This issue affects Gold Addons for Elementor: from n/a through 1.2.9.

    GoldAddons Gold Addons for Elementor
  • Medium 6.5
    CVE-2024-34564

    WordPress Counter Up plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt Inc. Counter Up allows Stored XSS.This issue affects Counter Up: from n/a through 2.2.1.

    logichunt Counter Up
  • Medium 5.9
    CVE-2024-34565

    WordPress Debug Info plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debug Info allows Stored XSS.This issue affects Debug Info: from n/a through 1.3.10.

    AMP-MODE Debug Info
  • Medium 6.5
    CVE-2024-34566

    WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a through 3.3.0.

    Johan van der Wijk Content Blocks (Custom Post Widget)
  • Medium 5.9
    CVE-2024-34568 Public exploit

    WordPress LetterPress Newsletter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeqx LetterPress allows Stored XSS.This issue affects LetterPress: from n/a through 1.2.1.

    themeqx LetterPress
  • High 7.7
    CVE-2024-3507

    Privilege escalation vulnerability in Lunar

    Improper privilege management vulnerability in Lunar software that affects versions 6.0.2 through 6.6.0. This vulnerability allows an attacker to perform a secondary process injection into the Lunar application and abuse those rights to access sensitive user …

    Lunar Lunar
  • Medium 6.5
    CVE-2024-34569

    WordPress Zotpress plugin <= 7.3.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from n/a through <= 7.3.9.

    Katie Zotpress
  • Medium 5.9
    CVE-2024-34570

    WordPress Xpro Elementor Addons plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons allows Stored XSS.This issue affects Xpro Elementor Addons: from n/a through 1.4.3.

    Xpro Xpro Elementor Addons
  • Medium 6.5
    CVE-2024-34571

    WordPress Himalayas theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects Himalayas: from n/a through 1.3.0.

    ThemeGrill Himalayas
  • Medium 5.4
    CVE-2024-4135

    WP Latest Posts <= 5.0.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

    The WP Latest Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.7. This is due to the plugin allowing users to execute an action that does not properly validate a user-supplied value prior to u…

    JoomUnited WP Latest Posts Web / CMS
  • Medium 6.4
    CVE-2024-4281

    Link Library <= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcode

    The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions up to, and including, 7.6.11 due to insufficient input sanitization and output escaping on user supplied attributes. T…

    jackdewey Link Library Web / CMS
  • Medium 6.5
    CVE-2024-34572

    WordPress Fancy Elementor Flipbox plugin <= 2.4.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePrix Fancy Elementor Flipbox fancy-elementor-flipbox allows Stored XSS.This issue affects Fancy Elementor Flipbox: from n/a through 2.4.2.

    ThemePrix Fancy Elementor Flipbox
  • Medium 6.5
    CVE-2024-34573

    WordPress Pootle Pagebuilder plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pootlepress Pootle Pagebuilder – WordPress Page builder allows Stored XSS.This issue affects Pootle Pagebuilder – WordPress Page builder: from n/a through 5.…

    pootlepress Pootle Pagebuilder – WordPress Page builder Web / CMS
  • High 7.5
    CVE-2024-4438

    Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platform

    The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2023-39325/CVE-2023-44487, known as Rapid Reset. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2…

    Red Hat Red Hat OpenStack Platform 18.0 Red Hat OpenStack Platform 16.2 Red Hat OpenStack Platform 16.1
  • Medium 5.9
    CVE-2024-34574

    WordPress Table Maker plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpsoul Table Maker allows Stored XSS.This issue affects Table Maker: from n/a through 1.9.1.

    wpsoul Table Maker
  • High 7.5
    CVE-2024-4437

    Etcd: incomplete fix for cve-2021-44716 in openstack platform

    The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2021-44716. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red H…

    Red Hat Red Hat OpenStack Platform 18.0 Red Hat OpenStack Platform 16.2 Red Hat OpenStack Platform 17.1
  • High 7.5
    CVE-2024-4436

    Etcd: incomplete fix for cve-2022-41723 in openstack platform

    The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2022-41723. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red H…

    Red Hat Red Hat OpenStack Platform 16.2 Red Hat OpenStack Platform 18.0 Red Hat OpenStack Platform 17.1
  • Medium 6.5
    CVE-2023-41651

    WordPress Multi-column Tag Map plugin <= 17.0.26 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Multi-column Tag Map.This issue affects Multi-column Tag Map: from n/a through 17.0.26.

    Multi-column Tag Map Multi-column Tag Map
  • Medium 6.5
    CVE-2024-1076

    SSL Zen <= 4.5.3 - Unauthenticated Private Keys Access

    The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read …

    Web / CMS
  • Medium 6.4
    CVE-2024-3494

    Mesmerize Companion <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode

    The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerize_contact_form' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supp…

    Horea Radu Mesmerize Companion Web / CMS