Skip to content
OpenAdvisories

Archive

18 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /18 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 6.1
    CVE-2024-28063

    Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS.

  • Medium 4.3
    CVE-2024-36050

    Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current sour…

    nix nix Debian Ubuntu
  • Medium 6.1
    CVE-2024-36043

    question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.

  • Medium 5.4
    CVE-2024-34083

    STARTTLS unencrypted commands injection

    aiosmptd is a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could b…

    aio-libs aiosmtpd aiosmtpd python-aiosmtpd Debian Ubuntu PyPI
  • Medium 6.4
    CVE-2024-5088

    Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authen…

    thehappymonster Happy Addons for Elementor Web / CMS
  • Medium 6.4
    CVE-2024-4432

    Piotnet Addons For Elementor <= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

    The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.4.26 due to insufficient input sanitization and output escaping on user supplied attributes. Th…

    piotnetdotcom Piotnet Addons For Elementor Web / CMS
  • Medium 6.4
    CVE-2024-4698

    Testimonial Carousel For Elementor <= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'show_line_text ' and 'slide_button_hover_animation' parameters in versions up to, and including, 10.1.1 due to insufficient input sanitization an…

    UAPP GROUP Testimonial Carousel For Elementor Web / CMS
  • Medium 6.4
    CVE-2024-4709

    Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘subject’ parameter in versions up to, and including, 5.1.16 due to insufficient input sanitiza…

    techjewel Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Web / CMS
  • Medium 6.4
    CVE-2024-2772

    Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting

    The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization a…

    techjewel Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Web / CMS
  • Medium 6.4
    CVE-2024-3811

    Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Salient Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'icon' shortcode in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This…

    Theme nectar Salient Shortcodes Web / CMS
  • Medium 6.4
    CVE-2024-4849

    WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter

    The WordPress Automatic Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 3.94.0 due to insufficient input sanitization and output escaping. This makes it possible for a…

    ValvePress WordPress Automatic Plugin Web / CMS
  • Medium 6.4
    CVE-2024-4891

    Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 4.5.12 due to insufficient input sanitization and output…

    wpdevteam Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Web / CMS
  • Medium 6.4
    CVE-2024-3714

    GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'give_form' shortcode when used with a legacy form in all versions up to, and including, 3.10.0 due to insufficient input …

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Medium 6.4
    CVE-2024-4374

    DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

    The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This ma…

    Detheme DethemeKit For Elementor Web / CMS
  • Medium 6.4
    CVE-2024-4865

    Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter

    The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_id’ parameter in all versions up to, and including, 3.10.8 due to insufficient input sanitization and output escaping. This makes it possible for authen…

    thehappymonster Happy Addons for Elementor Web / CMS