Skip to content
OpenAdvisories

Archive

May 2024

Vulnerabilities first published in this month (UTC), newest first.

← April 2024 2024 / May June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

2,009 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-31341

    WordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerability

    Insufficient Verification of Data Authenticity vulnerability in Cozmoslabs Profile Builder allows Functionality Bypass.This issue affects Profile Builder: from n/a through 3.11.2.

    Cozmoslabs Profile Builder
  • Medium 5.3
    CVE-2024-32131

    WordPress Download Manager plugin <= 3.2.82 - File Password Lock Bypass vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in W3 Eden Inc. Download Manager allows Functionality Bypass.This issue affects Download Manager: from n/a through 3.2.82.

    W3 Eden Download Manager
  • Medium 4.3
    CVE-2024-32790

    WordPress Pricing Table by Supsystic plugin <= 1.9.12 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Supsystic Pricing Table by Supsystic allows Code Injection.This issue affects Pricing Table by Supsystic: from n/a through 1.9.12.

    supsystic Pricing Table by Supsystic
  • Medium 5.3
    CVE-2024-33917

    WordPress WTI Like Post plugin <= 1.4.6 - IP Restriction Bypass Vulnerability vulnerability

    Authentication Bypass by Spoofing vulnerability in webtechideas WTI Like Post allows Functionality Bypass.This issue affects WTI Like Post: from n/a through 1.4.6.

    webtechideas WTI Like Post
  • Medium 6.5
    CVE-2024-34434

    WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.2 - Arbitrary Shortcode Execution vulnerability

    Incorrect Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Inclusion, Functionality Misuse.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.2.

    RealMag777 WordPress Meta Data and Taxonomies Filter (MDTF) Web / CMS
  • Medium 5.5
    CVE-2024-35110

    A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.c…

  • Medium 5.3
    CVE-2023-34186

    WordPress Headless CMS plugin <= 2.0.3 - Broken Authentication vulnerability

    Missing Authorization vulnerability in Imran Sayed Headless CMS.This issue affects Headless CMS: from n/a through 2.0.3.

    Imran Sayed Headless CMS
  • Medium 5.3
    CVE-2023-33321

    WordPress EventPrime plugin <= 2.8.6 - Sensitive Data Exposure

    Missing Authorization vulnerability in Metagauss EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 2.8.6.

    Metagauss EventPrime
  • Medium 6.0
    CVE-2023-33310

    WordPress Unite Gallery Lite plugin <= 1.7.59 - Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Valiano Unite Gallery Lite allows PHP Local File Inclusion.This issue affects Unite Gallery Lite: from n/a through 1.7.59.

    Valiano Unite Gallery Lite
  • Medium 4.3
    CVE-2023-32129

    WordPress Editorialmag theme <= 1.1.9 - Authenticated Arbitrary Plugin Activation

    Missing Authorization vulnerability in Sparkle WP Editorialmag editorialmag.This issue affects Editorialmag: from n/a through 1.1.9.

    Sparkle WP Editorialmag
  • Medium 6.8
    CVE-2023-24379

    WordPress Landing Page Builder – Free Landing Page Templates plugin <= 3.1.9.9 - Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Web-Settler Landing Page Builder – Free Landing Page Templates allows Path Traversal.This issue affects Landing Page Builder – Free Landing Page Templates: from n/…

    Web-Settler Landing Page Builder – Free Landing Page Templates
  • Medium 4.9
    CVE-2023-23872

    WordPress GMAce plugin <= 1.5.2 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in German Mesky GMAce allows Path Traversal.This issue affects GMAce: from n/a through 1.5.2.

    German Mesky GMAce
  • Medium 5.3
    CVE-2022-45070

    WordPress Conditional Checkout Fields for WooCommerce plugin <= 1.2.3 - Broken Authentication vulnerability

    Missing Authorization vulnerability in FmeAddons Conditional Checkout Fields for WooCommerce.This issue affects Conditional Checkout Fields for WooCommerce: from n/a through 1.2.3.

    fmeaddons Conditional Checkout Fields for WooCommerce Web / CMS
  • Medium 5.0
    CVE-2022-44581

    WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability

    Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.

    WPMU DEV Defender Security
  • Medium 6.5
    CVE-2024-32800

    WordPress Popup – Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Felix Moira Popup More Popups allows Stored XSS.This issue affects Popup More Popups: from n/a through 2.3.1.

    Felix Moira Popup More Popups
  • Medium 6.5
    CVE-2024-34567

    WordPress Easy Notify Lite plugin <= 1.1.29 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 1.1.29.

    GhozyLab Popup Builder
  • Medium 6.5
    CVE-2024-34575

    WordPress DethemeKit For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in deTheme DethemeKit For Elementor allows Stored XSS.This issue affects DethemeKit For Elementor: from n/a through 2.1.2.

    Detheme DethemeKit For Elementor
  • Medium 6.1
    CVE-2024-3580

    Popup4Phone <= 1.3.2 - Editor+ Stored XSS

    The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for …

    Web / CMS
  • Medium 6.1
    CVE-2024-3231 Scanner template

    Popup4Phone <= 1.3.2 - Unauthenticated Stored XSS

    The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.

    Web / CMS
  • Medium 4.3
    CVE-2024-2744

    Nextgen Gallery < 3.59.1 - Admin+ Stored XSS

    The NextGEN Gallery WordPress plugin before 3.59.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

    Web / CMS
  • Medium 6.5
    CVE-2024-2697

    Swift Framework < 2024.0.0 - Contributor+ Stored XSS via Shortcode

    The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting…

    Web / CMS
  • Medium 6.5
    CVE-2024-34757

    WordPress Borderless plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visualmodo Borderless borderless allows DOM-Based XSS.This issue affects Borderless: from n/a through <= 1.7.3.

    visualmodo Borderless
  • Medium 6.4
    CVE-2024-3134

    Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title_html_tag attribute in all versions up to, and including, 2.0.6.0 due to insufficient …

    litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Web / CMS
  • Medium 5.3
    CVE-2021-33146

    Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmwa…

  • Medium 6.0
    CVE-2021-33142

    Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmwa…

  • Medium 6.1
    CVE-2023-28383

    Improper conditions check in some Intel(R) BIOS PPAM firmware may allow a privileged user to potentially enable escalat…

  • Medium 6.7
    CVE-2023-35192

    Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.3 may allow an authenticated user …

  • Medium 6.7
    CVE-2023-41961

    Uncontrolled search path in some Intel(R) GPA software before version 2023.3 may allow an authenticated user to potenti…

  • Medium 5.9
    CVE-2023-48368

    Improper input validation in Intel(R) Media SDK software all versions may allow an authenticated user to potentially en…

    intel-mediasdk intel-mediasdk onevpl-intel-gpu Debian Ubuntu
  • Medium 4.8
    CVE-2023-45221

    Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable e…

    intel-mediasdk intel-mediasdk onevpl-intel-gpu Debian Ubuntu
  • Medium 6.7
    CVE-2023-43751

    Uncontrolled search path in Intel(R) Graphics Command Center Service bundled in some Intel(R) Graphics Windows DCH driv…

    Windows
  • Medium 6.7
    CVE-2023-42433

    Incorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an a…

  • Medium 6.7
    CVE-2023-42668

    Incorrect default permissions in some onboard video driver software before version 1.14 for Intel(R) Server Boards base…

  • Medium 6.5
    CVE-2024-22015

    Improper input validation for some Intel(R) DLB driver software before version 8.5.0 may allow an authenticated user to…

  • Medium 6.7
    CVE-2023-39929

    Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated…

    libva libva Ubuntu Azure Linux
  • Medium 4.4
    CVE-2023-41082

    Null pointer dereference for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to pot…

  • Medium 4.4
    CVE-2023-39433

    Improper access control for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to pote…

  • Medium 6.7
    CVE-2023-40155

    Uncontrolled search path for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to pot…

  • Medium 4.7
    CVE-2023-43487

    Improper access control in some Intel(R) CST before version 2.1.10300 may allow an authenticated user to potentially en…

  • Medium 6.7
    CVE-2023-45743

    Uncontrolled search path in some Intel(R) DSA software uninstallers before version 23.4.39.10 may allow an authenticate…