Skip to content
OpenAdvisories

Archive

8 June 2024

Vulnerabilities first published on this day (UTC), newest first.

← May 2024 2024 / June /8 July 2024 →
  1. 121
  2. 210
  3. 3117
  4. 4187
  5. 5116
  6. 6179
  7. 7136
  8. 878
  9. 9107
  10. 10149
  11. 11227
  12. 12113
  13. 13321
  14. 14156
  15. 1530
  16. 1626
  17. 1775
  18. 1865
  19. 19223
  20. 20159
  21. 21137
  22. 2222
  23. 239
  24. 2497
  25. 25144
  26. 2682
  27. 27111
  28. 2880
  29. 2916
  30. 3021
All Critical High Medium Low Exploited only Public exploit

50 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-35755

    WordPress Weather Widget Pro plugin <= 1.1.40 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in El tiempo Weather Widget Pro allows Stored XSS.This issue affects Weather Widget Pro: from n/a through 1.1.40.

    El tiempo Weather Widget Pro
  • Medium 5.9
    CVE-2024-35756

    WordPress Tooltip CK plugin <= 2.2.15 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CeiKay Tooltip CK tooltip-ck allows Stored XSS.This issue affects Tooltip CK: from n/a through 2.2.15.

    CeiKay Tooltip CK
  • Medium 6.5
    CVE-2024-5654

    CF7 Google Sheets Connector <= 5.0.9 - Missing Authorization to Limited Site Configuration Update

    The CF7 Google Sheets Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'execute_post_data_cg7_free' function in all versions up to, and including, 5.0.9. This makes it possible for unau…

    westerndeal GSheetConnector for CF7 – Connect Contact Form 7 to Google Sheets and Send Form Submissions in Real Time Web / CMS
  • Medium 4.3
    CVE-2024-4468

    Salon booking system <= 9.9 - Missing Authorization

    The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admin_init in all versions up to, and including, 9.9. This makes it possible for aut…

    wordpresschef Salon Booking System – Free Version Web / CMS
  • Medium 6.1
    CVE-2024-5613

    Formula <= 0.5.1 - Reflected Cross-Site Scripting via quality_customizer_notify_dismiss_action

    The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'quality_customizer_notify_dismiss_action' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and output …

    awordpresslife Formula Web / CMS
  • Medium 6.1
    CVE-2024-5638

    Formula <= 0.5.1 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins

    The Formula theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in the 'ti_customizer_notify_dismiss_recommended_plugins' AJAX action in all versions up to, and including, 0.5.1 due to insufficient input sanitization and…

    awordpresslife Formula Web / CMS
  • Medium 6.3
    CVE-2024-5087

    Minimal Coming Soon – Coming Soon Page <= 2.38 - Missing Authorization to Limited Settings Change

    The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validate_ajax, deactivate_ajax, and save_ajax functions in all versions up to, and including, 2.38. Thi…

    webfactory Minimal Coming Soon – Coming Soon Page Web / CMS
  • Medium 4.3
    CVE-2024-4661

    WP Reset <= 2.02 - Missing Authorization to License Key Modification

    The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all versions up to, and including, 2.02. This makes it possible for authenticated attackers, with subscriber-le…

    webfactory WP Reset Web / CMS
  • Medium 4.2
    CVE-2024-5770

    WP Force SSL & HTTPS SSL Redirect <= 1.66 - Missing Authorization to Settings Update

    The WP Force SSL & HTTPS SSL Redirect plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_setting' function in versions up to, and including, 1.66. This makes it possible for authenticate…

    webfactory WP Force SSL & HTTPS SSL Redirect Web / CMS
  • Medium 6.4
    CVE-2024-5663

    Cards for Beaver Builder <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Cards Widget

    The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Cards widget in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. Th…

    Pratik Chaskar Cards for Beaver Builder Web / CMS