Skip to content
OpenAdvisories

Archive

18 July 2024

Vulnerabilities first published on this day (UTC), newest first.

← June 2024 2024 / July /18 August 2024 →
  1. 1121
  2. 2135
  3. 360
  4. 438
  5. 566
  6. 624
  7. 74
  8. 866
  9. 9474
  10. 10122
  11. 1181
  12. 12201
  13. 1349
  14. 1411
  15. 1588
  16. 16255
  17. 1788
  18. 1849
  19. 1950
  20. 2083
  21. 2178
  22. 22136
  23. 2338
  24. 2485
  25. 2547
  26. 2672
  27. 2729
  28. 2827
  29. 29280
  30. 30171
  31. 31111
All Critical High Medium Low Exploited only Public exploit

49 results · Feed

  • Medium 5.4
    CVE-2023-6708

    SVG Support <= 2.5.7 - Authenticated (Author+) Cross-Site Scripting via SVG

    The SVG Support plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping, even when the 'Sanitize SVG while uploading' f…

    Benbodhi SVG Support Web / CMS
  • Medium 4.3
    CVE-2024-6599

    Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification

    The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attacke…

    mekshq Meks Video Importer Web / CMS
  • Medium 5.5
    CVE-2024-6705

    RegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The RegLevel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with …

    Eric Mann RegLevel Web / CMS
  • Medium 6.4
    CVE-2024-5964

    Zenon Lite <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode

    The Zenon Lite theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it pos…

    tislam100 Zenon Lite Web / CMS
  • High 8.8
    CVE-2024-5726

    Timeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injection

    The Timeline Event History plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1 via deserialization of untrusted input 'timelines-data' parameter. This makes it possible for authenticated attackers, with Contrib…

    wpdiscover Timeline Event History Web / CMS
  • Medium 5.4
    CVE-2024-6175

    Booking Ultra Pro <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates

    The Booking Ultra Pro Appointments Booking Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the multiple functions called via AJAX like save_fields_settings, bup_delete_user_avatar, b…

    Deetronix Booking Ultra Pro Appointments Booking Calendar Plugin Web / CMS
  • Critical 9.8
    CVE-2024-39173

    calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function…

  • Medium 6.1
    CVE-2024-39090 Public exploit

    The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forge…

  • Critical 9.8
    CVE-2024-41184

    In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur. NOTE:…

    keepalived keepalived keepalived Debian Ubuntu Azure Linux