Skip to content
OpenAdvisories

Archive

20 July 2024

Vulnerabilities first published on this day (UTC), newest first.

← June 2024 2024 / July /20 August 2024 →
  1. 1121
  2. 2135
  3. 360
  4. 438
  5. 566
  6. 624
  7. 74
  8. 866
  9. 9474
  10. 10122
  11. 1181
  12. 12201
  13. 1349
  14. 1411
  15. 1588
  16. 16255
  17. 1788
  18. 1849
  19. 1950
  20. 2083
  21. 2178
  22. 22136
  23. 2338
  24. 2485
  25. 2547
  26. 2672
  27. 2729
  28. 2827
  29. 29280
  30. 30171
  31. 31111
All Critical High Medium Low Exploited only Public exploit

63 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-38703

    WordPress WP Event Aggregator plugin <= 1.7.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7.9.

    Xylus Themes WP Event Aggregator
  • Medium 6.5
    CVE-2024-38705

    WordPress ElementInvader Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ElementInvader ElementInvader Addons for Elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through 1.2.4.

    Element Invader ElementInvader Addons for Elementor
  • Medium 5.9
    CVE-2024-38710

    WordPress Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin <= 2.0.6.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.6.2.

    Jewel Theme Master Addons for Elementor
  • Medium 6.5
    CVE-2024-38712

    WordPress Qi Blocks plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: from n/a through <= 1.3.

    QODE Qi Blocks
  • Medium 6.5
    CVE-2024-38713

    WordPress WP Photo Album Plus plugin <= 8.8.02.002 - Authenticated Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.02.002.

    J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus
  • Medium 6.5
    CVE-2024-38718

    WordPress Download Button for Elementor plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in clicklabs® Medienagentur Download Button for Elementor allows Stored XSS.This issue affects Download Button for Elementor: from n/a through 1.2.1.

    clicklabs® Medienagentur Download Button for Elementor
  • Medium 6.5
    CVE-2024-38720

    WordPress EazyDocs plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EazyDocs eazydocs allows Stored XSS.This issue affects EazyDocs: from n/a through 2.5.0.

    Spider Themes EazyDocs
  • Medium 6.5
    CVE-2024-38722

    WordPress Job Board Manager plugin <= 2.1.57 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows Stored XSS.This issue affects Job Board Manager: from n/a through 2.1.57.

    PickPlugins Job Board Manager
  • Medium 5.9
    CVE-2024-38725

    WordPress Admin Dashboard RSS Feed plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webstix Admin Dashboard RSS Feed allows Stored XSS.This issue affects Admin Dashboard RSS Feed: from n/a through 3.1.

    Webstix Admin Dashboard RSS Feed
  • Medium 5.9
    CVE-2024-38738

    WordPress Change From Email plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Marian Kadanka Change From Email allows Stored XSS.This issue affects Change From Email: from n/a through 1.2.1.

    Marian Kadanka Change From Email
  • Medium 5.1
    CVE-2024-38739

    WordPress OnePress theme <= 2.3.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in FameThemes OnePress allows Stored XSS.This issue affects OnePress: from n/a through 2.3.8.

    famethemes OnePress
  • Medium 6.5
    CVE-2024-38741

    WordPress Amazing Hover Effects plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Noor-E-Alam Amazing Hover Effects allows Stored XSS.This issue affects Amazing Hover Effects: from n/a through 2.4.9.

    Noor-E-Alam Amazing Hover Effects
  • Medium 6.5
    CVE-2024-38750

    WordPress Advanced post slider plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in digontoahsan Advanced post slider.This issue affects Advanced post slider: from n/a through 3.0.0.

    digontoahsan Advanced post slider
  • Medium 6.5
    CVE-2024-38757

    WordPress Typebot plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Typebot allows Stored XSS.This issue affects Typebot: from n/a through 3.6.0.

    Typebot Typebot
  • Medium 6.5
    CVE-2024-38767

    WordPress BSK PDF Manager plugin <= 3.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BannerSky.Com BSK PDF Manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.6.

    BannerSky.com BSK PDF Manager
  • Medium 4.9
    CVE-2024-38758

    WordPress WappPress plugin <= 6.0.4 - Blind Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 6.0.4.

    WappPress Team WappPress
  • Medium 5.3
    CVE-2024-6489

    Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update

    The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_google_api_key function in all versions up to, and including, 2.0.10. This makes it possible for authenticated a…

    jetmonsters Getwid – Gutenberg Blocks Web / CMS
  • Medium 4.3
    CVE-2024-6491

    Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update

    The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mailchimp_api_key_manage function in all versions up to, and including, 2.0.10. This makes it possible for authentic…

    jetmonsters Getwid – Gutenberg Blocks Web / CMS
  • Medium 6.5
    CVE-2024-3934

    Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download

    The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog function. This makes it possible for authenticated attackers, with subscriber-level access and above, to d…

    claudiosanches Mercado Pago payments for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2024-6560

    Addonify – Quick View For WooCommerce <= 1.2.16 - Unauthenticated Full Path Dislcosure

    The Addonify – Quick View For WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.16. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possi…

    Addonify Addonify – Quick View For WooCommerce Web / CMS
  • Medium 6.4
    CVE-2024-2337

    Easy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonials_grid ' shortcode in all versions up to, and including, 3.9.5 due to insufficient input sanitization and output escaping on user supplied att…

    ghuger Easy Testimonials Web / CMS
  • Medium 4.3
    CVE-2024-5804

    Conditional Fields for Contact Form 7 <= 2.4.13 - Cross-Site Request Forgery to Plugin Setting Reset

    The Conditional Fields for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.13. This is due to missing or incorrect nonce validation on the wpcf7cf_admin_init function. This makes it possibl…

    Jules Colle Conditional Fields for Contact Form 7 Web / CMS
  • Medium 6.1
    CVE-2024-40347

    A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform 23.2.1-r96 allows attackers to execute…