Skip to content
OpenAdvisories

Archive

20 July 2024

Vulnerabilities first published on this day (UTC), newest first.

← June 2024 2024 / July /20 August 2024 →
  1. 1121
  2. 2135
  3. 360
  4. 438
  5. 566
  6. 624
  7. 74
  8. 866
  9. 9474
  10. 10122
  11. 1181
  12. 12201
  13. 1349
  14. 1411
  15. 1588
  16. 16255
  17. 1788
  18. 1849
  19. 1950
  20. 2083
  21. 2178
  22. 22136
  23. 2338
  24. 2485
  25. 2547
  26. 2672
  27. 2729
  28. 2827
  29. 29280
  30. 30171
  31. 31111
All Critical High Medium Low Exploited only Public exploit

83 results · Feed

  • High 7.1
    CVE-2024-38680

    WordPress Appmaker plugin <= 1.36.12 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Appmaker Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps allows Reflected XSS.This issue affects Appmaker – Convert WooCommerce to …

    Appmaker Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps Android iOS Web / CMS
  • Medium 6.5
    CVE-2024-38681

    WordPress Magical Addons For Elementor plugin <= 1.1.41 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Noor alam Magical Addons For Elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through 1.1.41.

    Noor Alam Magical Addons For Elementor
  • Medium 6.5
    CVE-2024-38682

    WordPress Post Layouts for Gutenberg plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Techeshta Post Layouts for Gutenberg allows Stored XSS.This issue affects Post Layouts for Gutenberg: from n/a through 1.2.7.

    techeshta Post Layouts for Gutenberg
  • High 7.1
    CVE-2024-38683

    WordPress WooCommerce Report plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in iThemelandCo WooCommerce Report allows Reflected XSS.This issue affects WooCommerce Report: from n/a through 1.4.5.

    ithemelandco WooCommerce Report Web / CMS
  • Medium 6.5
    CVE-2024-38684

    WordPress SlingBlocks plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in FunnelKit SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) allows Stored XSS.This issue affects SlingBlocks – Gutenberg Blocks by Fun…

    FunnelKit SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels)
  • Medium 5.9
    CVE-2024-38685

    WordPress WP Announcement plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SubscriptionPro WP Announcement allows Stored XSS.This issue affects WP Announcement: from n/a through 2.0.8.

    SubscriptionPro WP Announcement
  • Medium 6.5
    CVE-2024-38686

    WordPress FancyPost plugin <= 5.3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pluginic FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor allows Stored XSS.This issue affects Fan…

    Pluginic FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor
  • Medium 6.5
    CVE-2024-38687

    WordPress Sky Addons for Elementor plugin <= 2.5.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons.This issue affects Sky Addons for Elementor: from n/a through <= 2.5.5.

    wowdevs Sky Addons for Elementor
  • Critical 9.8
    CVE-2024-6636

    WooCommerce - Social Login <= 2.7.3 - Missing Authorization to Unauthenticated Privilege Escalation

    The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woo_slg_login_email' function in all versions up to, and including, 2.7.3. This makes it possible for unauthentica…

    WPWeb WooCommerce - Social Login Web / CMS
  • High 7.3
    CVE-2024-6635

    WooCommerce - Social Login <= 2.7.3 - Unauthenticated Authentication Bypass

    The WooCommerce - Social Login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.7.3. This is due to insufficient controls in the 'woo_slg_login_email' function. This makes it possible for unauthenticated attacker…

    WPWeb WooCommerce - Social Login Web / CMS
  • Medium 5.9
    CVE-2024-38689

    WordPress Simple Popup plugin <= 4.4 - Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Garrett Grimm Simple Popup allows Stored XSS.This issue affects Simple Popup: from n/a through 4.4.

    Garrett Grimm Simple Popup
  • High 7.3
    CVE-2024-6637

    WooCommerce - Social Login <= 2.7.3 - Unauthenticated Privilege Escalation via One-Time Password

    The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauth…

    WPWeb WooCommerce - Social Login Web / CMS
  • High 7.1
    CVE-2024-38694

    WordPress Moloni plugin <= 4.7.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Moloni allows Reflected XSS.This issue affects Moloni: from n/a through 4.7.4.

    Moloni Moloni
  • High 7.1
    CVE-2024-38696

    WordPress Zoho CRM Lead Magnet plugin <= 1.7.8.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zoho CRM Zoho CRM Lead Magnet allows Reflected XSS.This issue affects Zoho CRM Lead Magnet: from n/a through 1.7.8.8.

    Zoho CRM Zoho CRM Lead Magnet
  • Medium 6.5
    CVE-2024-38697

    WordPress Goftino plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ali Rahimi Goftino allows Stored XSS.This issue affects Goftino: from n/a through 1.6.

    Ali Rahimi Goftino
  • Medium 6.5
    CVE-2024-38698

    WordPress SKT Skill Bar plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SKT Themes SKT Skill Bar allows Stored XSS.This issue affects SKT Skill Bar: from n/a through 2.0.

    SKT Themes SKT Skill Bar
  • Medium 6.5
    CVE-2024-38703

    WordPress WP Event Aggregator plugin <= 1.7.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xylus Themes WP Event Aggregator allows Stored XSS.This issue affects WP Event Aggregator: from n/a through 1.7.9.

    Xylus Themes WP Event Aggregator
  • Medium 6.5
    CVE-2024-38705

    WordPress ElementInvader Addons for Elementor plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ElementInvader ElementInvader Addons for Elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through 1.2.4.

    Element Invader ElementInvader Addons for Elementor
  • Medium 5.9
    CVE-2024-38710

    WordPress Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin <= 2.0.6.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.6.2.

    Jewel Theme Master Addons for Elementor
  • High 7.1
    CVE-2024-38711

    WordPress Link Library plugin <= 7.7.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.7.1.

    Yannick Lefebvre Link Library
  • Medium 6.5
    CVE-2024-38712

    WordPress Qi Blocks plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Qode Qi Blocks qi-blocks.This issue affects Qi Blocks: from n/a through <= 1.3.

    QODE Qi Blocks
  • Medium 6.5
    CVE-2024-38713

    WordPress WP Photo Album Plus plugin <= 8.8.02.002 - Authenticated Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.02.002.

    J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus
  • Medium 6.5
    CVE-2024-38718

    WordPress Download Button for Elementor plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in clicklabs® Medienagentur Download Button for Elementor allows Stored XSS.This issue affects Download Button for Elementor: from n/a through 1.2.1.

    clicklabs® Medienagentur Download Button for Elementor
  • Medium 6.5
    CVE-2024-38720

    WordPress EazyDocs plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in EazyDocs eazydocs allows Stored XSS.This issue affects EazyDocs: from n/a through 2.5.0.

    Spider Themes EazyDocs
  • Medium 6.5
    CVE-2024-38722

    WordPress Job Board Manager plugin <= 2.1.57 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Job Board Manager allows Stored XSS.This issue affects Job Board Manager: from n/a through 2.1.57.

    PickPlugins Job Board Manager
  • Medium 5.9
    CVE-2024-38725

    WordPress Admin Dashboard RSS Feed plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Webstix Admin Dashboard RSS Feed allows Stored XSS.This issue affects Admin Dashboard RSS Feed: from n/a through 3.1.

    Webstix Admin Dashboard RSS Feed
  • Medium 5.9
    CVE-2024-38738

    WordPress Change From Email plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Marian Kadanka Change From Email allows Stored XSS.This issue affects Change From Email: from n/a through 1.2.1.

    Marian Kadanka Change From Email
  • Medium 5.1
    CVE-2024-38739

    WordPress OnePress theme <= 2.3.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in FameThemes OnePress allows Stored XSS.This issue affects OnePress: from n/a through 2.3.8.

    famethemes OnePress
  • Medium 6.5
    CVE-2024-38741

    WordPress Amazing Hover Effects plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Noor-E-Alam Amazing Hover Effects allows Stored XSS.This issue affects Amazing Hover Effects: from n/a through 2.4.9.

    Noor-E-Alam Amazing Hover Effects
  • Medium 6.5
    CVE-2024-38750

    WordPress Advanced post slider plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in digontoahsan Advanced post slider.This issue affects Advanced post slider: from n/a through 3.0.0.

    digontoahsan Advanced post slider
  • Medium 6.5
    CVE-2024-38757

    WordPress Typebot plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Typebot allows Stored XSS.This issue affects Typebot: from n/a through 3.6.0.

    Typebot Typebot
  • Medium 6.5
    CVE-2024-38767

    WordPress BSK PDF Manager plugin <= 3.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BannerSky.Com BSK PDF Manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.6.

    BannerSky.com BSK PDF Manager
  • Medium 4.9
    CVE-2024-38758

    WordPress WappPress plugin <= 6.0.4 - Blind Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in WappPress Team WappPress.This issue affects WappPress: from n/a through 6.0.4.

    WappPress Team WappPress
  • Medium 5.3
    CVE-2024-6489

    Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update

    The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_google_api_key function in all versions up to, and including, 2.0.10. This makes it possible for authenticated a…

    jetmonsters Getwid – Gutenberg Blocks Web / CMS
  • Medium 4.3
    CVE-2024-6491

    Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update

    The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mailchimp_api_key_manage function in all versions up to, and including, 2.0.10. This makes it possible for authentic…

    jetmonsters Getwid – Gutenberg Blocks Web / CMS
  • Low 2.7
    CVE-2024-6694

    WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure

    The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authent…

    smub WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin Web / CMS
  • Medium 6.5
    CVE-2024-3934

    Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download

    The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to Path Traversal in versions 7.3.0 to 7.5.1 via the mercadopagoDownloadLog function. This makes it possible for authenticated attackers, with subscriber-level access and above, to d…

    claudiosanches Mercado Pago payments for WooCommerce Web / CMS
  • High 7.3
    CVE-2024-6281

    Path Traversal in parisneo/lollms

    A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potent…

    parisneo parisneo/lollms lollms PyPI
  • Medium 5.3
    CVE-2024-6560

    Addonify – Quick View For WooCommerce <= 1.2.16 - Unauthenticated Full Path Dislcosure

    The Addonify – Quick View For WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.2.16. This is due the plugin utilizing mobiledetect without preventing direct access to the files. This makes it possi…

    Addonify Addonify – Quick View For WooCommerce Web / CMS
  • Medium 6.4
    CVE-2024-2337

    Easy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Easy Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testimonials_grid ' shortcode in all versions up to, and including, 3.9.5 due to insufficient input sanitization and output escaping on user supplied att…

    ghuger Easy Testimonials Web / CMS