Skip to content
OpenAdvisories

Archive

25 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /25 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

53 results · Clear filters · Feed

  • Medium 6.1
    CVE-2024-8713

    Kodex Posts likes <= 2.5.0 - Reflected Cross-Site Scripting

    The Kodex Posts likes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attacker…

    Pierre Lebedel Kodex Posts likes Web / CMS
  • Medium 6.4
    CVE-2024-9068

    OneElements – Best Elementor Addons <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

    The OneElements – Best Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it possible for a…

    themexclub OneElements – Best Elementor Addons Web / CMS
  • Medium 6.4
    CVE-2024-9069

    Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

    The Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 d…

    besnikac Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) Web / CMS
  • Medium 6.1
    CVE-2024-8741

    Beam me up Scotty – Back to Top Button <= 1.0.21 - Reflected Cross-Site Scripting

    The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for un…

    outtheboxthemes Beam me up Scotty – Back to Top Button Web / CMS
  • Medium 5.3
    CVE-2024-7426

    Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.6.0 - Unauthenticated Full Path Disclosure

    The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.6.0. This is due to the plugin displaying errors and allowing direct access …

    PeepSo Community by PeepSo – Download from PeepSo.com Web / CMS
  • Medium 6.4
    CVE-2024-9027

    WPZOOM Shortcodes <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode

    The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This m…

    WPZOOM WPZOOM Shortcodes Web / CMS
  • Medium 6.1
    CVE-2024-8549

    Simple Calendar – Google Calendar Plugin <= 3.4.2 - Reflected Cross-Site Scripting

    The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.2. This makes it possible for u…

    Simple Calendar Simple Calendar – Google Calendar Plugin Web / CMS
  • Medium 4.3
    CVE-2024-7386

    Premium Packages – Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgery

    The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.1. This is due to missing nonce validation on the addRefund() function. This makes it possible for…

    codename065 Premium Packages – Sell Digital Products Securely Web / CMS
  • Medium 5.4
    CVE-2023-51157

    Cross Site Scripting vulnerability in ZKTeco WDMS v.5.1.3 Pro allows a remote attacker to execute arbitrary code and ob…

  • Medium 4.7
    CVE-2024-46600

    dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/doAdminAction.…

  • Medium 6.3
    CVE-2024-46485

    dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=addCate

  • Medium 6.1
    CVE-2024-46655

    A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code i…

  • Medium 6.5
    CVE-2024-41445

    Library MDF (mdflib) v2.1 is vulnerable to a heap-based buffer overread via a crafted mdf4 file is parsed using the Rea…