Skip to content
OpenAdvisories

Archive

20 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /20 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

68 results · Feed

  • Critical 9.8
    CVE-2024-44000 Public exploit Scanner template EPSS 82%

    WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

    Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.

    LiteSpeed Technologies LiteSpeed Cache
  • Medium 4.3
    CVE-2024-49325

    WordPress Photo Gallery Builder plugin <= 3.0 - Broken Access Control to Notice Dismissal vulnerability

    Missing Authorization vulnerability in wpdiscover Photo Gallery Builder photo-gallery-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Photo Gallery Builder: from n/a through <= 3.0.

    wpdiscover Photo Gallery Builder
  • Medium 5.4
    CVE-2024-47634

    WordPress CartBounty plugin <= 8.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Streamline CartBounty – Save and recover abandoned carts for WooCommerce woo-save-abandoned-carts allows Cross Site Request Forgery.This issue affects CartBounty – Save and recover abandoned carts for WooComm…

    Streamline CartBounty – Save and recover abandoned carts for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2024-49250

    WordPress Table of Contents Plus plugin <= 2408 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Table of Contents Plus table-of-contents-plus allows Cross Site Request Forgery.This issue affects Table of Contents Plus: from n/a through <= 2408.

    Syed Balkhi Table of Contents Plus
  • Medium 4.3
    CVE-2024-49272

    WordPress Social Auto Poster plugin <= 5.3.15 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wpweb Social Auto Poster social-auto-poster allows Cross Site Request Forgery.This issue affects Social Auto Poster: from n/a through <= 5.3.15.

    WPWeb Social Auto Poster
  • Medium 5.4
    CVE-2024-49274

    WordPress VOD Infomaniak plugin <= 1.5.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through <= 1.5.7.

    Infomaniak Network VOD Infomaniak
  • Medium 4.3
    CVE-2024-49275

    WordPress IdeaPush plugin <= 8.69 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Northern Beaches Websites IdeaPush ideapush allows Cross Site Request Forgery.This issue affects IdeaPush: from n/a through <= 8.69.

    Northern Beaches Websites IdeaPush
  • Medium 4.3
    CVE-2024-49290

    WordPress Cooked Pro plugin < 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1.8.0.

    Gora Tech Cooked Pro
  • Medium 4.3
    CVE-2024-49306

    WordPress WP Content Copy Protection & No Right Click plugin <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Content Copy Protection & No Right Click wp-content-copy-protector allows Cross Site Request Forgery.This issue affects WP Content Copy Protection & No Right Click: from n/a through <= 3.5.9.

    wp-buy WP Content Copy Protection & No Right Click
  • Medium 4.3
    CVE-2024-49627

    WordPress WordPress Image SEO plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Noor Alam WordPress Image SEO allows Cross Site Request Forgery.This issue affects WordPress Image SEO: from n/a through 1.1.4.

    Noor Alam WordPress Image SEO Web / CMS
  • Medium 4.3
    CVE-2024-49628

    WordPress Most And Least Read Posts Widget plugin <= 2.5.18 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in whiletrue Most And Least Read Posts Widget most-and-least-read-posts-widget allows Cross Site Request Forgery.This issue affects Most And Least Read Posts Widget: from n/a through <= 2.5.18.

    whiletrue Most And Least Read Posts Widget
  • High 7.1
    CVE-2024-49335

    WordPress GoogleDrive folder list plugin <= 2.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in sh4d0w28 GoogleDrive folder list googledrive-folder-list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through <= 2.2.2.

    sh4d0w28 GoogleDrive folder list
  • High 7.1
    CVE-2024-49605

    WordPress Community Lite Video Chat plugin <= 2.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Stefan Nour AVChat Video Chat avchat-3 allows Stored XSS.This issue affects AVChat Video Chat: from n/a through <= 2.2.

    Stefan Nour AVChat Video Chat
  • High 7.1
    CVE-2024-49629

    WordPress Endless Posts Navigation plugin <= 2.2.7 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Stored XSS.This issue affects Endless Posts Navigation: from n/a through <= 2.2.7.

    Fahad Mahmood Endless Posts Navigation
  • High 8.5
    CVE-2024-47325

    WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects MPG: from n/a through <= 3.4.7.

    themeisle MPG
  • High 8.5
    CVE-2024-49609

    WordPress Author Discussion plugin <= 0.2.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion author-discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through <= 0.2.2.

    Brandon White Author Discussion
  • High 8.5
    CVE-2024-49612

    WordPress SW Contact Form plugin <= 1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanjeev SW Contact Form sw-contact-form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through <= 1.0.

    Sanjeev SW Contact Form
  • High 8.5
    CVE-2024-49613

    WordPress Simple Code Insert Shortcode plugin <= 1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in developersnote Simple Code Insert Shortcode simple-code-insert-shortcode allows SQL Injection.This issue affects Simple Code Insert Shortcode: from n/a throu…

    developersnote Simple Code Insert Shortcode
  • High 8.5
    CVE-2024-49614

    WordPress SermonAudio Widgets plugin <= 1.9.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SermonAudio SermonAudio Widgets sermonaudio-widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through <= 1.9.3.

    SermonAudio SermonAudio Widgets
  • High 8.2
    CVE-2024-49615

    WordPress SafetyForms plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms safetymails-forms allows Blind SQL Injection.This issue affects SafetyForms: from n/a through <= 1.0.0.

    Henrique Rodrigues SafetyForms
  • High 8.5
    CVE-2024-49616

    WordPress Rate Own Post plugin <= 1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in nyasro Rate Own Post rate-own-post allows Blind SQL Injection.This issue affects Rate Own Post: from n/a through <= 1.0.

    nyasro Rate Own Post
  • High 8.2
    CVE-2024-49617

    WordPress Back Link Tracker plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in anciwasim Back Link Tracker back-link-tracker allows Blind SQL Injection.This issue affects Back Link Tracker: from n/a through <= 1.0.0.

    anciwasim Back Link Tracker
  • High 8.5
    CVE-2024-49618

    WordPress MyTweetLinks plugin <= 1.1.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordan Lyall MyTweetLinks mytweetlinks allows Blind SQL Injection.This issue affects MyTweetLinks: from n/a through <= 1.1.1.

    Jordan Lyall MyTweetLinks
  • High 8.5
    CVE-2024-49619

    WordPress Social Link Groups plugin <= 1.1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in acespritech Social Link Groups social-link-groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through <= 1.1.0.

    acespritech Social Link Groups
  • High 8.5
    CVE-2024-49620

    WordPress FERMA.ru.net plugin <= 1.3.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mrcheck116 FERMA.ru.net ferma-ru-net-checkout allows Blind SQL Injection.This issue affects FERMA.ru.net: from n/a through <= 1.3.3.

    mrcheck116 FERMA.ru.net
  • High 7.1
    CVE-2024-44061

    WordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory EU/UK VAT Manager for WooCommerce eu-vat-for-woocommerce.This issue affects EU/UK VAT Manager for WooCommerce: from n/a through <= 2.12.14.

    WPFactory EU/UK VAT Manager for WooCommerce Web / CMS
  • High 8.2
    CVE-2024-49621

    WordPress APA Register Newsletter Form plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari APA Register Newsletter Form apa-register-newsletter-form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through <= 1.0.0.

    aatmaadhikari APA Register Newsletter Form
  • High 8.2
    CVE-2024-49622

    WordPress Apa Banner Slider plugin <= 1.0.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in aatmaadhikari Apa Banner Slider apa-banner-slider allows SQL Injection.This issue affects Apa Banner Slider: from n/a through <= 1.0.0.

    aatmaadhikari Apa Banner Slider
  • High 8.5
    CVE-2024-49623

    WordPress Duplicate Title Validate plugin <= 1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hasan movahed Duplicate Title Validate duplicate-title-validate allows Blind SQL Injection.This issue affects Duplicate Title Validate: from n/a through <= 1…

    hasan movahed Duplicate Title Validate
  • High 8.8
    CVE-2024-49608

    WordPress GERRYWORKS Post by Mail plugin <= 1.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in gerryworks GERRYWORKS Post by Mail gerryworks-post-by-mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through <= 1.0.

    gerryworks GERRYWORKS Post by Mail
  • Critical 10.0
    CVE-2024-49324

    WordPress Sovratec Case Management plugin <= 1.0.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in sovratecdev Sovratec Case Management sovratec-case-management allows Upload a Web Shell to a Web Server.This issue affects Sovratec Case Management: from n/a through <= 1.0.0.

    sovratecdev Sovratec Case Management
  • Critical 10.0
    CVE-2024-49326

    WordPress Affiliator plugin <= 2.1.3 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Vasileios Kerasiotis Affiliator affiliator-lite allows Upload a Web Shell to a Web Server.This issue affects Affiliator: from n/a through <= 2.1.3.

    Vasileios Kerasiotis Affiliator
  • Critical 10.0
    CVE-2024-49327

    WordPress Woostagram Connect plugin <= 1.0.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in bepitulaz Woostagram Connect woostagram-connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through <= 1.0.2.

    bepitulaz Woostagram Connect
  • Critical 10.0
    CVE-2024-49329

    WordPress WP REST API FNS plugin <= 1.0.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in vivek2tamrakar WP REST API FNS rest-api-fns allows Upload a Web Shell to a Web Server.This issue affects WP REST API FNS: from n/a through <= 1.0.0.

    vivek2tamrakar WP REST API FNS
  • Critical 10.0
    CVE-2024-49330

    WordPress Nice Backgrounds plugin <= 1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds nicebackgrounds allows Upload a Web Shell to a Web Server.This issue affects Nice Backgrounds: from n/a through <= 1.0.

    brx8r Nice Backgrounds
  • Critical 9.9
    CVE-2024-49331

    WordPress Property Lot Management System plugin <= 4.2.38 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Property Lot Management System plms allows Upload a Web Shell to a Web Server.This issue affects Property Lot Management System: from n/a through <= 4.2.38.

    Myriad Solutionz Property Lot Management System
  • Critical 10.0
    CVE-2024-49607 Public exploit

    WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in redhopit WP Dropbox Dropins wp-dropbox-dropins allows Upload a Web Shell to a Web Server.This issue affects WP Dropbox Dropins: from n/a through <= 1.0.

    redhopit WP Dropbox Dropins
  • Critical 10.0
    CVE-2024-49610

    WordPress photokit plugin <= 1.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in photokiteditor photokit photokit allows Upload a Web Shell to a Web Server.This issue affects photokit: from n/a through <= 1.0.

    photokiteditor photokit
  • Medium 4.7
    CVE-2024-10195

    Tecno 4G Portable WiFi TR118 SMS Check goform_get_cmd_process sql injection

    A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of th…

    TECNO 4G Portable WiFi TR118
  • Critical 9.8
    CVE-2024-49332

    WordPress Giveaway Boost plugin <= 2.1.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.

    giveawayboost Giveaway Boost