Skip to content
OpenAdvisories

Archive

1 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /1 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

191 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-43296

    WordPress HTML5 Video Player plugin <= 2.5.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins LLC Flash & HTML5 Video allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flash & HTML5 Video: from n/a through 2.5.30.

    bPlugins Flash & HTML5 Video
  • Medium 4.3
    CVE-2024-43297

    WordPress Clone plugin <= 2.4.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.

    Migrate Clone
  • Medium 4.3
    CVE-2024-43298

    WordPress Clone plugin <= 2.4.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.

    Migrate Clone
  • Medium 4.3
    CVE-2024-43302

    WordPress Fonts plugin <= 3.7.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fonts Plugin Fonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fonts: from n/a through 3.7.7.

    Fonts Plugin Fonts
  • Medium 5.4
    CVE-2024-43312

    WordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.1.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPClever WPC Frequently Bought Together for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Frequently Bought Together for WooCommerce: from n/a through 7.1.9.

    wpclever WPC Frequently Bought Together for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2024-43310

    WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in UkrSolution Print Barcode Labels for your WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through…

    UKR Solution Print Barcode Labels for your WooCommerce products/orders Web / CMS
  • Medium 4.3
    CVE-2024-43314

    WordPress Asset CleanUp: Page Speed Booster plugin <= 1.3.9.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asset CleanUp: Page Speed Booster: from n/a through 1.3.9.3.

    Gabe Livan Asset CleanUp: Page Speed Booster
  • Medium 4.3
    CVE-2024-43332

    WordPress Photo Engine plugin <= 6.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jordy Meow Photo Engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Engine: from n/a through 6.4.0.

    Jordy Meow Photo Engine
  • Medium 5.3
    CVE-2024-43323

    WordPress ReviewX plugin <= 1.6.28 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ReviewX ReviewX allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReviewX: from n/a through 1.6.28.

    ReviewX ReviewX
  • Medium 4.3
    CVE-2024-43343

    WordPress Order Tracking – WordPress Status Tracking Plugin plugin < 3.3.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Etoile Web Design Order Tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Order Tracking: from n/a through 3.3.12.

    Etoile Web Design Order Tracking
  • Medium 6.5
    CVE-2024-43341

    WordPress Hello Agency theme <= 1.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Hello Agency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hello Agency: from n/a through 1.0.5.

    CozyThemes Hello Agency
  • Medium 4.3
    CVE-2024-43355

    WordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BearDev JoomSport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JoomSport: from n/a through 5.3.0.

    Beardev JoomSport
  • Medium 5.3
    CVE-2024-43919 Public exploit Scanner template EPSS 45%

    WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability

    Access Control vulnerability in YARPP YARPP allows . This issue affects YARPP: from n/a through 5.30.10.

    YARPP YARPP
  • Medium 5.3
    CVE-2024-43923

    WordPress Timetics plugin <= 1.0.23 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Timetics: from n/a through 1.0.23.

    Arraytics Timetics
  • Medium 5.4
    CVE-2024-43928

    WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in eyecix JobSearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through 2.5.4.

    EyeCix Technologies JobSearch Web / CMS
  • Medium 4.3
    CVE-2024-43925

    WordPress Envira Gallery Lite plugin <= 1.8.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envira Photo Gallery: from n/a through 1.8.14.

    Envira Gallery Team Envira Photo Gallery
  • Medium 6.5
    CVE-2024-43929

    WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in eyecix JobSearch allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JobSearch: from n/a through 2.5.4.

    EyeCix Technologies JobSearch Web / CMS
  • Medium 6.5
    CVE-2024-43932

    WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through <= 5.6.2.

    POSIMYTH The Plus Addons for Elementor Page Builder Lite
  • Medium 6.4
    CVE-2024-43937

    WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability

    Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10.

    Themeum WP Crowdfunding
  • Medium 5.4
    CVE-2024-43962

    WordPress LWS Affiliation plugin <= 2.3.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LWS LWS Affiliation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LWS Affiliation: from n/a through 2.3.4.

    LWS LWS Affiliation
  • Medium 6.5
    CVE-2024-43956

    WordPress MemberPress plugin <= 1.11.34 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Caseproof, LLC Memberpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberpress: from n/a through 1.11.34.

    Caseproof Memberpress
  • Medium 4.3
    CVE-2024-43968

    WordPress Newspack plugin < 3.8.7 - Broken Access Control vulnerability

    Broken Access Control vulnerability in Automattic Newspack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack: from n/a through 3.8.6.

    Automattic Newspack
  • Medium 6.5
    CVE-2024-43974

    WordPress ReviveNews theme <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes ReviveNews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ReviveNews: from n/a through 1.0.2.

    CozyThemes ReviveNews
  • Medium 4.3
    CVE-2024-43973

    WordPress GetPaid plugin <= 2.8.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Stiofan GetPaid invoicing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GetPaid: from n/a through <= 2.8.11.

    Stiofan GetPaid
  • Medium 6.5
    CVE-2024-43980

    WordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Fota WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fota WP: from n/a through 1.4.1.

    CozyThemes Fota WP
  • Medium 6.5
    CVE-2024-43979

    WordPress Blockbooster theme <= 1.0.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10.

    CozyThemes Blockbooster
  • Medium 4.3
    CVE-2024-43981

    WordPress GeoDirectory plugin <= 2.3.70 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70.

    AyeCode – WP Business Directory Plugins GeoDirectory
  • Medium 6.5
    CVE-2024-43998 Public exploit

    WordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3.

    WebsiteinWP Blogpoet
  • Medium 4.3
    CVE-2024-44006

    WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency woocommerce-multilingual.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.6.

    OnTheGoSystems WooCommerce Multilingual & Multicurrency Web / CMS
  • Medium 5.3
    CVE-2024-44019

    WordPress Contact Form 7 Campaign Monitor Extension plugin <= 0.4.67 - Arbitrary File Deletion vulnerability

    Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension contact-form-7-campaign-monitor-extension.This issue affects Contact Form 7 Campaign Monitor Extension: from n/a through <= 0.4.67.

    Renzo Johnson Contact Form 7 Campaign Monitor Extension
  • Medium 4.3
    CVE-2024-44020

    WordPress WP Free SSL plugin <= 1.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through <= 1.2.7.

    Prasad Kirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS Web / CMS
  • Medium 4.3
    CVE-2024-44031

    WordPress JoomSport plugin <= 5.6.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in beardev JoomSport joomsport-sports-league-results-management.This issue affects JoomSport: from n/a through <= 5.6.3.

    Beardev JoomSport
  • Medium 5.4
    CVE-2024-44021

    WordPress Truepush plugin <= 1.0.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in truepushplugin Truepush truepush-free-web-push-notifications.This issue affects Truepush: from n/a through <= 1.0.8.

    truepushplugin Truepush
  • Medium 4.3
    CVE-2024-44052

    WordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.10.

    HelloAsso HelloAsso
  • Medium 6.5
    CVE-2024-47308 Scanner template

    WordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Templately templately.This issue affects Templately: from n/a through <= 3.1.2.

    WPDeveloper Templately
  • Medium 4.3
    CVE-2024-47317

    WordPress Ads by WPQuads plugin <= 2.0.84 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded.This issue affects Ads by WPQuads: from n/a through <= 2.0.84.

    Ads by WPQuads Ads by WPQuads
  • Medium 4.3
    CVE-2024-47318

    WordPress PWA for WP & AMP plugin <= 1.7.72 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Magazine3 PWA for WP & AMP pwa-for-wp.This issue affects PWA for WP & AMP: from n/a through <= 1.7.72.

    Magazine3 PWA for WP & AMP
  • Medium 5.3
    CVE-2024-47358

    WordPress Popup Maker plugin <= 1.19.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Daniel Iser Popup Maker popup-maker.This issue affects Popup Maker: from n/a through <= 1.19.2.

    Daniel Iser Popup Maker
  • Medium 6.5
    CVE-2024-47321

    WordPress WP Datepicker plugin <= 2.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fahad Mahmood WP Datepicker wp-datepicker.This issue affects WP Datepicker: from n/a through <= 2.1.1.

    Fahad Mahmood WP Datepicker
  • Medium 5.3
    CVE-2024-47359

    WordPress Depicter plugin <= 3.2.2 - Broken Access Control vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in averta Depicter Slider depicter.This issue affects Depicter Slider: from n/a through <= 3.2.2.

    Averta Depicter Slider