Skip to content
OpenAdvisories

Archive

1 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /1 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

235 results · Feed

  • Medium 4.3
    CVE-2024-37218

    WordPress Page Builder Sandwich <= 5.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WordPress Page Builder Sandwich Team Page Builder Sandwich – Front-End Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Builder Sandwich – Front-End Page Builde…

    WordPress Page Builder Sandwich Team Page Builder Sandwich – Front-End Page Builder
  • Medium 5.3
    CVE-2024-37220

    WordPress Optinly plugin <= 1.0.18 - Broken Access Control vulnerability

    Missing Authorization vulnerability in OptinlyHQ Optinly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optinly: from n/a through 1.0.18.

    optinlyhq Optinly
  • Medium 5.3
    CVE-2024-37226

    WordPress Kanban Boards for WordPress plugin <= 2.5.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kanban for WordPress Kanban Boards for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.

    Kanban for WordPress Kanban Boards for WordPress Web / CMS
  • High 8.8
    CVE-2024-37232

    WordPress Hercules Core plugin <= 6.5 - Subscriber+ Arbitrary Settings Change/Access vulnerability

    Missing Authorization vulnerability in Hercules Design Hercules Core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hercules Core: from n/a through 6.5.

    Hercules Design Hercules Core
  • Medium 4.3
    CVE-2024-37254

    WordPress WP File Manager plugin <= 7.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in mndpsingh287 File Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Manager: from n/a through 7.2.7.

    mndpsingh287 File Manager
  • Medium 5.3
    CVE-2024-37255

    WordPress ElementsKit Lite plugin <= 3.1.4 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through <= 3.1.4.

    roxnor ElementsKit Elementor addons Lite
  • Medium 5.3
    CVE-2024-37269

    WordPress Masterstudy Elementor Widgets plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2.

    StylemixThemes Masterstudy Elementor Widgets
  • Medium 5.3
    CVE-2024-37276

    WordPress Featured Image from URL (FIFU) plugin <= 4.8.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.1.

    fifu.app Featured Image from URL
  • High 7.5
    CVE-2024-37277

    WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Paid Memberships Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Paid Memberships Pro: from n/a through 3.0.4.

    Paid Memberships Pro Paid Memberships Pro
  • Medium 5.3
    CVE-2024-37411

    WordPress Progress Planner plugin <= 0.9.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Progress Planner Progress Planner progress-planner.This issue affects Progress Planner: from n/a through <= 0.9.1.

    Progress Planner Progress Planner
  • Medium 5.4
    CVE-2024-37415

    WordPress E2Pdf plugin <= 1.20.27 - Broken Access Control vulnerability

    Missing Authorization vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.20.27.

    E2Pdf e2pdf
  • Medium 5.4
    CVE-2024-37425

    WordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Automattic Newspack Blocks newspack-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Blocks: from n/a through 3.0.8.

    Automattic Newspack Blocks
  • High 8.5
    CVE-2024-37423

    WordPress Newspack Blocks plugin <= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8.

    Automattic Newspack Blocks
  • Medium 5.3
    CVE-2024-37427

    WordPress Timetics plugin <= 1.0.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.21.

    Arraytics Timetics
  • Medium 5.4
    CVE-2024-37439

    WordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Subscriber+ Arbitrary Post/Page Duplication vulnerability

    Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a through 4.1.4.0

    Uncanny Owl Uncanny Toolkit Pro for LearnDash
  • Medium 4.3
    CVE-2024-37440

    WordPress Church Admin plugin <= 4.4.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.

    andy_moyle Church Admin
  • Medium 5.3
    CVE-2024-37444

    WordPress Defender plugin <= 4.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defender-security.This issue affects Defender Security: from n/a through <= 4.7.1.

    WPMU DEV - Your All-in-One WordPress Platform Defender Security
  • Medium 4.3
    CVE-2024-37443

    WordPress WP Job Manager plugin <= 2.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Automattic WP Job Manager - Resume Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Manager - Resume Manager: from n/a through 2.1.0.

    Automattic WP Job Manager - Resume Manager
  • Medium 4.3
    CVE-2024-37453

    WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 5.8.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 5.8.7.

    ProfileGrid User Profiles ProfileGrid
  • Medium 5.3
    CVE-2024-37456

    WordPress Simple Newsletter Plugin – Noptin plugin <= 3.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Noptin Newsletter Noptin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Noptin: from n/a through 3.4.2.

    Noptin Newsletter Team Noptin
  • Medium 5.3
    CVE-2024-37463

    WordPress CRM Perks Forms plugin <= 1.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CRM Perks CRM Perks Forms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CRM Perks Forms: from n/a through 1.1.5.

    CRM Perks CRM Perks Forms
  • High 8.2
    CVE-2024-37470

    WordPress Woffice Core plugin <= 5.4.8 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in WofficeIO Woffice Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woffice Core: from n/a through 5.4.8.

    WofficeIO Woffice Core
  • Medium 5.3
    CVE-2024-37468

    WordPress Newsmatic theme <= 1.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in blazethemes Newsmatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newsmatic: from n/a through 1.3.1.

    blazethemes Newsmatic
  • Medium 5.3
    CVE-2024-37475

    WordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Automattic Newspack Newsletters allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Newspack Newsletters: from n/a through 2.13.2.

    Automattic Newspack Newsletters
  • Medium 6.5
    CVE-2024-37481

    WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.

    RadiusTheme The Post Grid
  • Medium 6.5
    CVE-2024-37477

    WordPress Newspack Content Converter plugin <= 0.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Automattic Newspack Content Converter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Newspack Content Converter: from n/a through 0.1.5.

    Automattic Newspack Content Converter
  • Medium 4.3
    CVE-2024-37482

    WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.

    RadiusTheme The Post Grid
  • Medium 4.3
    CVE-2024-37505

    WordPress Business One Page theme <= 1.2.9 - Broken Access Control on Notice Dismissal vulnerability

    Missing Authorization vulnerability in Rara Themes Business One Page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business One Page: from n/a through 1.2.9.

    Rara Themes Business One Page
  • Medium 5.4
    CVE-2024-37483

    WordPress The Post Grid plugin <= 7.7.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RadiusTheme The Post Grid the-post-grid.This issue affects The Post Grid: from n/a through <= 7.7.4.

    RadiusTheme The Post Grid
  • Medium 6.5
    CVE-2024-37510

    WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Charitable Donations & Fundraising Team Charitable allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Charitable: from n/a through 1.8.1.7.

    Charitable Donations & Fundraising Team Charitable
  • Medium 5.3
    CVE-2024-37506

    WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Charitable Donations & Fundraising Team Charitable allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Charitable: from n/a through 1.8.1.7.

    Charitable Donations & Fundraising Team Charitable
  • Medium 6.3
    CVE-2024-37516

    WordPress Featured Image from URL (FIFU) plugin <= 4.8.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in fifu.App Featured Image from URL allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Image from URL: from n/a through 4.8.2.

    fifu.app Featured Image from URL
  • Medium 5.3
    CVE-2024-37921

    WordPress Chained Quiz plugin <= 1.3.2.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kiboko Labs Chained Quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chained Quiz: from n/a through 1.3.2.8.

    Kiboko Labs Chained Quiz
  • Medium 4.3
    CVE-2024-37517

    WordPress Spectra plugin <= 2.13.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.13.7.

    Brainstorm Force Spectra
  • Medium 6.3
    CVE-2024-37929

    WordPress User Activity Log Pro plugin <= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerability

    Missing Authorization vulnerability in solwin User Activity Log Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Activity Log Pro: from n/a through 2.3.4.

    solwin User Activity Log Pro
  • Medium 5.3
    CVE-2024-37926

    WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.9.

    Alex Volkov WP Accessibility Helper (WAH)
  • Medium 5.3
    CVE-2024-38690

    WordPress iPanorama 360 plugin <= 1.8.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.3.

    Avirtum iPanorama 360 WordPress Virtual Tour Builder Web / CMS
  • Medium 4.3
    CVE-2024-38695

    WordPress WP GoToWebinar plugin <= 15.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Martin Gibson WP GoToWebinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP GoToWebinar: from n/a through 15.6.

    Martin Gibson WP GoToWebinar
  • Medium 5.3
    CVE-2024-38702

    WordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Tyche Softwares Product Delivery Date for WooCommerce – Lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.2.

    Tyche Softwares Product Delivery Date for WooCommerce – Lite Web / CMS
  • Medium 6.3
    CVE-2024-38707

    WordPress EmbedPress plugin <= 4.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper EmbedPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EmbedPress: from n/a through 4.0.4.

    WPDeveloper EmbedPress