Skip to content
OpenAdvisories

Archive

9 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /9 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

212 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-54230

    WordPress Unlock Addons for Elementor plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masud Hasan Unlock Addons for Elementor unlock-addons-for-elementor allows DOM-Based XSS.This issue affects Unlock Addons for Elementor: from n/a through <= …

    Masud Hasan Unlock Addons for Elementor
  • Medium 6.5
    CVE-2024-54232

    WordPress RRAddons for Elementor plugin <= 1.1.0 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RRDevs RRAddons for Elementor rrdevs-for-elementor allows Stored XSS.This issue affects RRAddons for Elementor: from n/a through <= 1.1.0.

    RRDevs RRAddons for Elementor
  • Medium 6.5
    CVE-2024-54260

    WordPress News Kit Elementor Addons plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.

    blazethemes News Kit Elementor Addons
  • Medium 4.7
    CVE-2024-54255

    WordPress Login Widget With Shortcode plugin <= 6.1.2 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue affects Login Widget With Shortcode: from n/a through <= 6.1.2.

    aviplugins.com Login Widget With Shortcode
  • Medium 5.3
    CVE-2024-54223

    WordPress ARForms plugin <= 1.7.1 - HTML Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allows Code Injection.This issue affects ARForms Form Builder: from n/a through <= 1.7.1.

    Repute InfoSystems ARForms Form Builder
  • Medium 4.3
    CVE-2023-22708

    WordPress Kraken.io Image Optimizer plugin <= 2.6.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Karim Salman Kraken.io Image Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kraken.io Image Optimizer: from n/a through 2.6.7.

    Karim Salman Kraken.io Image Optimizer
  • Medium 5.2
    CVE-2023-23715

    WordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.2.2 - IDOR Leading To Job Removal Vulnerability

    Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoardWP – Job Board Listings and Submissions: from n/a through 1.2.…

    JobBoardWP JobBoardWP – Job Board Listings and Submissions
  • Medium 4.3
    CVE-2023-23716

    WordPress Zendesk Support for WordPress plugin <= 1.8.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Zendesk Zendesk Support for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zendesk Support for WordPress: from n/a through 1.8.4.

    Zendesk Zendesk Support for WordPress Web / CMS
  • Medium 4.3
    CVE-2023-23725

    WordPress Shortcodes by Angie Makes plugin <= 3.46 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Chris Baldelomar Shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes: from n/a through 3.46.

    Chris Baldelomar Shortcodes
  • Medium 5.4
    CVE-2023-23726

    WordPress Tickera – WordPress Event Ticketing plugin <= 3.5.1.0 - CSRF Leading To Post Status Change Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tickera.com Tickera allows Cross Site Request Forgery.This issue affects Tickera: from n/a through 3.5.1.0.

    Tickera.com Tickera
  • Medium 4.3
    CVE-2023-23823

    WordPress Enhanced Text Widget plugin <= 1.5.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Clever Widgets Enhanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through 1.5.8.

    Clever Widgets Enhanced Text Widget
  • Medium 4.3
    CVE-2023-23834

    WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Activate_Plugin vulnerability

    Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.

    Brainstorm Force Spectra
  • Medium 5.4
    CVE-2023-23868

    WordPress Cost of Goods for WooCommerce plugin <= 2.8.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFactory Cost of Goods for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost of Goods for WooCommerce: from n/a through 2.8.6.

    WPFactory Cost of Goods for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2023-23886

    WordPress WP-RecentComments plugin <= 2.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in mg12 WP-RecentComments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-RecentComments: from n/a through 2.2.7.

    mg12 WP-RecentComments
  • Medium 5.3
    CVE-2023-23887

    WordPress Easy Google Analytics for WordPress plugin <= 1.6.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Shaon Easy Google Analytics for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Google Analytics for WordPress: from n/a through 1.6.0.

    Shaon Easy Google Analytics for WordPress Web / CMS
  • Medium 5.3
    CVE-2023-23893

    WordPress Simple Giveaways plugin <= 2.48.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Igor Benic Simple Giveaways allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Giveaways: from n/a through 2.48.0.

    Igor Benic Simple Giveaways
  • Medium 5.3
    CVE-2023-23975

    WordPress Quick Event Manager plugin <= 9.7.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fullworks Quick Event Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Event Manager: from n/a through 9.7.4.

    fullworks Quick Event Manager
  • Medium 4.7
    CVE-2023-23895

    WordPress WP Time Slots Booking Form plugin <= 1.1.82 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through 1.1.82.

    codepeople WP Time Slots Booking Form
  • Medium 5.4
    CVE-2023-23986

    WordPress Reviews and Rating – Google My Business plugin <= 4.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Noah Hearle, Design Extreme Reviews and Rating – Google My Business allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reviews and Rating – Google My Business: from n/a through 4.1…

    Noah Hearle, Design Extreme Reviews and Rating – Google My Business
  • Medium 5.0
    CVE-2023-24407

    WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WpDevArt Booking calendar, Appointment Booking System allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.3.

    wpdevart Booking calendar, Appointment Booking System
  • Medium 4.3
    CVE-2023-25026

    WordPress PayPal Brasil para WooCommerce plugin <= 1.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2.

    PayPal PayPal Brasil para WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-25035

    WordPress Quick Contact Form plugin <= 8.0.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fullworks Quick Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Contact Form : from n/a through 8.0.3.1.

    fullworks Quick Contact Form
  • Medium 4.3
    CVE-2023-25037

    WordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar Contact Form: from n/a through 1.2.34.

    codepeople Booking Calendar Contact Form
  • Medium 5.3
    CVE-2023-25048

    WordPress Fantastic Content Protector Free plugin <= 2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fantastic Plugins Fantastic Content Protector Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fantastic Content Protector Free: from n/a through 2.6.

    Fantastic Plugins Fantastic Content Protector Free
  • Medium 5.3
    CVE-2023-25060

    WordPress Album and Image Gallery plus Lightbox plugin <= 1.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Album and Image Gallery plus Lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Album and Image Gallery plus Lightbox: from n/a through …

    WP OnlineSupport, Essential Plugin Album and Image Gallery plus Lightbox
  • Medium 4.3
    CVE-2023-25067

    WordPress We’re Open! plugin <= 1.45 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Noah Hearle, Design Extreme We’re Open! allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects We’re Open!: from n/a through 1.45.

    Noah Hearle, Design Extreme We’re Open!
  • Medium 6.5
    CVE-2023-25454

    WordPress Protected Posts Logout Button plugin <= 1.4.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Nate Reist Protected Posts Logout Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protected Posts Logout Button: from n/a through 1.4.5.

    Nate Reist Protected Posts Logout Button
  • Medium 5.3
    CVE-2023-25455

    WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord,…

    miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  • Medium 5.4
    CVE-2023-25469

    WordPress Easy Table of Contents plugin <= 2.0.45.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Magazine3 Easy Table of Contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Table of Contents: from n/a through 2.0.45.2.

    Magazine3 Easy Table of Contents
  • Medium 4.3
    CVE-2023-25486

    WordPress Clone plugin <= 2.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.3.7.

    Migrate Clone
  • Medium 5.3
    CVE-2023-25703

    WordPress Meta slider and carousel with lightbox plugin <= 1.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta slider and carousel with lightbox: from n/a throug…

    WP OnlineSupport, Essential Plugin Meta slider and carousel with lightbox
  • Medium 5.4
    CVE-2023-25791

    WordPress Fontiran plugin <= 2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Cadus Pro Fontiran allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fontiran: from n/a through 2.1.

    Cadus Pro Fontiran
  • Medium 5.4
    CVE-2023-25959

    WordPress Apollo13 Framework Extensions plugin <= 1.8.10 - Broken Access Control

    Missing Authorization vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apollo13 Framework Extensions: from n/a through 1.8.10.

    apollo13themes Apollo13 Framework Extensions
  • Medium 5.5
    CVE-2023-25966

    WordPress FileBird plugin <= 5.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through 5.1.4.

    Ninja Team Filebird
  • Medium 4.3
    CVE-2023-25993

    WordPress Top 10 – Popular posts plugin for WordPress plugin <= 3.2.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebberZone Top 10 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top 10: from n/a through 3.2.3.

    WebberZone Top 10 Web / CMS
  • Medium 5.3
    CVE-2023-26520

    WordPress Advanced Text Widget plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Max Chirkov Advanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Text Widget : from n/a through 2.1.2.

    Max Chirkov Advanced Text Widget
  • Medium 6.5
    CVE-2023-26522

    WordPress WP Repost plugin <= 0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in OneWebsite WP Repost allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Repost: from n/a through 0.1.

    OneWebsite WP Repost
  • Medium 5.4
    CVE-2023-27428

    WordPress WP users media plugin <= 4.2.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Damir Calusic WP users media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP users media: from n/a through 4.2.3.

    Damir Calusic WP users media
  • Medium 6.3
    CVE-2023-27449

    WordPress Total Poll Lite plugin <= 4.8.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in TotalSuite Total Poll Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through 4.8.6.

    TotalSuite Total Poll Lite
  • Medium 5.4
    CVE-2023-27454

    WordPress Rife Elementor Extensions & Templates plugin <= 1.1.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Apollo13Themes Rife Elementor Extensions & Templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rife Elementor Extensions & Templates: from n/a through 1.1.10.

    apollo13themes Rife Elementor Extensions & Templates