Skip to content
OpenAdvisories

Archive

9 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /9 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

212 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-27625

    WordPress Site Reviews plugin <= 6.5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Paul Ryley Site Reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 6.5.0.

    Paul Ryley Site Reviews
  • Medium 5.3
    CVE-2023-27626

    WordPress Stock Ticker plugin <= 3.23.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Aleksandar Urošević Stock Ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Ticker: from n/a through 3.23.0.

    Aleksandar Urošević Stock Ticker
  • Medium 4.3
    CVE-2023-28165

    WordPress Backup Bank: WordPress Backup Plugin plugin <= 4.0.28 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Tech Banker Backup Bank: WordPress Backup Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup Bank: WordPress Backup Plugin: from n/a through 4.0.28.

    Tech Banker Backup Bank: WordPress Backup Plugin Web / CMS
  • Medium 4.3
    CVE-2023-28416

    WordPress Chankhe theme <= 1.0.5 - Authenticated Arbitrary Plugin Activation vulnerability

    Missing Authorization vulnerability in Sparkle Themes Chankhe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chankhe: from n/a through 1.0.5.

    Sparkle Themes Chankhe
  • Medium 4.3
    CVE-2023-28532

    WordPress Real Estate Directory theme <= 1.0.5 - Authenticated Arbitrary Plugin Activation

    Missing Authorization vulnerability in wpdirectorykit.com Real Estate Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Directory: from n/a through 1.0.5.

    wpdirectorykit.com Real Estate Directory
  • Medium 5.4
    CVE-2023-28417

    WordPress Dynamics 365 Integration plugin <= 1.3.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.12.

    alexacrm Dynamics 365 Integration
  • Medium 5.3
    CVE-2023-28536

    WordPress Branded Social Images plugin <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Acato Branded Social Images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Branded Social Images: from n/a through 1.1.0.

    Acato Branded Social Images
  • Medium 5.4
    CVE-2023-28688

    WordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk TH Variation Swatches allows Cross Site Request Forgery.This issue affects TH Variation Swatches: from n/a through 1.2.7.

    ThemeHunk TH Variation Swatches
  • Medium 6.5
    CVE-2023-28689

    WordPress JS Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through 2.0.0.

    JoomSky JS Job Manager
  • Medium 6.3
    CVE-2023-29237

    WordPress Remove Duplicate Posts plugin <= 1.3.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Muhammad Rehman Remove Duplicate Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Remove Duplicate Posts: from n/a through 1.3.5.

    muhammad-rehman Remove Duplicate Posts
  • Medium 5.3
    CVE-2023-29173

    WordPress Product Category Tree plugin <= 2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AWESOME TOGI Product Category Tree allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Category Tree: from n/a through 2.5.

    AWESOME TOGI Product Category Tree
  • Medium 5.4
    CVE-2023-29239

    WordPress LuckyWP Scripts Control plugin <= 1.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through 1.2.1.

    LuckyWP LuckyWP Scripts Control
  • Medium 4.3
    CVE-2023-29422

    WordPress Dynamics 365 Integration plugin <= 1.3.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.13.

    alexacrm Dynamics 365 Integration
  • Medium 5.3
    CVE-2023-29429

    WordPress User Registration plugin <= 2.3.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPEverest User Registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 2.3.2.1.

    WPEverest User Registration
  • Medium 4.3
    CVE-2023-29431

    WordPress qTranslate X Cleanup and WPML Import plugin <= 3.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in OntheGoSystems qTranslate X Cleanup and WPML Import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects qTranslate X Cleanup and WPML Import: from n/a through 3.0.1.

    OnTheGoSystems qTranslate X Cleanup and WPML Import
  • Medium 5.4
    CVE-2023-29433

    WordPress tencentcloud-cos plugin <= 1.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in 腾讯云 tencentcloud-cos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects tencentcloud-cos: from n/a through 1.0.7.

  • Medium 5.3
    CVE-2023-30479

    WordPress Stamped.io Product Reviews & UGC for WooCommerce plugin <= 2.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Stamped.io Stamped.io Product Reviews & UGC for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stamped.io Product Reviews & UGC for WooCommerce: from n/a through 2.…

    Stamped.io Stamped.io Product Reviews & UGC for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-30476

    WordPress Blogger Buzz theme <= 1.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2.

    Sparkle Themes Blogger Buzz
  • Medium 4.3
    CVE-2023-30486 Public exploit

    WordPress Square theme <= 2.0.0 - Broken Access Control

    Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.

    HashThemes Square
  • Medium 5.3
    CVE-2023-30488

    WordPress Featured Post Creative plugin <= 1.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Featured Post Creative allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Featured Post Creative: from n/a through 1.2.7.

    WP OnlineSupport, Essential Plugin Featured Post Creative
  • Medium 4.3
    CVE-2023-30748

    WordPress Easy Appointments plugin <= 3.10.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikola Loncar Easy Appointments allows Stored XSS.This issue affects Easy Appointments: from n/a through 3.10.7.

    Nikola Loncar Easy Appointments
  • Medium 4.3
    CVE-2023-30783

    WordPress Smart WooCommerce Search plugin <= 2.5.0 - Broken Access Control

    Missing Authorization vulnerability in YummyWP Smart WooCommerce Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WooCommerce Search: from n/a through 2.5.0.

    YummyWP Smart WooCommerce Search Web / CMS
  • Medium 6.5
    CVE-2023-30870

    WordPress Sharkdropship for AliExpress Dropship and Affiliate plugin <= 2.2.3 - Multiple Broken Access Control vulnerabilities

    Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sharkdropship for AliExpress Dropship and Affiliate: from …

    Woo product importer Sharkdropship for AliExpress Dropship and Affiliate
  • Medium 5.4
    CVE-2023-30873

    WordPress WP Docs plugin <= 1.9.8 - Broken Access Control

    Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through 1.9.8.

    Fahad Mahmood WP Docs
  • Medium 4.3
    CVE-2023-31073

    WordPress Shortcode to display post and user data plugin <= 1.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jose Vega Display custom fields in the frontend – Post and User Profile Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Display custom fields in the frontend – Post and U…

    Jose Vega Display custom fields in the frontend – Post and User Profile Fields
  • Medium 5.4
    CVE-2023-31214

    WordPress WP Quick Post Duplicator plugin <= 2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arul Prasad J WP Quick Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Quick Post Duplicator: from n/a through 2.0.

    Arul Prasad J WP Quick Post Duplicator
  • Medium 5.4
    CVE-2023-32094

    WordPress Extended Post Status plugin <= 1.0.19 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Felix Welberg Extended Post Status allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extended Post Status: from n/a through 1.0.19.

    Felix Welberg Extended Post Status
  • Medium 5.3
    CVE-2023-32293

    WordPress WRC Pricing Tables plugin <= 2.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Realwebcare WRC Pricing Tables allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WRC Pricing Tables: from n/a through 2.3.7.

    Realwebcare WRC Pricing Tables
  • Medium 4.3
    CVE-2023-32126

    WordPress SALERT plugin <= 1.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPoperation SALERT allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALERT: from n/a through 1.2.1.

    WPoperation SALERT
  • Medium 6.5
    CVE-2023-32299

    WordPress Ni WooCommerce Sales Report plugin <= 3.7.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Sales Report ni-woocommerce-sales-report allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ni WooCommerce Sales Report: from n/a through <= 3.7.3.

    Anzar Ahmed Ni WooCommerce Sales Report Web / CMS
  • Medium 5.4
    CVE-2023-47694

    WordPress Mini Cart Drawer For WooCommerce plugin <= 4.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in appsbd Mini Cart Drawer For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mini Cart Drawer For WooCommerce: from n/a through 4.0.0.

    Appsbd Mini Cart Drawer For WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-47756

    WordPress Welcome Email Editor plugin <= 5.0.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in David Vongries Welcome Email Editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcome Email Editor: from n/a through 5.0.6.

    David Vongries Welcome Email Editor
  • Medium 4.3
    CVE-2023-47760

    WordPress Essential Blocks plugin <= 4.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.2.0.

    WPDeveloper Essential Blocks for Gutenberg
  • Medium 4.3
    CVE-2023-47761

    WordPress Simple 301 Redirects by BetterLinks plugin <= 2.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Simple 301 Redirects by BetterLinks simple-301-redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple 301 Redirects by BetterLinks: from n/a through <= 2.0…

    WPDeveloper Simple 301 Redirects by BetterLinks
  • Medium 4.3
    CVE-2023-47762

    WordPress BetterDocs plugin <= 2.5.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper BetterDocs betterdocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BetterDocs: from n/a through <= 2.5.2.

    WPDeveloper BetterDocs
  • Medium 4.3
    CVE-2023-47763

    WordPress WP Custom Admin Interface plugin <= 7.31 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through <= 7.31.

    Northern Beaches Websites WP Custom Admin Interface
  • Medium 6.5
    CVE-2023-47764

    WordPress Ditty plugin <= 3.1.24 - Broken Access Control vulnerability

    Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through <= 3.1.24.

    Metaphor Creations Ditty
  • Medium 4.3
    CVE-2023-47776

    WordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through <= 4.2.1.

    miniOrange miniorange otp verification
  • Medium 4.3
    CVE-2023-47780

    WordPress EasyAzon – Amazon Associates Affiliate Plugin plugin <= 5.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in flowdee EasyAzon easyazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyAzon: from n/a through <= 5.1.0.

    flowdee EasyAzon
  • Medium 4.3
    CVE-2023-47793

    WordPress Acme Fix Images plugin <= 1.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Acme Themes Acme Fix Images acme-fix-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acme Fix Images: from n/a through <= 1.0.0.

    Acme Themes Acme Fix Images