Skip to content
OpenAdvisories

Archive

9 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /9 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

288 results · Feed

  • Medium 4.3
    CVE-2024-53816

    WordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.This issue affects Tutor LMS Elementor Addons: from n/a through <= 2.1.5.

    Themeum Tutor LMS Elementor Addons
  • Medium 5.4
    CVE-2024-54217

    WordPress ARForms plugin <= 6.4.1 - Subscriber+ Plugin Settings Change vulnerability

    Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.1.

    Repute InfoSystems ARForms
  • Medium 6.5
    CVE-2024-53791

    WordPress Lenxel Core plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows DOM-Based XSS.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through <= 1.3.9.

    Ogun Labs Lenxel Core for Lenxel(LNX) LMS
  • Medium 5.4
    CVE-2024-53798

    WordPress FloristPress plugin <= 7.3.0 - Nonce Leakage to Broken Access Control vulnerability

    Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion.This issue affects FloristPress: from n/a through <= 7.3.0.

    BAKKBONE Australia FloristPress
  • Medium 6.5
    CVE-2024-53818

    WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post.This issue affects PostX: from n/a through <= 4.1.15.

    wpxpo PostX
  • High 7.1
    CVE-2024-54219

    WordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Site-Wide Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thehp AIO Contact aio-contact.This issue affects AIO Contact: from n/a through <= 2.8.1.

    thehp AIO Contact
  • High 7.1
    CVE-2024-54220

    WordPress FAT Services Booking plugin <= 5.6 - Subscriber+ Site-Wide Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Services Booking fat-services-booking allows Stored XSS.This issue affects FAT Services Booking: from n/a through <= 5.6.

    roninwp FAT Services Booking
  • Medium 6.5
    CVE-2024-54247

    WordPress ABCBiz Addons and Templates for Elementor plugin <= 2.0.2 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ABCBiz ABCBiz Addons and Templates for Elementor allows Stored XSS.This issue affects ABCBiz Addons and Templates for Elementor: from n/a through 2.0.2.

    ABCBiz ABCBiz Addons and Templates for Elementor
  • Medium 6.5
    CVE-2024-54253

    WordPress Xpro Addons For Elementor plugin <= 1.4.6.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons.This issue affects Xpro Elementor Addons: from n/a through <= 1.4.6.5.

    Xpro Xpro Elementor Addons
  • Medium 6.3
    CVE-2024-54254

    WordPress Message Filter for Contact Form 7 plugin <= 1.6.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.3.

    Kofi Mokome Message Filter for Contact Form 7
  • Medium 5.3
    CVE-2024-53819

    WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerability

    Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.0.

    Bold Grid Client Invoicing by Sprout Invoices
  • Critical 9.3
    CVE-2024-54215

    WordPress Revy plugin <= 1.18 - Unauthenticated SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy.This issue affects Revy: from n/a through <= 1.18.

    roninwp Revy
  • Critical 10.0
    CVE-2024-53822

    WordPress Pie Register Premium plugin < 3.8.3.3 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3.

    Genetech Solutions Pie Register Premium
  • High 7.5
    CVE-2024-53790

    WordPress Lenxel Core plugin <= 1.2.8 - Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ogun Labs Lenxel Core for Lenxel(LNX) LMS lenxel-core allows PHP Local File Inclusion.This issue affects Lenxel Core for Lenxel(LNX) LMS: from n/a through <= 1.3.9.

    Ogun Labs Lenxel Core for Lenxel(LNX) LMS
  • Critical 9.8
    CVE-2024-43222

    WordPress Sweet Date theme <= 3.7.3 - Privilege Escalation vulnerability

    Missing Authorization vulnerability in SeventhQueen Sweet Date sweetdate allows Privilege Escalation.This issue affects Sweet Date: from n/a through <= 3.7.3.

    SeventhQueen Sweet Date
  • Unscored —
    RUSTSEC-2024-0423

    gtk-layer-shell-sys GTK3 bindings - no longer maintained

    The gtk-layer-shell-sys GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at [gtk4-layer-shell](https:…

    gtk-layer-shell-sys crates.io
  • Unscored —
    RUSTSEC-2024-0422

    gtk-layer-shell GTK3 bindings - no longer maintained

    The gtk-layer-shell GTK3 bindings are no longer maintained. The maintainers have archived the repository, and added a note to the crate description and its README.md that the crates are no longer maintained. Please take a look at [gtk4-layer-shell](https://gi…

    gtk-layer-shell crates.io
  • Medium 4.3
    CVE-2023-48277

    WordPress Super Progressive Web Apps plugin <= 2.2.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SuperPWA Super Progressive Web Apps super-progressive-web-apps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Progressive Web Apps: from n/a through <= 2.2.21.

    superpwa Super Progressive Web Apps
  • Medium 4.3
    CVE-2024-54227

    WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Dotstore Minimum and Maximum Quantity for WooCommerce min-and-max-quantity-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Minimum and Maximum Quantity for WooCo…

    Dotstore Minimum and Maximum Quantity for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2024-54251

    WordPress Prodigy Commerce plugin <= 3.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Prodigy Commerce: from n/a through <= 3.1.2.

    prodigycommerce Prodigy Commerce
  • Medium 6.5
    CVE-2024-54224

    WordPress ElementsReady Addons for Elementor plugin <= 6.4.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows DOM-Based XSS.This issue affects ElementsReady Addons for Elementor: from n/a throug…

    quomodosoft ElementsReady Addons for Elementor
  • Medium 6.5
    CVE-2024-54228

    WordPress Wot Elementor Widgets plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Wot Elementor Widgets wot-elementor-widgets allows DOM-Based XSS.This issue affects Wot Elementor Widgets: from n/a through <=…

    Weboccult Technologies Pvt Wot Elementor Widgets
  • Medium 6.5
    CVE-2024-54230

    WordPress Unlock Addons for Elementor plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masud Hasan Unlock Addons for Elementor unlock-addons-for-elementor allows DOM-Based XSS.This issue affects Unlock Addons for Elementor: from n/a through <= …

    Masud Hasan Unlock Addons for Elementor
  • Medium 6.5
    CVE-2024-54232

    WordPress RRAddons for Elementor plugin <= 1.1.0 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RRDevs RRAddons for Elementor rrdevs-for-elementor allows Stored XSS.This issue affects RRAddons for Elementor: from n/a through <= 1.1.0.

    RRDevs RRAddons for Elementor
  • Medium 6.5
    CVE-2024-54260

    WordPress News Kit Elementor Addons plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Stored XSS.This issue affects News Kit Elementor Addons: from n/a through <= 1.4.2.

    blazethemes News Kit Elementor Addons
  • High 7.1
    CVE-2024-54226

    WordPress Country Blocker plugin <= 3.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in karlkiesinger Country Blocker country-blocker allows Stored XSS.This issue affects Country Blocker: from n/a through <= 3.2.

    Karl Kiesinger Country Blocker
  • Medium 4.7
    CVE-2024-54255

    WordPress Login Widget With Shortcode plugin <= 6.1.2 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue affects Login Widget With Shortcode: from n/a through <= 6.1.2.

    aviplugins.com Login Widget With Shortcode
  • High 7.5
    CVE-2024-54225

    WordPress Designer plugin <= 1.4.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codegearthemes Designer designer allows PHP Local File Inclusion.This issue affects Designer: from n/a through <= 1.4.1.

    codegearthemes Designer
  • Medium 5.3
    CVE-2024-54223

    WordPress ARForms plugin <= 1.7.1 - HTML Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in reputeinfosystems ARForms Form Builder arforms-form-builder allows Code Injection.This issue affects ARForms Form Builder: from n/a through <= 1.7.1.

    Repute InfoSystems ARForms Form Builder
  • High 7.5
    CVE-2023-22701

    WordPress Ebook Store plugin <= 5.775 - Broken Authentication vulnerability

    Missing Authorization vulnerability in Shopfiles Ltd Ebook Store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ebook Store: from n/a through 5.775.

    Shopfiles Ebook Store
  • Medium 4.3
    CVE-2023-22708

    WordPress Kraken.io Image Optimizer plugin <= 2.6.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Karim Salman Kraken.io Image Optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kraken.io Image Optimizer: from n/a through 2.6.7.

    Karim Salman Kraken.io Image Optimizer
  • Medium 5.2
    CVE-2023-23715

    WordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.2.2 - IDOR Leading To Job Removal Vulnerability

    Missing Authorization vulnerability in JobBoardWP JobBoardWP – Job Board Listings and Submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobBoardWP – Job Board Listings and Submissions: from n/a through 1.2.…

    JobBoardWP JobBoardWP – Job Board Listings and Submissions
  • Medium 4.3
    CVE-2023-23716

    WordPress Zendesk Support for WordPress plugin <= 1.8.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Zendesk Zendesk Support for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zendesk Support for WordPress: from n/a through 1.8.4.

    Zendesk Zendesk Support for WordPress Web / CMS
  • Medium 4.3
    CVE-2023-23725

    WordPress Shortcodes by Angie Makes plugin <= 3.46 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Chris Baldelomar Shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes: from n/a through 3.46.

    Chris Baldelomar Shortcodes
  • Low 3.8
    CVE-2023-23814

    WordPress Calendar Event Multi View plugin <= 1.4.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through 1.4.13.

    codepeople CP Multi View Event Calendar
  • Medium 5.4
    CVE-2023-23726

    WordPress Tickera – WordPress Event Ticketing plugin <= 3.5.1.0 - CSRF Leading To Post Status Change Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tickera.com Tickera allows Cross Site Request Forgery.This issue affects Tickera: from n/a through 3.5.1.0.

    Tickera.com Tickera
  • Medium 4.3
    CVE-2023-23823

    WordPress Enhanced Text Widget plugin <= 1.5.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Clever Widgets Enhanced Text Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Text Widget: from n/a through 1.5.8.

    Clever Widgets Enhanced Text Widget
  • Low 3.1
    CVE-2023-23825

    WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Import_WPforms vulnerability

    Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.

    Brainstorm Force Spectra
  • Medium 4.3
    CVE-2023-23834

    WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Activate_Plugin vulnerability

    Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.

    Brainstorm Force Spectra
  • Medium 5.4
    CVE-2023-23868

    WordPress Cost of Goods for WooCommerce plugin <= 2.8.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFactory Cost of Goods for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost of Goods for WooCommerce: from n/a through 2.8.6.

    WPFactory Cost of Goods for WooCommerce Web / CMS