Skip to content
OpenAdvisories

Archive

13 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /13 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

191 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-12553

    GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability

    GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit…

    GeoVision GV-ASManager
  • Medium 6.9
    CVE-2024-55890 Public exploit Scanner template

    D-Tale allows Remote Code Execution through the Custom Filter Input

    D-Tale is a visualizer for pandas data structures. Prior to version 3.16.1, users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Users should upgrade to version 3.16.1 where the `upda…

    man-group dtale dtale PyPI
  • Medium 5.3
    CVE-2024-9945

    Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0

    An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders.

    Fortra GoAnywhere MFT
  • Medium 6.5
    CVE-2024-54349

    WordPress Plain Post plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mashiurz Plain Post plain-post allows Stored XSS.This issue affects Plain Post: from n/a through <= 1.0.3.

    mashiurz Plain Post
  • Medium 6.5
    CVE-2024-54346

    WordPress Barter theme <= 1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 Barter barter allows DOM-Based XSS.This issue affects Barter: from n/a through <= 1.6.

    sonalsinha21 Barter
  • Medium 6.5
    CVE-2024-54345

    WordPress Bicycleshop theme <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 Bicycleshop bicycleshop allows DOM-Based XSS.This issue affects Bicycleshop: from n/a through <= 1.5.

    sonalsinha21 Bicycleshop
  • Medium 6.5
    CVE-2024-54338

    WordPress Hello Event Widgets For Elementor plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in christer_f Hello Event Widgets For Elementor hello-event-widgets-for-elementor allows DOM-Based XSS.This issue affects Hello Event Widgets For Elementor: fro…

    christer_f Hello Event Widgets For Elementor
  • Medium 6.5
    CVE-2024-54334

    WordPress Quran Phrases About Most People Shortcodes plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeshanb Quran Phrases About Most People Shortcodes quran-phrases-about-most-people-shortcodes allows DOM-Based XSS.This issue affects Quran Phrases About Mos…

    zeshanb Quran Phrases About Most People Shortcodes
  • Medium 6.5
    CVE-2024-54326

    WordPress GEO my WP plugin <= 4.5.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through <= 4.5.0.4.

    Eyal Fitoussi GEO my WordPress Web / CMS
  • Medium 5.4
    CVE-2024-54323

    WordPress New User Approve plugin <= 2.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 2.6.2.

    Saad Iqbal New User Approve
  • Medium 4.3
    CVE-2024-54321

    WordPress Hive Support plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Hive Support Hive Support hive-support allows Cross Site Request Forgery.This issue affects Hive Support: from n/a through <= 1.1.2.

    Hive Support Hive Support
  • Medium 6.5
    CVE-2024-54318

    WordPress NiceJob plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affects NiceJob: from n/a through <= 3.6.5.

    nicejob NiceJob
  • Medium 6.5
    CVE-2024-54317

    WordPress Web Stories plugin <= 1.37.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Google Web Stories web-stories allows Stored XSS.This issue affects Web Stories: from n/a through <= 1.37.0.

    Google Web Stories
  • Medium 6.5
    CVE-2024-54316

    WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor allows DOM-Based XSS.This issue affects Restaurant & Cafe Addon for Ele…

    nicheaddons Restaurant & Cafe Addon for Elementor
  • Medium 6.5
    CVE-2024-54315

    WordPress Events Addon for Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-elementor allows DOM-Based XSS.This issue affects Events Addon for Elementor: from n/a through <= 2.2…

    nicheaddons Events Addon for Elementor
  • Medium 6.5
    CVE-2024-54314

    WordPress Primary Addon for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.6…

    nicheaddons Primary Addon for Elementor
  • Medium 6.5
    CVE-2024-54313

    WordPress FULL – Cliente plugin <= 3.1.25 - Local File Inclusion vulnerability

    Path Traversal vulnerability in FULL. FULL Customer allows Path Traversal.This issue affects FULL Customer: from n/a through 3.1.25.

    FULL. FULL Customer
  • Medium 5.4
    CVE-2024-54311

    WordPress Mark New Posts plugin <= 7.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in i.lychkov Mark New Posts mark-new-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark New Posts: from n/a through <= 7.5.1.

    i.lychkov Mark New Posts
  • Medium 5.3
    CVE-2024-54310

    WordPress Gou Manage My Account Menu plugin <= 1.0.1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Aslam Khan Gouran Gou Manage My Account Menu gou-wc-account-tabs allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Gou Manage My Account Menu: from n/a through <= 1.0.1.8.

    Aslam Khan Gouran Gou Manage My Account Menu
  • Medium 6.5
    CVE-2024-54309

    WordPress PostBox plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in wpdebuglog PostBox postbox-email-logs allows Retrieve Embedded Sensitive Data.This issue affects PostBox: from n/a through <= 1.0.4.

    wpdebuglog PostBox
  • Medium 5.9
    CVE-2024-54308

    WordPress Cryptocurrency Price Widget plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Cryptocurrency Price Widget cryptocurrency-price-widget allows Stored XSS.This issue affects Cryptocurrency Price Widget: from n/a through <= 1.2.…

    falselight Cryptocurrency Price Widget
  • Medium 4.3
    CVE-2024-54307

    WordPress AIcomments plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in aipost AIcomments aicomments allows Cross Site Request Forgery.This issue affects AIcomments: from n/a through <= 1.4.1.

    aipost AIcomments
  • Medium 4.3
    CVE-2024-54306

    WordPress AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in aitool AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot ai-seo-translator allows Cross Site Request Forgery.This issue affects AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot: from …

    aitool AIKCT Engine Chatbot, ChatGPT, Gemini, GPT-4o Best AI Chatbot
  • Medium 4.3
    CVE-2024-54300

    WordPress AutoWP plugin <= 2.0.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Cross Site Request Forgery.This issue affects AutoWP: from n/a through <= 2.0.8.

    Basar Ventures AutoWP
  • Medium 4.3
    CVE-2024-54298

    WordPress Car Dealer plugin <= 4.46 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sminozzi Car Dealer cardealer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Dealer: from n/a through <= 4.46.

    sminozzi Car Dealer
  • Medium 6.5
    CVE-2024-54289

    WordPress Awesome Support plugin <= 6.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.3.1.

    Awesome Support Awesome Support
  • Medium 6.5
    CVE-2024-54287

    WordPress Advanced Blog Post Block plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer Advanced Blog Post Block advanced-blog-post-block allows Stored XSS.This issue affects Advanced Blog Post Block: from n/a through <= 1.0.4.

    Best WP Developer Advanced Blog Post Block
  • Medium 6.5
    CVE-2024-54286

    WordPress Smaily for WP plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smaily Smaily for WP smaily-for-wp allows Stored XSS.This issue affects Smaily for WP: from n/a through <= 3.1.5.

    Smaily Smaily for WP
  • Medium 4.3
    CVE-2024-54278

    WordPress News Ticker for Elementor plugin <= 2.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor news-ticker-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects News Ticker for Elementor: from n/a through <= 2.1.3.

    Plugin Devs News Ticker for Elementor
  • Medium 6.5
    CVE-2024-54277

    WordPress Nias course plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alireza Aliniya Nias course nias-course allows DOM-Based XSS.This issue affects Nias course: from n/a through <= 1.2.10.

    Alireza Aliniya Nias course
  • Medium 6.5
    CVE-2024-54276

    WordPress Poll Builder plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devfelixmoira Poll Builder poll-builder allows Stored XSS.This issue affects Poll Builder: from n/a through <= 1.3.5.

    devfelixmoira Poll Builder
  • Medium 6.5
    CVE-2024-54272

    WordPress Radius Blocks plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Radius Blocks radius-blocks allows Stored XSS.This issue affects Radius Blocks: from n/a through <= 2.1.2.

    RadiusTheme Radius Blocks
  • Medium 5.4
    CVE-2024-54271

    WordPress WPCargo Track & Trace plugin <= 8.0.2 - Settings Change vulnerability

    Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

    Arni Cinco WPCargo Track & Trace
  • Medium 4.3
    CVE-2024-54268

    WordPress SiteOrigin Widgets Bundle plugin <= 1.64.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Greg - SiteOrigin SiteOrigin Widgets Bundle so-widgets-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteOrigin Widgets Bundle: from n/a through <= 1.64.0.

    Greg – SiteOrigin SiteOrigin Widgets Bundle
  • Medium 4.3
    CVE-2024-54267

    WordPress CM Answers plugin <= 3.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Answers: from n/a through <= 3.2.6.

    CreativeMindsSolutions CM Answers
  • Medium 6.5
    CVE-2024-54259

    WordPress DELUCKS SEO plugin <= 2.7.0 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.

    delucks DELUCKS SEO
  • Medium 6.3
    CVE-2024-54252

    WordPress Pinpoint Booking System Plugin <= 2.9.9.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.

    dotonpaper Pinpoint Booking System
  • Medium 6.5
    CVE-2024-54250

    WordPress Prodigy Commerce plugin <= 3.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through <= 3.0.8.

    prodigycommerce Prodigy Commerce
  • Medium 6.5
    CVE-2024-54246

    WordPress FAQs plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Stored XSS.This issue affects FAQs: from n/a through <= 1.0.2.

    Think201 FAQs
  • Medium 6.5
    CVE-2024-54245

    WordPress Clients plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through <= 1.1.4.

    Think201 Clients