Skip to content
OpenAdvisories

Archive

13 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /13 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

191 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-40001

    WordPress iThemes Sync plugin <= 2.1.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SolidWP iThemes Sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through 2.1.13.

    solidwp iThemes Sync
  • Medium 5.3
    CVE-2023-39997

    WordPress Popup by Supsystic plugin <= 1.10.19 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in supsystic.com Popup by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup by Supsystic: from n/a through 1.10.19.

    supsysticcom Popup by Supsystic
  • Medium 5.3
    CVE-2023-39996

    WordPress Accordion and Accordion Slider plugin <= 1.2.4 - Broken Access Control

    Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Accordion and Accordion Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion and Accordion Slider: from n/a through 1.2.4.

    WP OnlineSupport, Essential Plugin Accordion and Accordion Slider
  • Medium 4.3
    CVE-2023-39995

    WordPress Portfolio and Projects plugin <= 1.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Portfolio and Projects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio and Projects: from n/a through 1.3.7.

    WP OnlineSupport, Essential Plugin Portfolio and Projects
  • Medium 5.3
    CVE-2023-39305

    WordPress Yet Another Stars Rating plugin <= 3.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Dash Labs Yet Another Stars Rating yet-another-stars-rating allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yet Another Stars Rating: from n/a through <= 3.4.3.

    Dash Labs Yet Another Stars Rating
  • Medium 4.3
    CVE-2023-38514

    WordPress Social Share Icons & Social Share Buttons plugin <= 3.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in social share pro Social Share Icons & Social Share Buttons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.5.7.

    Social Share Pro Social Share Icons & Social Share Buttons
  • Medium 5.4
    CVE-2023-38483

    WordPress Instant CSS plugin <= 1.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Dylan Blokhuis Instant CSS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instant CSS: from n/a through 1.1.4.

    Dylan Blokhuis Instant CSS
  • Medium 5.3
    CVE-2023-38480

    WordPress Booster Elementor Addons plugin <= 1.4.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Certain Dev Booster Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booster Elementor Addons: from n/a through 1.4.9.

    Certain Dev Booster Elementor Addons
  • Medium 5.3
    CVE-2023-38479

    WordPress Simple Googlebot Visit plugin <= 1.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Codents Simple Googlebot Visit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Googlebot Visit: from n/a through 1.2.4.

    codents Simple Googlebot Visit
  • Medium 4.3
    CVE-2023-38477

    WordPress QR code MeCard/vCard generator plugin <= 1.6.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Stanislav Kuznetsov QR code MeCard/vCard generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QR code MeCard/vCard generator: from n/a through 1.6.0.

    Stanislav Kuznetsov QR code MeCard/vCard generator
  • Medium 4.3
    CVE-2023-38475

    WordPress Donations Made Easy – Smart Donations plugin <= 4.0.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RedNao Donations Made Easy – Smart Donations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.

    RedNao Donations Made Easy – Smart Donations
  • Medium 5.4
    CVE-2023-38383

    WordPress Language plugin <= 1.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in OnTheGoSystems Language allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Language: from n/a through 1.2.1.

    OnTheGoSystems Language
  • Medium 5.4
    CVE-2023-37989

    WordPress Easyship WooCommerce Shipping Rates plugin <= 0.9.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Easyship Easyship WooCommerce Shipping Rates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easyship WooCommerce Shipping Rates: from n/a through 0.9.0.

    Easyship Easyship WooCommerce Shipping Rates Web / CMS
  • Medium 6.5
    CVE-2023-37987

    WordPress YourMembership Single Sign On plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YourMembership Single Sign On: from n/a through 1.1.3.

    miniOrange YourMembership Single Sign On
  • Medium 6.5
    CVE-2023-37971

    WordPress WooCommerce Product Stock Alert plugin <= 2.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Stock Alert: from n/a through 2.0.1.

    MultiVendorX WooCommerce Product Stock Alert Web / CMS
  • Medium 4.3
    CVE-2023-37984

    WordPress Quiz And Survey Master plugin <= 8.1.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ExpressTech Quiz And Survey Master allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 8.1.10.

    ExpressTech Systems Quiz And Survey Master
  • Medium 5.3
    CVE-2023-37969

    WordPress Checkout with Zelle on Woocommerce plugin <= 3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in The African Boss Checkout with Zelle on Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout with Zelle on Woocommerce: from n/a through 3.1.

    The African Boss Checkout with Zelle on Woocommerce Web / CMS
  • Medium 6.5
    CVE-2023-37967

    WordPress DirectoryPress plugin <= 3.6.2 - Unauthenticated Broken Access Control Vulnerability

    Missing Authorization vulnerability in Designinvento DirectoryPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through 3.6.2.

    Designinvento DirectoryPress
  • Medium 6.5
    CVE-2023-37887

    WordPress WPSchoolPress plugin <= 2.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPSchoolPress Team WPSchoolPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through 2.2.7.

    WPSchoolPress Team WPSchoolPress
  • Medium 5.3
    CVE-2023-36681

    WordPress Cryptocurrency Widgets – Price Ticker & Coins List plugin <= 2.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets – Price Ticker & Coins List: from n/a thro…

    Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List
  • Medium 5.4
    CVE-2023-36680

    WordPress Image Regenerate & Select Crop plugin <= 7.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Iulia Cazan Image Regenerate & Select Crop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Regenerate & Select Crop: from n/a through 7.1.0.

    Iulia Cazan Image Regenerate & Select Crop
  • Medium 4.3
    CVE-2023-36531 Public exploit

    WordPress LiquidPoll plugin <= 3.3.68 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a thro…

    liquidpoll LiquidPoll – Advanced Polls for Creators and Brands
  • Medium 5.3
    CVE-2023-36528

    WordPress kk Star Ratings plugin <= 5.4.3 - Rate Manipulation due to IP Spoofing Vulnerability

    Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.3.

    FeedbackWP kk Star Ratings
  • Medium 5.4
    CVE-2023-36526

    WordPress Duplicate Post Page Menu & Custom Post Type plugin <= 2.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Inqsys Technology Duplicate Post Page Menu & Custom Post Type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Duplicate Post Page Menu & Custom Post Type: from n/a through 2.4.1.

    Inqsys Technology Duplicate Post Page Menu & Custom Post Type
  • Medium 5.4
    CVE-2023-36519

    WordPress SW Product Bundles plugin <= 2.0.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpthemego SW Product Bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SW Product Bundles: from n/a through 2.0.15.

    wpthemego SW Product Bundles
  • Medium 4.3
    CVE-2023-36518

    WordPress Post Hit Counter plugin <= 1.3.2 - Broken Access Control

    Missing Authorization vulnerability in Hugh Lashbrooke Post Hit Counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Hit Counter: from n/a through 1.3.2.

    Hugh Lashbrooke Post Hit Counter
  • Medium 5.4
    CVE-2023-36509

    WordPress CHP Ads Block Detector plugin <= 3.9.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Suresh Chand CHP Ads Block Detector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CHP Ads Block Detector: from n/a through 3.9.5.

    Suresh Chand CHP Ads Block Detector
  • Medium 5.3
    CVE-2023-36506

    WordPress YITH WooCommerce Waitlist plugin <= 2.13.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITH YITH WooCommerce Waiting List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Waiting List: from n/a through 2.13.0.

    Yith YITH WooCommerce Waiting List Web / CMS
  • Medium 5.3
    CVE-2023-35875

    WordPress Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.8.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jegstudio Gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse: from n/a through 1.8.5.

    Jegstudio Gutenverse
  • Medium 5.3
    CVE-2023-35777

    WordPress The Events Calendar plugin <= 6.1.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.1.2.2.

    The Events Calendar The Events Calendar
  • Medium 5.4
    CVE-2023-35051

    WordPress Contact Forms by Cimatti plugin <= 1.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Forms by Cimatti: from n/a through 1.5.7.

    Cimatti Consulting Contact Forms by Cimatti
  • Medium 4.3
    CVE-2023-35052

    WordPress Directorist plugin <= 7.5.4 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in wpWax - WP Business Directory Plugin and Classified Listings Directory Directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through 7.5.4.

    wpWax - WP Business Directory Plugin and Classified Listings Directory Directorist
  • Medium 5.4
    CVE-2023-35046

    WordPress Dynamic Visibility for Elementor plugin <= 5.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Dynamic.ooo Dynamic Visibility for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamic Visibility for Elementor: from n/a through 5.0.5.

    Dynamic.ooo Dynamic Visibility for Elementor
  • Medium 4.3
    CVE-2023-34387

    WordPress Constant Contact Forms plugin <= 2.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Constant Contact Constant Contact Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact Forms: from n/a through 2.0.3.

    Constant Contact Constant Contact Forms
  • Medium 5.3
    CVE-2023-34381

    WordPress Zippy plugin <= 1.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Gesundheit Bewegt GmbH Zippy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zippy: from n/a through 1.6.2.

    Gesundheit Bewegt Zippy
  • Medium 6.5
    CVE-2023-34019

    WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.

    Uncanny Owl Uncanny Toolkit for LearnDash
  • Medium 5.4
    CVE-2023-34376

    WordPress Change WooCommerce Add To Cart Button Text plugin <= 1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rextheme Change WooCommerce Add To Cart Button Text allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Change WooCommerce Add To Cart Button Text: from n/a through 1.3.

    RexTheme Change WooCommerce Add To Cart Button Text Web / CMS
  • Medium 5.4
    CVE-2023-34014

    WordPress Grid Plus plugin <= 1.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in G5Theme Grid Plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grid Plus: from n/a through 1.3.2.

    G5Theme Grid Plus
  • Medium 4.3
    CVE-2023-34009

    WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.1 - Broken Access Control + CSRF

    Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Media & Share Icons: from n/a through 2.8.1.

    Inisev Social Media & Share Icons
  • Medium 4.3
    CVE-2023-33998

    WordPress Easy Social Icons plugin <= 3.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in cybernetikz Easy Social Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Icons: from n/a through 3.2.5.

    cybernetikz Easy Social Icons