Skip to content
OpenAdvisories

Archive

13 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /13 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

297 results · Feed

  • Medium 5.4
    CVE-2024-54271

    WordPress WPCargo Track & Trace plugin <= 8.0.2 - Settings Change vulnerability

    Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

    Arni Cinco WPCargo Track & Trace
  • Medium 4.3
    CVE-2024-54268

    WordPress SiteOrigin Widgets Bundle plugin <= 1.64.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Greg - SiteOrigin SiteOrigin Widgets Bundle so-widgets-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteOrigin Widgets Bundle: from n/a through <= 1.64.0.

    Greg – SiteOrigin SiteOrigin Widgets Bundle
  • Medium 4.3
    CVE-2024-54267

    WordPress CM Answers plugin <= 3.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Answers: from n/a through <= 3.2.6.

    CreativeMindsSolutions CM Answers
  • High 7.1
    CVE-2024-54266

    WordPress ImageRecycle pdf & image compression plugin <= 3.1.16 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ImageRecycle ImageRecycle pdf & image compression imagerecycle-pdf-image-compression allows Reflected XSS.This issue affects ImageRecycle pdf & image compres…

    ImageRecycle ImageRecycle pdf & image compression
  • High 7.1
    CVE-2024-54265

    WordPress Barcode Scanner and Inventory manager plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Refl…

    Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager
  • High 7.1
    CVE-2024-54264

    WordPress Shortcodes Blocks Creator Ultimate plugin <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmorillas1 Shortcodes Blocks Creator Ultimate ultimate-shortcodes-creator allows Reflected XSS.This issue affects Shortcodes Blocks Creator Ultimate: from n/…

    cmorillas1 Shortcodes Blocks Creator Ultimate
  • Critical 9.9
    CVE-2024-54262 Public exploit

    WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.

    sidngr Import Export For WooCommerce Web / CMS
  • Critical 10.0
    CVE-2024-54261

    WordPress TAX SERVICE Electronic HDM plugin <= 1.2.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HK Digital Agency LLC TAX SERVICE Electronic HDM virtual-hdm-for-taxservice-am allows SQL Injection.This issue affects TAX SERVICE Electronic HDM: from n/a t…

    HK Digital Agency TAX SERVICE Electronic HDM
  • Medium 6.5
    CVE-2024-54259

    WordPress DELUCKS SEO plugin <= 2.7.0 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Path Traversal.This issue affects DELUCKS SEO: from n/a through <= 2.7.0.

    delucks DELUCKS SEO
  • High 7.1
    CVE-2024-54256

    WordPress Easy Blocks pro plugin <= 1.0.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Seerox Easy Blocks pro easy-blocks-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Easy Blocks pro: from n/a through <= 1.0.21.

    Seerox Easy Blocks pro
  • High 8.5
    CVE-2024-54258

    WordPress Ni CRM Lead plugin <= 1.3.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows SQL Injection.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.

    Anzar Ahmed Ni CRM Lead
  • Medium 6.3
    CVE-2024-54252

    WordPress Pinpoint Booking System Plugin <= 2.9.9.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.

    dotonpaper Pinpoint Booking System
  • Medium 6.5
    CVE-2024-54250

    WordPress Prodigy Commerce plugin <= 3.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prodigycommerce Prodigy Commerce prodigy-commerce allows DOM-Based XSS.This issue affects Prodigy Commerce: from n/a through <= 3.0.8.

    prodigycommerce Prodigy Commerce
  • High 8.8
    CVE-2024-54248

    WordPress Eewee Admin Custom plugin <= 1.8.2.4 - CSRF to Privilege Escalation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in eewee eewee admin custom eewee-admincustom allows Privilege Escalation.This issue affects eewee admin custom: from n/a through <= 1.8.2.4.

    eewee eewee admin custom
  • Medium 6.5
    CVE-2024-54246

    WordPress FAQs plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 FAQs faqs allows Stored XSS.This issue affects FAQs: from n/a through <= 1.0.2.

    Think201 FAQs
  • Medium 6.5
    CVE-2024-54245

    WordPress Clients plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients clients allows Stored XSS.This issue affects Clients: from n/a through <= 1.1.4.

    Think201 Clients
  • Medium 6.5
    CVE-2024-54244

    WordPress Easy Replace plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Easy Replace easy-replace allows Stored XSS.This issue affects Easy Replace: from n/a through <= 1.3.

    Think201 Easy Replace
  • Medium 6.5
    CVE-2024-54243

    WordPress Echoza plugin <= 0.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Echoza echoza allows Stored XSS.This issue affects Echoza: from n/a through <= 0.1.1.

    Think201 Echoza
  • Medium 6.5
    CVE-2024-54241

    WordPress Elite Notification plugin 1.5 - Cross Site Scripting (XSS) vulnerability

    Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social P…

    Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification Web / CMS
  • Medium 6.5
    CVE-2024-54242

    WordPress Simple Notification plugin <= 1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in appsbd Simple Notification simple-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Notification: from n/a through <= 1.3.

    Appsbd Simple Notification
  • High 7.1
    CVE-2024-54240

    WordPress Blaze Online eParcel for WooCommerce plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazeonline Blaze Online eParcel for WooCommerce blaze-online-eparcel-for-woocommerce allows Reflected XSS.This issue affects Blaze Online eParcel for WooCom…

    blazeonline Blaze Online eParcel for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2024-54239 Public exploit

    WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through <= 4.0.18.

    dugudlabs Eyewear prescription form
  • High 7.1
    CVE-2024-54238

    WordPress Board Document Manager from CHUHPL plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL board-document-manager-from-chuhpl allows Reflected XSS.T…

    Cleveland Heights-University Heights Public Library Webdeveloper Board Document Manager from CHUHPL
  • High 7.1
    CVE-2024-54237

    WordPress Ni CRM Lead plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni CRM Lead ni-crm-lead allows Reflected XSS.This issue affects Ni CRM Lead: from n/a through <= 1.3.0.

    Anzar Ahmed Ni CRM Lead
  • High 7.1
    CVE-2024-54236

    WordPress Ni WooCommerce Bulk Product Editor plugin <= 1.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Bulk Product Editor ni-woocommerce-product-editor allows Reflected XSS.This issue affects Ni WooCommerce Bulk Product Editor: from…

    Anzar Ahmed Ni WooCommerce Bulk Product Editor Web / CMS
  • High 7.1
    CVE-2024-54235

    WordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiptimize Shiptimize for WooCommerce shiptimize-for-woocommerce allows Reflected XSS.This issue affects Shiptimize for WooCommerce: from n/a through <= 3.1.…

    Shiptimize Shiptimize for WooCommerce Web / CMS
  • Critical 9.3
    CVE-2024-54234

    WordPress Limit Login Attempts plugin <= 5.5 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wp-buy Limit Login Attempts wp-limit-failed-login-attempts allows SQL Injection.This issue affects Limit Login Attempts: from n/a through <= 5.5.

    wp-buy Limit Login Attempts
  • High 7.1
    CVE-2024-54233

    WordPress Advanced Control Manager plugin <= 2.16.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in overclokk Advanced Control Manager for WordPress by ItalyStrap advanced-control-manager allows Reflected XSS.This issue affects Advanced Control Manager for …

    overclokk Advanced Control Manager for WordPress by ItalyStrap Web / CMS
  • Medium 5.3
    CVE-2023-44149

    WordPress Brands for WooCommerce plugin <= 3.8.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brands for WooCommerce: from n/a through <= 3.8.2.2.

    BeRocket Brands for WooCommerce Web / CMS
  • High 7.1
    CVE-2024-54231

    WordPress Ni WooCommerce Order Export plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Order Export ni-woocommerce-order-export allows Reflected XSS.This issue affects Ni WooCommerce Order Export: from n/a through <= …

    Anzar Ahmed Ni WooCommerce Order Export Web / CMS
  • Medium 5.3
    CVE-2023-44147

    WordPress Comment Blacklist Updater plugin <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in apasionados Comment Blacklist Updater comment-blacklist-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through <= 1.1.0.

    apasionados Comment Blacklist Updater
  • Medium 5.4
    CVE-2023-44142

    WordPress Inactive Logout plugin <= 3.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Deepen Bajracharya Inactive Logout inactive-logout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Inactive Logout: from n/a through <= 3.2.2.

    Deepen Bajracharya Inactive Logout
  • Medium 5.3
    CVE-2023-41952

    WordPress Fluent Forms plugin <= 5.0.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Contact Form - WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 5.0.8.

    Contact Form - WPManageNinja FluentForm
  • Medium 4.3
    CVE-2023-41951

    WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.6.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.6.14.

    rtcamp rtMedia for WordPress, BuddyPress and bbPress Web / CMS
  • Medium 5.3
    CVE-2023-41875

    WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6.

    wpdirectorykit.com WP Directory Kit
  • Medium 4.3
    CVE-2023-41873

    WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4.

    miniOrange SAML SP Single Sign On
  • Medium 4.3
    CVE-2023-41870

    WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5.

    Themeum WP Crowdfunding
  • Medium 4.3
    CVE-2023-41869

    WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.4.

    Alex Volkov WP Accessibility Helper (WAH)
  • Medium 4.3
    CVE-2023-41866

    WordPress Automatic YouTube Gallery plugin <= 2.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Team Plugins360 Automatic YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic YouTube Gallery: from n/a through 2.3.3.

    Team Plugins360 Automatic YouTube Gallery
  • Medium 4.3
    CVE-2023-41865

    WordPress Slider Pro plugin <= 4.8.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bqworks Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Pro: from n/a through 4.8.6.

    bqworks Slider Pro