Skip to content
OpenAdvisories

Archive

13 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /13 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

297 results · Feed

  • Medium 5.4
    CVE-2023-38383

    WordPress Language plugin <= 1.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in OnTheGoSystems Language allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Language: from n/a through 1.2.1.

    OnTheGoSystems Language
  • Medium 5.4
    CVE-2023-37989

    WordPress Easyship WooCommerce Shipping Rates plugin <= 0.9.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Easyship Easyship WooCommerce Shipping Rates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easyship WooCommerce Shipping Rates: from n/a through 0.9.0.

    Easyship Easyship WooCommerce Shipping Rates Web / CMS
  • Medium 6.5
    CVE-2023-37987

    WordPress YourMembership Single Sign On plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YourMembership Single Sign On: from n/a through 1.1.3.

    miniOrange YourMembership Single Sign On
  • Medium 6.5
    CVE-2023-37971

    WordPress WooCommerce Product Stock Alert plugin <= 2.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Stock Alert: from n/a through 2.0.1.

    MultiVendorX WooCommerce Product Stock Alert Web / CMS
  • Medium 4.3
    CVE-2023-37984

    WordPress Quiz And Survey Master plugin <= 8.1.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ExpressTech Quiz And Survey Master allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 8.1.10.

    ExpressTech Systems Quiz And Survey Master
  • Medium 5.3
    CVE-2023-37969

    WordPress Checkout with Zelle on Woocommerce plugin <= 3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in The African Boss Checkout with Zelle on Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Checkout with Zelle on Woocommerce: from n/a through 3.1.

    The African Boss Checkout with Zelle on Woocommerce Web / CMS
  • Medium 6.5
    CVE-2023-37967

    WordPress DirectoryPress plugin <= 3.6.2 - Unauthenticated Broken Access Control Vulnerability

    Missing Authorization vulnerability in Designinvento DirectoryPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through 3.6.2.

    Designinvento DirectoryPress
  • Medium 6.5
    CVE-2023-37887

    WordPress WPSchoolPress plugin <= 2.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPSchoolPress Team WPSchoolPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through 2.2.7.

    WPSchoolPress Team WPSchoolPress
  • Medium 5.3
    CVE-2023-36681

    WordPress Cryptocurrency Widgets – Price Ticker & Coins List plugin <= 2.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cryptocurrency Widgets – Price Ticker & Coins List: from n/a thro…

    Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List
  • Medium 5.4
    CVE-2023-36680

    WordPress Image Regenerate & Select Crop plugin <= 7.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Iulia Cazan Image Regenerate & Select Crop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Regenerate & Select Crop: from n/a through 7.1.0.

    Iulia Cazan Image Regenerate & Select Crop
  • Medium 4.3
    CVE-2023-36531 Public exploit

    WordPress LiquidPoll plugin <= 3.3.68 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a thro…

    liquidpoll LiquidPoll – Advanced Polls for Creators and Brands
  • Medium 5.3
    CVE-2023-36528

    WordPress kk Star Ratings plugin <= 5.4.3 - Rate Manipulation due to IP Spoofing Vulnerability

    Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.3.

    FeedbackWP kk Star Ratings
  • Medium 5.4
    CVE-2023-36526

    WordPress Duplicate Post Page Menu & Custom Post Type plugin <= 2.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Inqsys Technology Duplicate Post Page Menu & Custom Post Type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Duplicate Post Page Menu & Custom Post Type: from n/a through 2.4.1.

    Inqsys Technology Duplicate Post Page Menu & Custom Post Type
  • Medium 5.4
    CVE-2023-36519

    WordPress SW Product Bundles plugin <= 2.0.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpthemego SW Product Bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SW Product Bundles: from n/a through 2.0.15.

    wpthemego SW Product Bundles
  • Medium 4.3
    CVE-2023-36518

    WordPress Post Hit Counter plugin <= 1.3.2 - Broken Access Control

    Missing Authorization vulnerability in Hugh Lashbrooke Post Hit Counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Hit Counter: from n/a through 1.3.2.

    Hugh Lashbrooke Post Hit Counter
  • High 7.3
    CVE-2023-36510

    WordPress ReDi Restaurant Reservation plugin <= 23.0211 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Reservation Diary ReDi Restaurant Reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReDi Restaurant Reservation: from n/a through 23.0211.

    Reservation Diary ReDi Restaurant Reservation
  • Medium 5.4
    CVE-2023-36509

    WordPress CHP Ads Block Detector plugin <= 3.9.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Suresh Chand CHP Ads Block Detector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CHP Ads Block Detector: from n/a through 3.9.5.

    Suresh Chand CHP Ads Block Detector
  • Medium 5.3
    CVE-2023-36506

    WordPress YITH WooCommerce Waitlist plugin <= 2.13.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITH YITH WooCommerce Waiting List allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Waiting List: from n/a through 2.13.0.

    Yith YITH WooCommerce Waiting List Web / CMS
  • Medium 5.3
    CVE-2023-35875

    WordPress Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.8.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jegstudio Gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse: from n/a through 1.8.5.

    Jegstudio Gutenverse
  • Medium 5.3
    CVE-2023-35777

    WordPress The Events Calendar plugin <= 6.1.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.1.2.2.

    The Events Calendar The Events Calendar
  • Medium 5.4
    CVE-2023-35051

    WordPress Contact Forms by Cimatti plugin <= 1.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Forms by Cimatti: from n/a through 1.5.7.

    Cimatti Consulting Contact Forms by Cimatti
  • Medium 4.3
    CVE-2023-35052

    WordPress Directorist plugin <= 7.5.4 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in wpWax - WP Business Directory Plugin and Classified Listings Directory Directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through 7.5.4.

    wpWax - WP Business Directory Plugin and Classified Listings Directory Directorist
  • Medium 5.4
    CVE-2023-35046

    WordPress Dynamic Visibility for Elementor plugin <= 5.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Dynamic.ooo Dynamic Visibility for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamic Visibility for Elementor: from n/a through 5.0.5.

    Dynamic.ooo Dynamic Visibility for Elementor
  • High 7.6
    CVE-2023-35037

    WordPress Surfer plugin <= 1.3.2.357 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.3.2.357.

    Surfer Surfer
  • Medium 4.3
    CVE-2023-34387

    WordPress Constant Contact Forms plugin <= 2.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Constant Contact Constant Contact Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact Forms: from n/a through 2.0.3.

    Constant Contact Constant Contact Forms
  • Medium 5.3
    CVE-2023-34381

    WordPress Zippy plugin <= 1.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Gesundheit Bewegt GmbH Zippy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zippy: from n/a through 1.6.2.

    Gesundheit Bewegt Zippy
  • Medium 6.5
    CVE-2023-34019

    WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.

    Uncanny Owl Uncanny Toolkit for LearnDash
  • Medium 5.4
    CVE-2023-34376

    WordPress Change WooCommerce Add To Cart Button Text plugin <= 1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rextheme Change WooCommerce Add To Cart Button Text allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Change WooCommerce Add To Cart Button Text: from n/a through 1.3.

    RexTheme Change WooCommerce Add To Cart Button Text Web / CMS
  • Medium 5.4
    CVE-2023-34014

    WordPress Grid Plus plugin <= 1.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in G5Theme Grid Plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grid Plus: from n/a through 1.3.2.

    G5Theme Grid Plus
  • Medium 4.3
    CVE-2023-34009

    WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.1 - Broken Access Control + CSRF

    Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Media & Share Icons: from n/a through 2.8.1.

    Inisev Social Media & Share Icons
  • Medium 4.3
    CVE-2023-33998

    WordPress Easy Social Icons plugin <= 3.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in cybernetikz Easy Social Icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Icons: from n/a through 3.2.5.

    cybernetikz Easy Social Icons
  • High 8.8
    CVE-2023-33996

    WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in СleanTalk - Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spam protection, AntiSpam, FireWall by CleanTal…

    СleanTalk - Anti-Spam Protection Spam protection, AntiSpam, FireWall by CleanTalk
  • Medium 4.3
    CVE-2023-33995

    WordPress Photo Gallery by 10Web plugin <= 1.8.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Gallery by 10Web: from n/a through 1.8.15.

    Photo Gallery Team Photo Gallery by 10Web
  • Medium 6.5
    CVE-2023-33994

    WordPress Slimstat Analytics plugin <= 5.0.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in VeronaLabs Slimstat Analytics wp-slimstat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slimstat Analytics: from n/a through <= 5.0.5.1.

    VeronaLabs Slimstat Analytics
  • Medium 4.3
    CVE-2023-33928

    WordPress WordPress Backup & Migration plugin <= 1.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebToffee WordPress Backup & Migration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through 1.4.0.

    WebToffee WordPress Backup & Migration Web / CMS
  • Medium 6.5
    CVE-2023-33324

    WordPress Easy Captcha plugin <= 1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wppal Easy Captcha allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Captcha: from n/a through 1.0.

    wppal Easy Captcha
  • Medium 5.4
    CVE-2023-33215

    WordPress Taggbox plugin <= 3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Taggbox Taggbox taggbox-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taggbox: from n/a through <= 3.3.

    Taggbox Taggbox
  • Medium 5.3
    CVE-2023-32963

    WordPress Predictive Search for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in a3rev Software WooCommerce Predictive Search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Predictive Search: from n/a through 5.8.0.

    a3rev Software WooCommerce Predictive Search Web / CMS
  • Medium 5.3
    CVE-2023-32798

    WordPress Simple Page Ordering plugin <= 2.5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in 10up Simple Page Ordering allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Page Ordering: from n/a through 2.5.0.

    10up Simple Page Ordering
  • Medium 5.4
    CVE-2023-32601

    WordPress Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Booking Ultra Pro Booking Ultra Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Ultra Pro: from n/a through 1.1.12.

    Booking Ultra Pro Booking Ultra Pro