Skip to content
OpenAdvisories

Archive

13 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /13 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

297 results · Feed

  • Medium 4.3
    CVE-2023-32599

    WordPress reCAPTCHA for all plugin <= 1.22 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Bill Minozzi reCAPTCHA for all allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects reCAPTCHA for all: from n/a through 1.22.

    Bill Minozzi reCAPTCHA for all
  • Medium 4.3
    CVE-2023-32586

    WordPress SoundCloud Is Gold plugin <= 2.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Thomas Michalak Soundcloud Is Gold allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Soundcloud Is Gold: from n/a through 2.5.1.

    Thomas Michalak Soundcloud Is Gold
  • Medium 5.4
    CVE-2023-32593

    WordPress GS Pins for Pinterest plugin <= 1.6.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in GS Plugins GS Pins for Pinterest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Pins for Pinterest: from n/a through 1.6.7.

    GS Plugins GS Pins for Pinterest
  • Medium 5.4
    CVE-2023-32581

    WordPress WP-Chatbot for Messenger plugin <= 4.7 - Broken Access Control

    Missing Authorization vulnerability in MobileMonkey WP-Chatbot for Messenger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Chatbot for Messenger: from n/a through 4.7.

    MobileMonkey WP-Chatbot for Messenger
  • High 7.5
    CVE-2023-32585

    WordPress Portfolio Gallery – Responsive Image Gallery plugin <= 1.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Total-Soft Portfolio Gallery – Responsive Image Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery – Responsive Image Gallery: from n/a through 1.4.6.

    Total-Soft Portfolio Gallery – Responsive Image Gallery
  • Medium 4.3
    CVE-2023-32574

    WordPress Injection Guard plugin <= 1.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fahad Mahmood Injection Guard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Injection Guard: from n/a through 1.2.1.

    Fahad Mahmood Injection Guard
  • High 7.5
    CVE-2023-32520

    WordPress WCP Contact Form plugin <= 3.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Webcodin WCP Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCP Contact Form: from n/a through 3.1.0.

    WebCodin WCP Contact Form
  • Medium 4.3
    CVE-2023-32519

    WordPress WCP Contact Form plugin <= 3.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Webcodin WCP Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCP Contact Form: from n/a through 3.1.0.

    WebCodin WCP Contact Form
  • High 7.3
    CVE-2023-32507

    WordPress Woo Custom Emails plugin <= 2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wp3sixty Woo Custom Emails allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woo Custom Emails: from n/a through 2.2.

    wp3sixty Woo Custom Emails
  • Medium 6.5
    CVE-2023-32506

    WordPress Link Whisper Free plugin <= 0.6.3 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in Link Whisper Link Whisper Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through 0.6.3.

    Link Whisper Link Whisper Free
  • Medium 4.3
    CVE-2023-28990

    WordPress Viral Mag theme <= 1.0.9 - Authenticated Arbitrary Plugin Activation Vulnerability

    Missing Authorization vulnerability in HashThemes Viral Mag allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Viral Mag: from n/a through 1.0.9.

    HashThemes Viral Mag
  • High 7.5
    CVE-2023-30490

    WordPress Easing Slider plugin <= 3.0.8 - Plugin Settings Reset Vulnerability

    Missing Authorization vulnerability in Matthew Ruddy Easing Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easing Slider : from n/a through 3.0.8.

    Matthew Ruddy Easing Slider
  • Medium 4.3
    CVE-2023-27456

    WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation

    Missing Authorization vulnerability in HashThemes Total allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total: from n/a through 2.1.19.

    HashThemes Total
  • High 7.5
    CVE-2023-25988

    WordPress Video Gallery – YouTube Gallery plugin <= 1.7.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Video Gallery by Total-Soft Video Gallery – YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Gallery – YouTube Gallery: from n/a through 1.7.6.

    Video Gallery by Total-Soft Video Gallery – YouTube Gallery
  • Medium 5.3
    CVE-2022-47429

    WordPress Coming Soon Landing Page and Maintenance Mode WordPress Plugin plugin <= 2.2.0 - Broken Access Control

    Missing Authorization vulnerability in 8Degree Themes Coming Soon Landing Page and Maintenance Mode WordPress Plugin allows Retrieve Embedded Sensitive Data.This issue affects Coming Soon Landing Page and Maintenance Mode WordPress Plugin: from n/a through 2.…

    8Degree Themes Coming Soon Landing Page and Maintenance Mode WordPress Plugin Web / CMS
  • Medium 5.3
    CVE-2022-44578

    WordPress Owl Carousel plugin <= 0.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Pierre JEHAN Owl Carousel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Owl Carousel: from n/a through 0.5.3.

    Pierre JEHAN Owl Carousel
  • Medium 5.3
    CVE-2023-22697

    WordPress Survey Maker plugin <= 3.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Survey Maker team Survey Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Survey Maker: from n/a through 3.2.0.

    Survey Maker team Survey Maker
  • Medium 6.5
    CVE-2022-47594

    WordPress Essential Blocks for Gutenberg plugin <= 3.8.5 - Broken Access Control

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 3.8.5.

    WPDeveloper Essential Blocks for Gutenberg
  • Medium 5.3
    CVE-2022-47182

    WordPress APIExperts Square for WooCommerce plugin <= 4.4.1 - Broken Access Control

    Missing Authorization vulnerability in Wpexpertsio APIExperts Square for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.4.1.

    WPExperts.io APIExperts Square for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2022-47168

    WordPress Printful Integration for WooCommerce plugin <= 2.2.3 - Cross Site Request Forgery (CSRF)

    Missing Authorization vulnerability in printful Printful Integration for WooCommerce printful-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printful Integration for WooCommerce: from n/a th…

    printful Printful Integration for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2022-47176

    WordPress Depicter Slider plugin <= 1.9.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0.

    Depicter Slider and Popup by Averta Depicter Slider
  • Medium 5.3
    CVE-2022-46846

    WordPress Trending/Popular Post Slider and Widget plugin <= 1.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Trending/Popular Post Slider and Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trending/Popular Post Slider and Widget: from n/a thro…

    WP OnlineSupport, Essential Plugin Trending/Popular Post Slider and Widget
  • Medium 5.4
    CVE-2022-46840

    WordPress JS Help Desk plugin <= 2.7.1 - Broken Access Control

    Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.…

    JS Help Desk JS Help Desk – Best Help Desk & Support Plugin
  • Critical 9.1
    CVE-2022-46838

    WordPress JS Help Desk plugin <= 2.7.1 - Unauthenticated Settings Change Vulnerability

    Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.…

    JS Help Desk JS Help Desk – Best Help Desk & Support Plugin
  • Medium 4.3
    CVE-2022-46811

    WordPress ALD Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 1.0.21 - Broken Access Control + CSRF

    Missing Authorization vulnerability in VillaTheme(villatheme.com) ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment f…

    VillaTheme(villatheme.com) ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce Web / CMS
  • Medium 4.3
    CVE-2022-46807

    WordPress Stock Sync for WooCommerce plugin <= 2.3.2 - Broken Access Control

    Missing Authorization vulnerability in Lauri Karisola / WP Trio Stock Sync for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Sync for WooCommerce: from n/a through 2.3.2.

    Lauri Karisola / WP Trio Stock Sync for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2022-46795

    WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 4.7.2 - CSRF Plugin Settings Reset vulnerability

    Missing Authorization vulnerability in Tyche Softwares Print Invoice & Delivery Notes for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through 4…

    Tyche Softwares Print Invoice & Delivery Notes for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2022-46796

    WordPress CURCY plugin <= 2.1.25 - Unauthenticated plugin settings change vulnerability

    Missing Authorization vulnerability in VillaTheme CURCY allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.1.25.

    villatheme CURCY
  • Medium 5.4
    CVE-2022-45841

    WordPress Robo Gallery plugin <= 3.2.9 - Auth. Broken Access Control vulnerability

    Missing Authorization vulnerability in RoboSoft Robo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robo Gallery: from n/a through 3.2.9.

    Robosoft Robo Gallery
  • Medium 6.5
    CVE-2022-45840

    WordPress Auto Affiliate Links plugin <= 6.2.1.5 - Unauth. Broken Access Control vulnerability

    Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Affiliate Links: from n/a through 6.2.1.5.

    Lucian Apostol Auto Affiliate Links
  • Medium 5.4
    CVE-2022-45826

    WordPress Sunshine Photo Cart plugin <= 2.9.13 - Auth. Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13.

    WP Sunshine Sunshine Photo Cart
  • Low 3.5
    CVE-2022-45819

    WordPress Popup Maker plugin <= 1.17.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Popup Maker Popup Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Maker: from n/a through 1.17.1.

    Popup Maker Popup Maker
  • Medium 4.3
    CVE-2022-45806

    WordPress Formidable Forms plugin <= 5.5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Strategy11 Form Builder Team Formidable Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms: from n/a through 5.5.4.

    Strategy11 Form Builder Team Formidable Forms
  • Medium 4.3
    CVE-2022-43472

    WordPress eRoom plugin <= 1.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom – Zoom Meetings & Webinar: from n/a through 1.4.6.

    StylemixThemes eRoom – Zoom Meetings & Webinar
  • Medium 6.5
    CVE-2024-28980

    Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability…

    Dell RecoverPoint for Virtual Machines
  • Medium 4.4
    CVE-2024-47984

    Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability. A User with Remote access could …

    Dell RecoverPoint for Virtual Machines
  • Medium 6.6
    CVE-2024-24902

    Dell RecoverPoint for Virtual Machines 6.0.x contains an Improper access control vulnerability. A low privileged local …

    Dell RecoverPoint for Virtual Machines
  • Medium 6.5
    CVE-2024-38488

    Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authenticat…

    Dell RecoverPoint for Virtual Machines
  • Medium 5.3
    CVE-2024-48007

    Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthentic…

    Dell RecoverPoint for Virtual Machines
  • Critical 9.6
    CVE-2024-11986

    Stored XSS in CrushFTP

    Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting…

    CrushFTP CrushFTP