Skip to content
OpenAdvisories

Archive

18 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /18 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

62 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-12061

    Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure

    The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naevents_elementor_template shortcode due to insufficient restrictions on which posts can be included. This makes it …

    nicheaddons Events Addon for Elementor Web / CMS
  • Medium 5.3
    CVE-2024-12250

    Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure

    The Accept Authorize.NET Payments Using Contact Form 7 plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2 via the cf7adn-info.php file. This makes it possible for unauthenticated attackers to extract configura…

    zealopensource Accept Authorize.NET Payments Using Contact Form 7 Web / CMS
  • Medium 4.3
    CVE-2024-12596

    LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 7.8.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

    The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all versions up to, and including, 7.8.5. This makes it possibl…

    chrisbadgett LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes Web / CMS
  • Medium 6.4
    CVE-2024-12449

    Video Share VOD – Turnkey Video Site Builder Script <= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_player_html' shortcode in all versions up to, and including, 2.6.30 due to insufficient input sanitization…

    videowhisper Video Share VOD – Turnkey Video Site Builder Script Web / CMS
  • Medium 6.1
    CVE-2024-11254

    AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting

    The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the disqus_name parameter in all versions up to, and including, 1.1.1 due to insufficient input validation. This makes it possible for unauthent…

    mohammed_kaludi AMP for WP – Accelerated Mobile Pages Web / CMS
  • Medium 6.4
    CVE-2024-12513

    Contests by Rewards Fuel <= 2.0.65 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Contests by Rewards Fuel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RF_CONTEST' shortcode in all versions up to, and including, 2.0.65 due to insufficient input sanitization and output escaping on user supplied att…

    rewardsfuel Contests by Rewards Fuel Web / CMS
  • Medium 6.4
    CVE-2024-11881

    Easy Waveform Player <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easywaveformplayer' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied …

    tymotey Easy Waveform Player Web / CMS
  • Medium 6.4
    CVE-2024-12500

    Philantro – Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Philantro – Donations and Donor Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes like 'donate' in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping on …

    philantro Philantro – Donations and Donor Management Web / CMS
  • Medium 6.4
    CVE-2024-11748

    Taeggie Feed <= 0.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'taeggie-feed' shortcode in all versions up to, and including, 0.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. Th…

    taeggie Taeggie Feed Web / CMS
  • Medium 6.4
    CVE-2024-11439

    ScanCircle <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The ScanCircle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'scancircle' shortcode in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping on user supplied attributes. This m…

    aklaren ScanCircle Web / CMS
  • Medium 6.1
    CVE-2024-55492

    Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).

  • Medium 4.3
    CVE-2024-55231

    An IDOR vulnerability in the edit-notes.php module of PHPGurukul Online Notes Sharing Management System v1.0 allows una…

  • Medium 5.4
    CVE-2024-55232

    An IDOR vulnerability in the manage-notes.php module in PHPGurukul Online Notes Sharing Management System v1.0 allows u…

  • Medium 4.1
    CVE-2024-55089

    Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because…

    Rhymix Rhymix
  • Medium 5.4
    CVE-2024-55239

    A reflected Cross-Site Scripting vulnerability in the standard documentation upload functionality in Portabilis i-Educa…

  • Medium 4.6
    CVE-2024-37649

    Insecure Permissions vulnerability in SecureSTATION v.2.5.5.3116-S50-SMA-B20160811A and before allows a physically prox…

  • Medium 6.1
    CVE-2024-56175

    In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users'…

  • Medium 5.3
    CVE-2024-56170

    A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant…

    fort-validator fort-validator Debian Ubuntu
  • Medium 4.7
    CVE-2024-56173

    In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users'…

  • Medium 6.1
    CVE-2024-56115 Public exploit

    A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements. It…

  • Medium 5.3
    CVE-2024-56169

    A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are…

    fort-validator fort-validator Debian Ubuntu
  • Medium 4.3
    CVE-2024-49201

    Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensi…