Skip to content
OpenAdvisories

Archive

2 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /2 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

239 results · Feed

  • High 7.1
    CVE-2023-48758

    WordPress JetEngine plugin <= 3.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.2.4.

    Crocoblock JetEngine
  • Medium 5.6
    CVE-2024-13111

    Beijing Yunfan Internet Technology Yunfan Learning Examination System JWT Token SysUserControl improper authentication

    A vulnerability classified as critical was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected by this vulnerability is an unknown functionality of the file src/main/java/com/yf/exam/modules/sys/user/controller/SysUs…

    Beijing Yunfan Internet Technology Yunfan Learning Examination System
  • Medium 4.3
    CVE-2024-37237

    WordPress FS Poster plugin <= 6.5.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in fs-code FS Poster fs-poster allows Cross Site Request Forgery.This issue affects FS Poster: from n/a through <= 6.5.8.

    fs-code FS Poster
  • Medium 4.3
    CVE-2024-37241

    WordPress WP Job Manager Resume Manager plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Automattic WP Job Manager - Resume Manager allows Cross Site Request Forgery.This issue affects WP Job Manager - Resume Manager: from n/a through 2.1.0.

    Automattic WP Job Manager - Resume Manager
  • Medium 5.4
    CVE-2024-37438

    WordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Cross Site Request Forgery.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a before 4.1.4.1.

    Uncanny Owl Uncanny Toolkit Pro for LearnDash
  • Medium 4.3
    CVE-2024-13110

    Beijing Yunfan Internet Technology Yunfan Learning Examination System Exam Answer PaperController.java， information disclosure

    A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown function of the file src/main/java/com/yf/exam/modules/paper/controller/PaperController.java， of th…

    Beijing Yunfan Internet Technology Yunfan Learning Examination System
  • Medium 4.3
    CVE-2024-37452

    WordPress Schema Lite theme <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop Schema Lite allows Cross Site Request Forgery.This issue affects Schema Lite: from n/a through 1.2.2.

    mythemeshop Schema Lite
  • Medium 5.4
    CVE-2024-37925

    WordPress BuddyBoss Theme theme <= 2.4.61 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in BUDDYBOSS LLC BuddyBoss Theme allows Cross Site Request Forgery.This issue affects BuddyBoss Theme: from n/a through 2.4.61.

    BuddyBoss BuddyBoss Theme
  • Medium 4.3
    CVE-2024-37931

    WordPress Point theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Creativthemes Point allows Cross Site Request Forgery.This issue affects Point: from n/a through 1.1.

    creativthemes Point
  • Medium 4.3
    CVE-2024-38731

    WordPress i-amaze theme <= 1.3.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Marsian i-amaze allows Cross Site Request Forgery.This issue affects i-amaze: from n/a through 1.3.7.

    marsian i-amaze
  • Medium 4.3
    CVE-2024-38732

    WordPress Patricia Blog theme <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in VolThemes Patricia Blog allows Cross Site Request Forgery.This issue affects Patricia Blog: from n/a through 1.2.

    VolThemes Patricia Blog
  • Medium 4.3
    CVE-2024-38764

    WordPress i-transform theme <= 3.0.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Marsian allows Cross Site Request Forgery.This issue affects i-transform: from n/a through 3.0.9.

    marsian i-transform
  • Medium 5.3
    CVE-2024-13109

    Beijing Yunfan Internet Technology Yunfan Learning Examination System doc.html improper authorization

    A vulnerability was found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. It has been rated as critical. This issue affects some unknown processing of the file /doc.html. The manipulation leads to improper authorization. The at…

    Beijing Yunfan Internet Technology Yunfan Learning Examination System
  • Medium 4.3
    CVE-2024-38778

    WordPress WP Fast Total Search <= 1.69.234 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through <= 1.69.234.

    Epsiloncool WP Fast Total Search
  • High 8.8
    CVE-2024-39623

    WordPress ListingPro theme <= 2.9.4 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro listingpro allows Authentication Bypass.This issue affects ListingPro: from n/a through <= 2.9.4.

    Cridio Studio ListingPro
  • Medium 5.3
    CVE-2024-13108

    D-Link DIR-816 A2 form2NetSniper.cgi access control

    A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been declared as critical. This vulnerability affects unknown code of the file /goform/form2NetSniper.cgi. The manipulation leads to improper access controls. The attack can be init…

    D-Link DIR-816 A2 Network devices
  • High 7.1
    CVE-2024-56014

    WordPress Olivia Theme <= 0.9.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markyis Cool Olivia allows Reflected XSS.This issue affects Olivia: from n/a through 0.9.5.

    Markyis Cool Olivia
  • Medium 6.5
    CVE-2024-56257

    WordPress Coins MarketCap plugin <= 5.5.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolPlugins Coins MarketCap coins-marketcap allows DOM-Based XSS.This issue affects Coins MarketCap: from n/a through <= 5.5.8.

    Cool Plugins Coins MarketCap
  • Medium 6.5
    CVE-2024-56268

    WordPress Post Grid Elementor Addon plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook Post Grid Elementor Addon post-grid-elementor-addon.This issue affects Post Grid Elementor Addon: from n/a through <= 2.0.18.

    hookandhook Post Grid Elementor Addon
  • Medium 6.5
    CVE-2024-56302

    WordPress ConvertCalculator for WordPress plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jorisderuiter ConvertCalculator for WordPress convertcalculator allows Stored XSS.This issue affects ConvertCalculator for WordPress: from n/a through <= 1.1…

    jorisderuiter ConvertCalculator for WordPress Web / CMS
  • Medium 6.3
    CVE-2024-56266

    WordPress MP3 Audio Player plugin <= 5.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MP3 Audio Player for Music, Radio & Podcast by So…

    sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar
  • High 7.1
    CVE-2024-56267

    WordPress Interactive UK Map plugin <= 3.4.8 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in html5maps Interactive UK Map interactive-uk-map allows Stored XSS.This issue affects Interactive UK Map: from n/a through <= 3.4.8.

    html5maps Interactive UK Map
  • Medium 6.6
    CVE-2024-56264 Public exploit

    WordPress ACF City Selector plugin <= 1.14.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Beee ACF City Selector acf-city-selector allows Upload a Web Shell to a Web Server.This issue affects ACF City Selector: from n/a through <= 1.14.0.

    Beee ACF City Selector
  • Medium 6.5
    CVE-2024-56263

    WordPress GS Shots for Dribbble plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Shots for Dribbble gs-dribbble-portfolio allows DOM-Based XSS.This issue affects GS Shots for Dribbble: from n/a through <= 1.2.0.

    GS Plugins GS Shots for Dribbble
  • Medium 6.5
    CVE-2024-56262

    WordPress GS Coaches plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins GS Coaches gs-coach allows Stored XSS.This issue affects GS Coaches: from n/a through <= 1.1.0.

    GS Plugins GS Coaches
  • Medium 6.5
    CVE-2024-56260

    WordPress ShopElement plugin <= 2.0.0 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StorePlugin ShopElement shopelement allows Stored XSS.This issue affects ShopElement: from n/a through <= 2.0.0.

    StorePlugin ShopElement
  • Medium 6.5
    CVE-2024-56261

    WordPress Project Showcase plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GS Plugins Project Showcase gs-projects allows Stored XSS.This issue affects Project Showcase: from n/a through <= 1.1.1.

    GS Plugins Project Showcase
  • Medium 6.5
    CVE-2024-56259

    WordPress GeoDirectory plugin <= 2.3.84 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paolo GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through <= 2.3.84.

    Paolo GeoDirectory
  • Medium 6.5
    CVE-2024-56258

    WordPress Magazine Blocks plugin <= 1.3.20 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlockArt Magazine Blocks magazine-blocks allows Stored XSS.This issue affects Magazine Blocks: from n/a through <= 1.3.20.

    BlockArt Magazine Blocks
  • Medium 4.3
    CVE-2024-56255

    WordPress AyeCode Connect plugin <= 1.3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Stiofan AyeCode Connect ayecode-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AyeCode Connect: from n/a through <= 1.3.8.

    Stiofan AyeCode Connect
  • Medium 6.5
    CVE-2024-56254

    WordPress Move Addons for Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moveaddons Move Addons for Elementor move-addons allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through <= 1.3.6.

    moveaddons Move Addons for Elementor
  • Medium 6.5
    CVE-2024-56252

    WordPress Enter Addons plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themelooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through <= 2.1.9.

    themelooks Enter Addons
  • Medium 5.4
    CVE-2024-56253

    WordPress Data Tables Generator by Supsystic plugin <= 1.10.36 - Broken Access Control vulnerability

    Missing Authorization vulnerability in supsystic Data Tables Generator by Supsystic data-tables-generator-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Data Tables Generator by Supsystic: from n/a thro…

    supsystic Data Tables Generator by Supsystic
  • High 7.6
    CVE-2024-56250

    WordPress Just Writing Statistics plugin <= 4.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows SQL Injection.This issue affects Just Writing Statistics: from n/a through <= 4.7.

    Greg Ross Just Writing Statistics
  • Medium 4.3
    CVE-2024-56251

    WordPress Event Espresso plugin <= 5.0.28.decaf - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Cross Site Request Forgery.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.28.decaf.

    Event Espresso Event Espresso 4 Decaf
  • Critical 9.1
    CVE-2024-56249 Public exploit

    WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Upload a Web Shell to a Web Server.This issue affects WPMasterToolKit: from n/a through <= 1.13.1.

    Ludwig You WPMasterToolKit
  • High 7.6
    CVE-2024-56247

    WordPress WP Post Author plugin <= 3.8.2 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows SQL Injection.This issue affects WP Post Author: from n/a through <= 3.8.2.

    AF themes WP Post Author
  • Medium 4.9
    CVE-2024-56248

    WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Path Traversal.This issue affects WPMasterToolKit: from n/a through <= 1.13.1.

    Ludwig You WPMasterToolKit
  • Medium 6.5
    CVE-2024-56245

    WordPress Premium Blocks plugin <= 2.1.42 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Stored XSS.This issue affects Premium Blocks – Gutenberg Blocks fo…

    leap13 Premium Blocks – Gutenberg Blocks for WordPress Web / CMS
  • Medium 6.5
    CVE-2024-56246

    WordPress Nexter Blocks plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows DOM-Based XSS.This issue affects Nexter Blocks: from n/a through <= 4.0.4.

    POSIMYTH Nexter Blocks