Skip to content
OpenAdvisories

Archive

2 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /2 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

239 results · Feed

  • Medium 4.3
    CVE-2024-37467

    WordPress Hestia theme <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in themeisle Hestia hestia allows Cross Site Request Forgery.This issue affects Hestia: from n/a through <= 3.1.2.

    themeisle Hestia
  • Medium 4.3
    CVE-2024-37458

    WordPress Highlight theme <= 1.0.29 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in extendthemes Highlight highlight allows Cross Site Request Forgery.This issue affects Highlight: from n/a through <= 1.0.29.

    Extend Themes Highlight
  • Medium 4.3
    CVE-2024-37451

    WordPress Travel Agency theme <= 1.4.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme Travel Agency travel-agency allows Cross Site Request Forgery.This issue affects Travel Agency: from n/a through <= 1.4.9.

    Rara Theme Travel Agency
  • Medium 4.3
    CVE-2024-37450

    WordPress Benevolent theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme Benevolent benevolent allows Cross Site Request Forgery.This issue affects Benevolent: from n/a through <= 1.3.4.

    Rara Theme Benevolent
  • Medium 4.3
    CVE-2024-37448

    WordPress OnePress theme <= 2.3.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in famethemes OnePress onepress allows Cross Site Request Forgery.This issue affects OnePress: from n/a through <= 2.3.6.

    famethemes OnePress
  • Medium 4.3
    CVE-2024-37441

    WordPress NewsMash theme <= 1.0.34 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in desertthemes NewsMash newsmash allows Cross Site Request Forgery.This issue affects NewsMash: from n/a through <= 1.0.34.

    desertthemes NewsMash
  • Medium 4.3
    CVE-2024-37435

    WordPress Perfect Portfolio theme <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme Perfect Portfolio perfect-portfolio allows Cross Site Request Forgery.This issue affects Perfect Portfolio: from n/a through <= 1.2.0.

    Rara Theme Perfect Portfolio
  • Medium 4.3
    CVE-2024-37431

    WordPress Mesmerize theme <= 1.6.120 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in extendthemes Mesmerize mesmerize allows Cross Site Request Forgery.This issue affects Mesmerize: from n/a through <= 1.6.120.

    Extend Themes Mesmerize
  • Medium 4.3
    CVE-2024-37426

    WordPress Elegant Pink theme 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme Elegant Pink elegant-pink allows Cross Site Request Forgery.This issue affects Elegant Pink: from n/a through <= 1.3.0.

    Rara Theme Elegant Pink
  • Medium 4.3
    CVE-2024-37421

    WordPress JobScout theme <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme JobScout jobscout allows Cross Site Request Forgery.This issue affects JobScout: from n/a through <= 1.1.4.

    Rara Theme JobScout
  • Medium 4.3
    CVE-2024-37417

    WordPress Coachify theme <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through <= 1.0.7.

    wpcoachify Coachify
  • Medium 4.3
    CVE-2024-37413

    WordPress Preschool and Kindergarten theme <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme Preschool and Kindergarten preschool-and-kindergarten allows Cross Site Request Forgery.This issue affects Preschool and Kindergarten: from n/a through <= 1.2.1.

    Rara Theme Preschool and Kindergarten
  • Medium 4.3
    CVE-2024-37412

    WordPress Blossom Shop theme <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Blossom Shop blossom-shop allows Cross Site Request Forgery.This issue affects Blossom Shop: from n/a through <= 1.1.7.

    Blossom Themes Blossom Shop
  • Medium 4.3
    CVE-2024-37274

    WordPress WP Mobile Menu plugin <= 2.8.4.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rui Guerreiro WP Mobile Menu mobile-menu allows Cross Site Request Forgery.This issue affects WP Mobile Menu: from n/a through <= 2.8.4.3.

    Rui Guerreiro WP Mobile Menu
  • Medium 4.3
    CVE-2024-37272

    WordPress Travel Monster theme <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wptravelengine Travel Monster travel-monster allows Cross Site Request Forgery.This issue affects Travel Monster: from n/a through <= 1.1.2.

    WP Travel Engine Travel Monster
  • Medium 4.3
    CVE-2024-37243

    WordPress Vandana Lite theme <= 1.1.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Vandana Lite vandana-lite allows Cross Site Request Forgery.This issue affects Vandana Lite: from n/a through <= 1.1.9.

    Blossom Themes Vandana Lite
  • Medium 4.3
    CVE-2024-37242

    WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Cross Site Request Forgery.This issue affects Newspack Newsletters: from n/a through <= 2.13.2.

    Automattic Newspack Newsletters
  • Medium 4.3
    CVE-2024-37240

    WordPress Falang multilanguage for WordPress plugin <= 1.3.51 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through <= 1.3.51.

    sbouey Falang multilanguage Web / CMS
  • Medium 4.3
    CVE-2024-37238

    WordPress WPAdverts plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Greg Winiarski WPAdverts wpadverts allows Cross Site Request Forgery.This issue affects WPAdverts: from n/a through <= 2.1.2.

    Greg Winiarski WPAdverts
  • Medium 4.3
    CVE-2024-37235

    WordPress Groundhogg plugin <= 3.4.2.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Adrian Tobey Groundhogg groundhogg allows Cross Site Request Forgery.This issue affects Groundhogg: from n/a through <= 3.4.2.3.

    Adrian Tobey Groundhogg
  • Medium 4.3
    CVE-2024-37236

    WordPress Loco Translate plugin <= 2.6.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tim W Loco Translate loco-translate allows Cross Site Request Forgery.This issue affects Loco Translate: from n/a through <= 2.6.9.

    Tim W Loco Translate
  • Medium 4.3
    CVE-2024-37104

    WordPress Chic Lite theme <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme Chic Lite chic-lite allows Cross Site Request Forgery.This issue affects Chic Lite: from n/a through <= 1.1.3.

    Rara Theme Chic Lite
  • Medium 4.3
    CVE-2024-37102

    WordPress Vilva theme <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Vilva vilva allows Cross Site Request Forgery.This issue affects Vilva: from n/a through <= 1.2.2.

    Blossom Themes Vilva
  • Medium 4.3
    CVE-2024-37103

    WordPress Education Zone theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme Education Zone education-zone allows Cross Site Request Forgery.This issue affects Education Zone: from n/a through <= 1.3.4.

    Rara Theme Education Zone
  • Medium 4.3
    CVE-2024-37093

    WordPress MasterStudy LMS plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through <= 3.2.1.

    stylemix MasterStudy LMS
  • High 7.5
    CVE-2023-47693

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a throu…

    themefic Ultimate Addons for Contact Form 7
  • Medium 4.3
    CVE-2023-47692

    WordPress Flo Forms plugin <= 1.0.41 - Broken Access Control vulnerability

    Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flo Forms: from n/a through <= 1.0.41.

    flothemesplugins Flo Forms
  • Medium 6.5
    CVE-2023-47689

    WordPress Animator plugin <= 3.0.10 - Unauthenticated Plugin Settings Change Vulnerability

    Missing Authorization vulnerability in Toast Plugins Animator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animator: from n/a through 3.0.10.

    Toast Plugins Animator
  • High 7.5
    CVE-2023-47648

    WordPress EazyDocs plugin <= 2.3.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Spider Themes EazyDocs eazydocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EazyDocs: from n/a through <= 2.3.5.

    Spider Themes EazyDocs
  • Medium 5.4
    CVE-2023-47661

    WordPress Dragfy Addons for Elementor plugin <= 1.0.2 - Broken Access Control + CSRF vulnerability

    Missing Authorization vulnerability in Dragfy Dragfy Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dragfy Addons for Elementor: from n/a through 1.0.2.

    Dragfy Dragfy Addons for Elementor
  • Medium 4.3
    CVE-2023-47647

    WordPress BadgeOS plugin <= 3.7.1.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LearningTimes BadgeOS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BadgeOS: from n/a through 3.7.1.6.

    LearningTimes BadgeOS
  • Medium 4.3
    CVE-2023-47557

    WordPress Visitor Traffic Real Time Statistics plugin <= 7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wp-buy Visitors Traffic Real Time Statistics visitors-traffic-real-time-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visitors Traffic Real Time Statistics: from n/…

    wp-buy Visitors Traffic Real Time Statistics
  • Medium 4.3
    CVE-2023-47523

    WordPress Auto Tag Creator plugin <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ecreate Infotech Auto Tag Creator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Tag Creator: from n/a through 1.0.2.

    Ecreate Infotech Auto Tag Creator
  • Medium 5.3
    CVE-2023-47515

    WordPress Seers | GDPR & CCPA Cookie Consent & Compliance plugin <= 8.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Seers Seers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seers: from n/a through 8.1.1.

    Seers Seers
  • Medium 5.3
    CVE-2023-47241

    WordPress CoCart – Headless ecommerce plugin <= 3.11.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CoCart Headless CoCart – Headless ecommerce cart-rest-api-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoCart – Headless ecommerce: from n/a through <= 3.11.2.

    CoCart Headless CoCart – Headless ecommerce
  • High 7.5
    CVE-2023-47224

    WordPress WP Travel plugin <= 7.8.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Travel: from n/a through <= 7.8.0.

    WP Travel WP Travel
  • Medium 5.4
    CVE-2023-47225

    WordPress Short URL plugin <= 1.6.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in KaizenCoders Short URL shorten-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Short URL: from n/a through <= 1.6.8.

    KaizenCoders Short URL
  • Medium 5.3
    CVE-2023-47188

    WordPress Simple Job Board plugin <= 2.10.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PressTigers Simple Job Board simple-job-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Job Board: from n/a through <= 2.10.5.

    PressTigers Simple Job Board
  • Medium 5.4
    CVE-2023-47187

    WordPress Animated Rotating Words plugin <= 5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Labib Ahmed Animated Rotating Words css3-rotating-words allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Rotating Words: from n/a through <= 5.4.

    Labib Ahmed Animated Rotating Words
  • Medium 5.3
    CVE-2023-47183

    WordPress GiveWP plugin <= 2.33.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 2.33.1.

    stellarwp GiveWP