Skip to content
OpenAdvisories

Archive

7 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /7 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

214 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-12559

    ClickDesigns <= 1.8.0 - Missing Authorization to API Key Modification or Removal

    The ClickDesigns plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clickdesigns_add_api' and the 'clickdesigns_remove_api' functions in all versions up to, and including, 1.8.0. This makes it pos…

    1clickdesigns ClickDesigns Web / CMS
  • Medium 6.4
    CVE-2024-11777

    Sell Media <= 2.5.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Sell Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sell_media_search_form_gutenberg' shortcode in all versions up to, and including, 2.5.8.5 due to insufficient input sanitization and output escaping on user sup…

    endortrails Sell Media Web / CMS
  • Medium 6.1
    CVE-2024-12098

    ARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scripting

    The ARS Affiliate Page Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'utm_keyword' parameter in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible f…

    arsdeveloper ARS Affiliate Page Plugin Web / CMS
  • Medium 6.4
    CVE-2024-12592

    Sellsy <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Sellsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'testSellsy' shortcode in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

    sellsy Sellsy Web / CMS
  • Medium 5.4
    CVE-2024-12541

    Chative Live chat and Chatbot <= 1.1 - Cross-Site Request Forgery via add_chative_widget_action Function

    The Chative Live chat and Chatbot plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the add_chative_widget_action() function. This makes it possi…

    chative Chative Live chat and Chatbot Web / CMS
  • Medium 6.4
    CVE-2024-12528

    WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress <= 1.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsurveypoll_results' shortcode in all versions up to, and including, 1.7.5 due to insufficient input …

    Pantherius WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress Web / CMS
  • Medium 6.5
    CVE-2024-12419

    Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler <= 1.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting

    The The Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.7.0. This is due to the software allowing users to execute an action that doe…

    tobias_conrad WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms Web / CMS
  • Medium 6.4
    CVE-2024-11934

    Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce <= 2.1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formaloo' shortcode in all versions up to, and including, 2.1.3.2 due to insufficient input sanitization and ou…

    formaloo Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce Web / CMS
  • Medium 6.1
    CVE-2024-12557

    Transporters.io <= 2.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    The Transporters.io plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious w…

    transportersio Transporters.io Web / CMS
  • Medium 4.9
    CVE-2024-11437

    Timeline Designer <= 1.4 - Authenticated (Admin+) SQL Injection

    The Timeline Designer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.…

    Solwin Infotech Timeline Designer Web / CMS
  • Medium 6.4
    CVE-2024-12590

    WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

    The WP Youtube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta…

    india-web-developer WP Youtube Gallery Web / CMS
  • Medium 6.1
    CVE-2024-55218 Scanner template

    IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.

  • Medium 6.1
    CVE-2024-50659

    Cross Site Scripting vulnerability iPublish Media Solutions AdPortal 3.0.39 allows a remote attacker to escalate privil…

  • Medium 5.4
    CVE-2024-44450 Public exploit

    Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew. The issue was fixed in version JUN23 #190.