Skip to content
OpenAdvisories

Archive

January 2025

Vulnerabilities first published in this month (UTC), newest first.

← December 2024 2025 / January February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

2,209 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-37417

    WordPress Coachify theme <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wpcoachify Coachify coachify allows Cross Site Request Forgery.This issue affects Coachify: from n/a through <= 1.0.7.

    wpcoachify Coachify
  • Medium 4.3
    CVE-2024-37413

    WordPress Preschool and Kindergarten theme <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme Preschool and Kindergarten preschool-and-kindergarten allows Cross Site Request Forgery.This issue affects Preschool and Kindergarten: from n/a through <= 1.2.1.

    Rara Theme Preschool and Kindergarten
  • Medium 4.3
    CVE-2024-37412

    WordPress Blossom Shop theme <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Blossom Shop blossom-shop allows Cross Site Request Forgery.This issue affects Blossom Shop: from n/a through <= 1.1.7.

    Blossom Themes Blossom Shop
  • Medium 4.3
    CVE-2024-37274

    WordPress WP Mobile Menu plugin <= 2.8.4.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rui Guerreiro WP Mobile Menu mobile-menu allows Cross Site Request Forgery.This issue affects WP Mobile Menu: from n/a through <= 2.8.4.3.

    Rui Guerreiro WP Mobile Menu
  • Medium 4.3
    CVE-2024-37272

    WordPress Travel Monster theme <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wptravelengine Travel Monster travel-monster allows Cross Site Request Forgery.This issue affects Travel Monster: from n/a through <= 1.1.2.

    WP Travel Engine Travel Monster
  • Medium 4.3
    CVE-2024-37243

    WordPress Vandana Lite theme <= 1.1.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Vandana Lite vandana-lite allows Cross Site Request Forgery.This issue affects Vandana Lite: from n/a through <= 1.1.9.

    Blossom Themes Vandana Lite
  • Medium 4.3
    CVE-2024-37242

    WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Cross Site Request Forgery.This issue affects Newspack Newsletters: from n/a through <= 2.13.2.

    Automattic Newspack Newsletters
  • Medium 4.3
    CVE-2024-37240

    WordPress Falang multilanguage for WordPress plugin <= 1.3.51 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in sbouey Falang multilanguage falang allows Cross Site Request Forgery.This issue affects Falang multilanguage: from n/a through <= 1.3.51.

    sbouey Falang multilanguage Web / CMS
  • Medium 4.3
    CVE-2024-37238

    WordPress WPAdverts plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Greg Winiarski WPAdverts wpadverts allows Cross Site Request Forgery.This issue affects WPAdverts: from n/a through <= 2.1.2.

    Greg Winiarski WPAdverts
  • Medium 4.3
    CVE-2024-37235

    WordPress Groundhogg plugin <= 3.4.2.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Adrian Tobey Groundhogg groundhogg allows Cross Site Request Forgery.This issue affects Groundhogg: from n/a through <= 3.4.2.3.

    Adrian Tobey Groundhogg
  • Medium 4.3
    CVE-2024-37236

    WordPress Loco Translate plugin <= 2.6.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tim W Loco Translate loco-translate allows Cross Site Request Forgery.This issue affects Loco Translate: from n/a through <= 2.6.9.

    Tim W Loco Translate
  • Medium 4.3
    CVE-2024-37104

    WordPress Chic Lite theme <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme Chic Lite chic-lite allows Cross Site Request Forgery.This issue affects Chic Lite: from n/a through <= 1.1.3.

    Rara Theme Chic Lite
  • Medium 4.3
    CVE-2024-37102

    WordPress Vilva theme <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in blossomthemes Vilva vilva allows Cross Site Request Forgery.This issue affects Vilva: from n/a through <= 1.2.2.

    Blossom Themes Vilva
  • Medium 4.3
    CVE-2024-37103

    WordPress Education Zone theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in raratheme Education Zone education-zone allows Cross Site Request Forgery.This issue affects Education Zone: from n/a through <= 1.3.4.

    Rara Theme Education Zone
  • Medium 4.3
    CVE-2024-37093

    WordPress MasterStudy LMS plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through <= 3.2.1.

    stylemix MasterStudy LMS
  • Medium 4.3
    CVE-2023-47692

    WordPress Flo Forms plugin <= 1.0.41 - Broken Access Control vulnerability

    Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flo Forms: from n/a through <= 1.0.41.

    flothemesplugins Flo Forms
  • Medium 6.5
    CVE-2023-47689

    WordPress Animator plugin <= 3.0.10 - Unauthenticated Plugin Settings Change Vulnerability

    Missing Authorization vulnerability in Toast Plugins Animator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animator: from n/a through 3.0.10.

    Toast Plugins Animator
  • Medium 5.4
    CVE-2023-47661

    WordPress Dragfy Addons for Elementor plugin <= 1.0.2 - Broken Access Control + CSRF vulnerability

    Missing Authorization vulnerability in Dragfy Dragfy Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dragfy Addons for Elementor: from n/a through 1.0.2.

    Dragfy Dragfy Addons for Elementor
  • Medium 4.3
    CVE-2023-47647

    WordPress BadgeOS plugin <= 3.7.1.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LearningTimes BadgeOS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BadgeOS: from n/a through 3.7.1.6.

    LearningTimes BadgeOS
  • Medium 4.3
    CVE-2023-47557

    WordPress Visitor Traffic Real Time Statistics plugin <= 7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wp-buy Visitors Traffic Real Time Statistics visitors-traffic-real-time-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visitors Traffic Real Time Statistics: from n/…

    wp-buy Visitors Traffic Real Time Statistics
  • Medium 4.3
    CVE-2023-47523

    WordPress Auto Tag Creator plugin <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ecreate Infotech Auto Tag Creator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Tag Creator: from n/a through 1.0.2.

    Ecreate Infotech Auto Tag Creator
  • Medium 5.3
    CVE-2023-47515

    WordPress Seers | GDPR & CCPA Cookie Consent & Compliance plugin <= 8.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Seers Seers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seers: from n/a through 8.1.1.

    Seers Seers
  • Medium 5.3
    CVE-2023-47241

    WordPress CoCart – Headless ecommerce plugin <= 3.11.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CoCart Headless CoCart – Headless ecommerce cart-rest-api-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoCart – Headless ecommerce: from n/a through <= 3.11.2.

    CoCart Headless CoCart – Headless ecommerce
  • Medium 5.4
    CVE-2023-47225

    WordPress Short URL plugin <= 1.6.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in KaizenCoders Short URL shorten-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Short URL: from n/a through <= 1.6.8.

    KaizenCoders Short URL
  • Medium 5.3
    CVE-2023-47188

    WordPress Simple Job Board plugin <= 2.10.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PressTigers Simple Job Board simple-job-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Job Board: from n/a through <= 2.10.5.

    PressTigers Simple Job Board
  • Medium 5.4
    CVE-2023-47187

    WordPress Animated Rotating Words plugin <= 5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Labib Ahmed Animated Rotating Words css3-rotating-words allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animated Rotating Words: from n/a through <= 5.4.

    Labib Ahmed Animated Rotating Words
  • Medium 5.3
    CVE-2023-47183

    WordPress GiveWP plugin <= 2.33.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 2.33.1.

    stellarwp GiveWP
  • Medium 6.5
    CVE-2023-47180

    WordPress Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin <= 2.16.0 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in XLPlugins Finale Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Finale Lite: from n/a through 2.16.0.

    XLPlugins Finale Lite
  • Medium 6.5
    CVE-2023-46644

    WordPress WordPress CTA plugin <= 1.5.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP CTA PRO WordPress CTA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through 1.5.8.

    WP CTA PRO WordPress CTA Web / CMS
  • Medium 5.3
    CVE-2023-46639

    WordPress kk Star Ratings plugin <= 5.4.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.5.

    FeedbackWP kk Star Ratings
  • Medium 5.3
    CVE-2023-46637

    WordPress Generate Dummy Posts plugin <= 1.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Saurav Sharma Generate Dummy Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Generate Dummy Posts: from n/a through 1.0.0.

    Saurav Sharma Generate Dummy Posts
  • Medium 5.3
    CVE-2023-46635

    WordPress YITH WooCommerce Product Add-Ons plugin <= 4.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= …

    YITHEMES YITH WooCommerce Product Add-Ons Web / CMS
  • Medium 5.4
    CVE-2023-46633

    WordPress WP Glossary plugin <= 3.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in TCBarrett Glossary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Glossary: from n/a through 3.1.2.

    TCBarrett Glossary
  • Medium 4.3
    CVE-2023-46628

    WordPress WP Word Count plugin <= 3.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RedLettuce Plugins WP Word Count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Word Count: from n/a through 3.2.4.

    RedLettuce Plugins WP Word Count
  • Medium 6.5
    CVE-2023-46631

    WordPress Product Recommendation Quiz for eCommerce plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RevenueHunt Product Recommendation Quiz for eCommerce product-recommendation-quiz-for-ecommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Recommendation Quiz for e…

    RevenueHunt Product Recommendation Quiz for eCommerce
  • Medium 5.4
    CVE-2023-46616

    WordPress Draw Attention plugin <= 2.0.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NSquared Draw Attention allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Draw Attention: from n/a through 2.0.15.

    N Squared Draw Attention
  • Medium 4.3
    CVE-2023-46612

    WordPress Mediabay plugin <= 1.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in codedraft Mediabay mediabay-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mediabay: from n/a through <= 1.6.

    codedraft Mediabay
  • Medium 5.3
    CVE-2023-46611

    WordPress YOP Poll plugin <= 6.5.28 - Vote Manipulation Due to Broken Captcha Control Vulnerability

    Authentication Bypass by Primary Weakness vulnerability in yourownprogrammer YOP Poll allows Authentication Bypass.This issue affects YOP Poll: from n/a through 6.5.28.

    yourownprogrammer YOP Poll
  • Medium 6.5
    CVE-2023-46610

    WordPress Quill Forms plugin <= 3.3.0 - Broken Access Control + CSRF vulnerability

    Missing Authorization vulnerability in Mohamed Magdy Quill Forms quillforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quill Forms: from n/a through <= 3.3.0.

    Mohamed Magdy Quill Forms
  • Medium 5.3
    CVE-2023-46608

    WordPress DoLogin Security plugin <= 3.7.1 - Multiple Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDO DoLogin Security dologin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DoLogin Security: from n/a through <= 3.7.1.

    WPDO DoLogin Security