Skip to content
OpenAdvisories

Archive

January 2025

Vulnerabilities first published in this month (UTC), newest first.

← December 2024 2025 / January February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

2,209 results · Clear filters · Feed

  • Medium 6.5
    CVE-2023-46609

    WordPress FeedFocal plugin <= 1.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in FeedFocal FeedFocal feedfocal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FeedFocal: from n/a through <= 1.2.2.

    FeedFocal FeedFocal
  • Medium 5.4
    CVE-2023-46607

    WordPress WP iCal Availability plugin <= 1.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP iCal Availability WP iCal Availability allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP iCal Availability: from n/a through 1.0.3.

    WP iCal Availability WP iCal Availability
  • Medium 5.3
    CVE-2023-46605

    WordPress Convertful – Your Ultimate On-Site Conversion Tool plugin <= 2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ruslan Suhar Convertful – Your Ultimate On-Site Conversion Tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Convertful – Your Ultimate On-Site Conversion Tool: from n/a thro…

    Ruslan Suhar Convertful – Your Ultimate On-Site Conversion Tool
  • Medium 5.3
    CVE-2023-46606

    WordPress AtomChat plugin <= 1.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Team AtomChat AtomChat atomchat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AtomChat: from n/a through <= 1.1.4.

    Team AtomChat AtomChat
  • Medium 5.3
    CVE-2023-46309

    WordPress wpDiscuz plugin <= 7.6.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.10.

    advancedcoding wpDiscuz
  • Medium 5.3
    CVE-2024-13107

    D-Link DIR-816 A2 ACL form2LocalAclEditcfg.cgi access control

    A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. It has been classified as critical. This affects an unknown part of the file /goform/form2LocalAclEditcfg.cgi of the component ACL Handler. The manipulation leads to improper access contro…

    D-Link DIR-816 A2 Network devices
  • Medium 5.3
    CVE-2023-46206

    WordPress MW WP Form plugin <= 4.4.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Webの相談所 MW WP Form mw-wp-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MW WP Form: from n/a through <= 4.4.5.

    Webの相談所 MW WP Form
  • Medium 4.3
    CVE-2023-46203

    WordPress Just Custom Fields plugin <= 3.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in JustCoded / Alex Prokopenko Just Custom Fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Custom Fields: from n/a through 3.3.2.

    JustCoded / Alex Prokopenko Just Custom Fields
  • Medium 4.3
    CVE-2023-46196

    WordPress Social proof testimonials and reviews by Repuso plugin <= 4.97 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social proof testimonials and revie…

    Repuso Social proof testimonials and reviews by Repuso
  • Medium 6.5
    CVE-2023-46195

    WordPress Headline Analyzer plugin <= 1.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CoSchedule Headline Analyzer headline-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headline Analyzer: from n/a through <= 1.3.1.

    CoSchedule Headline Analyzer
  • Medium 4.3
    CVE-2023-46188

    WordPress Freesoul Deactivate Plugins plugin <= 2.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Freesoul Deactivate Plugins – Plugin manager and cleanup…

    Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup
  • Medium 5.3
    CVE-2023-46083

    WordPress Kali Forms plugin <= 2.3.27 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.27.

    WP Chill Kali Forms
  • Medium 5.3
    CVE-2023-46082

    WordPress Broken Link Checker | Finder plugin <= 2.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Cyberlord92 Broken Link Checker | Finder broken-link-finder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Checker | Finder: from n/a through <= 2.4.2.

    cyberlord92 Broken Link Checker | Finder
  • Medium 4.3
    CVE-2023-46080

    WordPress ApplyOnline – Application Form Builder and Manager plugin <= 2.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Farhan Noor ApplyOnline – Application Form Builder and Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline – Application Form Builder and Manager: from n/a throu…

    Farhan Noor ApplyOnline – Application Form Builder and Manager
  • Medium 5.4
    CVE-2023-46079

    WordPress Ashe Extra plugin <= 1.2.9 - Broken Access Control + CSRF vulnerability

    Missing Authorization vulnerability in WP Royal Ashe Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe Extra: from n/a through 1.2.9.

    WP Royal Ashe Extra
  • Medium 5.3
    CVE-2023-46073

    WordPress DX Delete Attached Media plugin <= 2.0.5.1 - Broken Access Control vulnerability + CSRF

    Missing Authorization vulnerability in Mario Peshev DX Delete Attached Media dx-delete-attached-media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DX Delete Attached Media: from n/a through <= 2.0.5.1.

    Mario Peshev DX Delete Attached Media
  • Medium 5.4
    CVE-2023-45828 Public exploit

    WordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RumbleTalk Live Group Chat: from n/a through <= 6.2.5.

    RumbleTalk RumbleTalk Live Group Chat
  • Medium 5.3
    CVE-2023-45766

    WordPress Poll Maker plugin <= 4.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ays Pro Poll Maker poll-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through <= 4.7.1.

    Ays Pro Poll Maker
  • Medium 4.3
    CVE-2023-45765

    WordPress WP ERP plugin <= 1.12.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.12.6.

    wedevs WP ERP
  • Medium 5.3
    CVE-2023-45649

    WordPress Appointment Hour Booking plugin <= 1.4.23 - Broken Access Control vulnerability

    Missing Authorization vulnerability in codepeople Appointment Hour Booking appointment-hour-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Hour Booking: from n/a through <= 1.4.23.

    codepeople Appointment Hour Booking
  • Medium 4.3
    CVE-2023-45760

    WordPress wpDiscuz plugin <= 7.6.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.3.

    advancedcoding wpDiscuz
  • Medium 5.4
    CVE-2023-45636

    WordPress Backup & Migration plugin <= 1.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through <= 1.4.1.

    WebToffee WordPress Backup & Migration Web / CMS
  • Medium 4.3
    CVE-2023-45631

    WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

    wpdevart Responsive Image Gallery, Gallery Album
  • Medium 6.5
    CVE-2023-45275

    WordPress Contact Form builder with drag & drop plugin <= 2.3.28 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.28.

    WP Chill Kali Forms
  • Medium 4.3
    CVE-2023-45110

    WordPress Bold Timeline Lite plugin <= 1.1.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bold Timeline Lite: from n/a through <= 1.1.9.

    Bold Themes Bold Timeline Lite
  • Medium 4.3
    CVE-2023-45271

    WordPress ProductX – Gutenberg WooCommerce Blocks plugin <= 2.7.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPXPO WowStore product-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowStore: from n/a through <= 2.7.8.

    wpxpo WowStore
  • Medium 4.3
    CVE-2023-45101

    WordPress Customer Reviews for WooCommerce plugin <= 5.36.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce customer-reviews-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Reviews for WooCommerce: from n/a through <= 5.36.0.

    CusRev Customer Reviews for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2023-45061

    WordPress WP Job Openings plugin <= 3.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in awsm.in WP Job Openings wp-job-openings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Openings: from n/a through <= 3.4.1.

    awsmin WP Job Openings
  • Medium 5.4
    CVE-2023-45045

    WordPress WP Custom Widget area plugin <= 1.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in krozero WP Custom Widget area wp-custom-widget-area allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Widget area: from n/a through <= 1.2.5.

    krozero WP Custom Widget area
  • Medium 4.3
    CVE-2023-45002

    WordPress WP User Frontend plugin <= 3.6.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 3.6.8.

    wedevs WP User Frontend
  • Medium 4.3
    CVE-2023-44988

    WordPress WP Custom Admin Interface plugin <= 7.32 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Martin Gibson WP Custom Admin Interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through 7.32.

    Martin Gibson WP Custom Admin Interface
  • Medium 5.3
    CVE-2023-44258

    WordPress Schema App Structured Data plugin <= 1.23.1 - Broken Access Control + CSRF vulnerability

    Missing Authorization vulnerability in vberkel Schema App Structured Data schema-app-structured-data-for-schemaorg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schema App Structured Data: from n/a through <= 1.23.…

    vberkel Schema App Structured Data
  • Medium 5.3
    CVE-2024-13106 EPSS 26%

    D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control

    A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/form2IPQoSTcAdd of the component IP QoS Handler. The manipulation leads to improper acce…

    D-Link DIR-816 A2 Network devices
  • Medium 5.3
    CVE-2024-13105

    D-Link DIR-816 A2 DHCPD Setting form2Dhcpd.cgi access control

    A vulnerability has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/form2Dhcpd.cgi of the component DHCPD Setting Handler. The manipulation leads…

    D-Link DIR-816 A2 Network devices
  • Medium 5.3
    CVE-2024-13104

    D-Link DIR-816 A2 WiFi Settings form2AdvanceSetup.cgi access control

    A vulnerability, which was classified as critical, was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. Affected is an unknown function of the file /goform/form2AdvanceSetup.cgi of the component WiFi Settings Handler. The manipulation leads to improper acce…

    D-Link DIR-816 A2 Network devices
  • Medium 5.3
    CVE-2024-13103

    D-Link DIR-816 A2 Virtual Service form2AddVrtsrv.cgi access control

    A vulnerability, which was classified as critical, has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This issue affects some unknown processing of the file /goform/form2AddVrtsrv.cgi of the component Virtual Service Handler. The manipulation leads t…

    D-Link DIR-816 A2 Network devices
  • Medium 5.3
    CVE-2024-13102

    D-Link DIR-816 A2 DDNS Service access control

    A vulnerability classified as critical was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This vulnerability affects unknown code of the file /goform/DDNS of the component DDNS Service. The manipulation leads to improper access controls. The attack can be…

    D-Link DIR-816 A2 Network devices
  • Medium 6.5
    CVE-2024-56019

    WordPress Inline Footnotes Plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavinr Inline Footnotes inline-footnotes allows Stored XSS.This issue affects Inline Footnotes: from n/a through <= 2.3.0.

    gavinr Inline Footnotes
  • Medium 6.3
    CVE-2024-13093

    code-projects Job Recruitment Seeker Profile _call_main_search_ajax.php sql injection

    A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /_parse/_call_main_search_ajax.php of the component Seeker Profile Handler. The manipulation of the …

    code-projects Job Recruitment
  • Medium 6.3
    CVE-2024-13092

    code-projects Job Recruitment Job Post search_ajax.php sql injection

    A vulnerability classified as critical was found in code-projects Job Recruitment 1.0. This vulnerability affects unknown code of the file /_parse/_call_job/search_ajax.php of the component Job Post Handler. The manipulation of the argument n leads to sql inj…

    code-projects Job Recruitment