Product Expiry for WooCommerce < 2.6 - Subscriber+ Settings Update

Description The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...

WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin <= 4.3.0 is vulnerable to Broken Access Control

Software WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Type Plugin Vulnerable versions = 4.3.0 Fixed in 4.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-7068 Patch priority Low CVSS severity Low 4.3 Developer Claim...

JVM rich text icons < 1.2.7 - Subscriber+ Arbitrary File Deletion

Description The JVM Gutenberg Rich Text Icons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the 'file' parameter. This makes it possible for authenticated attackers, with subscriber access and above, to delete arbitrary files...

WordPress Plugin WP SMS Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WP 2FA < 2.6.0 - Subscriber+ Arbitrary Email Sending

Description The plugin is vulnerable to Insecure Direct Object Reference via the sendbackupcodesemail due to missing validation on a user controlled key. This makes it possible for subscriber-level attackers to email arbitrary users on the site...

WooCommerce PDF Invoices < 4.3.1 - Subscriber+ Arbitrary Order Export

Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on theprintpackinglist action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information...

Verge3D < 4.5.3 - Subscriber+ Arbitrary File Upload

Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'v3duploadappfile' function, allowing any authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code executi...

WP SMS < 6.5.1 - Cross-Site Request Forgery to Subscriber Deletion

Description The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5. This is due to missing or incorrect nonce validation on the 'delete' action of the...

PT-2024-15154 · WordPress · Wp Sms

Name of the Vulnerable Software and Affected Versions: WP SMS – Messaging & SMS Notification for WordPress versions up to, and including, 6.5 Description: The issue is due to missing or incorrect nonce validation on the 'delete' action of the wp-sms-subscribers page, making it possible for...

CVE-2023-6485

The Html5 Video Player WordPress plugin before 2.5.19 does not sanitise and escape some of its player settings, which combined with missing capability checks around the plugin could allow any authenticated users, such as low as subscribers to perform Stored Cross-Site Scripting attacks against hi...

WordPress ProfileGrid Plugin <= 5.6.6 is vulnerable to Broken Access Control

Software ProfileGrid Type Plugin Vulnerable versions = 5.6.6 Fixed in 5.6.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52117 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c7b51f634c0f Credits emad Required privilege Subscribe...

WordPress Quotes for WooCommerce Plugin <= 2.0.1 is vulnerable to Broken Access Control

Software Quotes for WooCommerce Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51680 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ace2b6bbf64b Credits Abdi Pranata Required...

WordPress FunnelKit Checkout Plugin <= 3.10.3 is vulnerable to Settings Change

Software FunnelKit Checkout Type Plugin Vulnerable versions = 3.10.3 Fixed in 3.11.0 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51671 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f63332e6c6a9 Credits Dave Jong Patchstack Required...

WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.9 is vulnerable to Broken Access Control

Software WooCommerce Ship to Multiple Addresses Type Plugin Vulnerable versions = 3.8.9 Fixed in 3.8.10 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51497 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 29dc0846876f Credits...

WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload

Software JVM rich text icons Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.6 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-51417 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID b7c089e25bbe Credits Rafie Muhammad Patchstack Required...

WordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.1.6 is vulnerable to Cross Site Scripting (XSS)

Software WOOCS – WooCommerce Currency Switcher Type Plugin Vulnerable versions = 1.4.1.6 Fixed in 1.4.1.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6556 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 45d1f7361e75...

WordPress Essential Blocks for Gutenberg Plugin <= 4.2.0 is vulnerable to Broken Access Control

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51360 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID aa89b26b64fb Credits Rafie Muhamm...

WordPress Product Filter by WBW Plugin <= 2.5.0 is vulnerable to Broken Access Control

Software Product Filter by WBW Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.5.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50877 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID b4377cfc0c43 Credits Abdi Pranata...

WordPress ARMember Plugin <= 4.0.10 is vulnerable to Privilege Escalation

Software ARMember Type Plugin Vulnerable versions = 4.0.10 Fixed in 4.0.11 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51356 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 74e8b899602e Credits Revan Arifio...

WordPress ProjectHuddle Client Site Plugin <= 1.0.34 is vulnerable to Broken Access Control

Software ProjectHuddle Client Site Type Plugin Vulnerable versions = 1.0.34 Fixed in 1.0.35 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51376 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 662f316bbcd6 Credits Rafie...