WordPress Checkout Mestres WP Plugin <= 8.6 is vulnerable to Local File Inclusion

Software Checkout Mestres WP Type Plugin Vulnerable versions = 8.6 Fixed in 8.6.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44030 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 15bf1846430c Credits tahu.datar Required privilege...

WordPress Houzez Theme <= 3.2.4 is vulnerable to Privilege Escalation

Software Houzez Type Theme Vulnerable versions = 3.2.4 Fixed in 3.3.0 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2024-22303 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 51553a618b56 Credits luc Required privilege Subscriber...

WordPress Share This Image Plugin <= 2.03 is vulnerable to Open Redirection

Software Share This Image Type Plugin Vulnerable versions = 2.03 Fixed in 2.04 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2024-8761 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 2b483c93b8d5 Credits Krzysztof Zając Required privilege Unauthenticat...

WordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.2.1 is vulnerable to Broken Access Control

Software WOOCS – WooCommerce Currency Switcher Type Plugin Vulnerable versions = 1.4.2.1 Fixed in 1.4.2.2 OWASP Top 10 A3: Injection Classification Broken Access Control CVE CVE-2024-8271 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 630dad8a94ec Credits Arkadiusz...

WordPress Bricks Builder Theme <= 1.10.1 is vulnerable to Cross Site Scripting (XSS)

Software Bricks Builder Type Theme Vulnerable versions = 1.10.1 Fixed in 1.10.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3410 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID acd84adffb41 Credits Ram Required privilege...

WordPress Greenshift – animation and page builder blocks Plugin <= 9.3.7 is vulnerable to Cross Site Scripting (XSS)

Software Greenshift – animation and page builder blocks Type Plugin Vulnerable versions = 9.3.7 Fixed in 9.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44005 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6b98adee659f Credits João Pedr...

WordPress WPCargo Track & Trace Plugin <= 7.0.6 is vulnerable to SQL Injection

Software WPCargo Track & Trace Type Plugin Vulnerable versions = 7.0.6 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-44004 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 8e07b930efd1 Credits LVT-tholv2k Required privilege...

WordPress YITH Custom Login Plugin <= 1.7.3 is vulnerable to Cross Site Scripting (XSS)

Software YITH Custom Login Type Plugin Vulnerable versions = 1.7.3 Fixed in 1.7.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8665 Patch priority Medium CVSS severity Medium 7.1 Developer YITH PSID 91c2ea88e903 Credits vgo0 Required privilege...

WordPress Roles & Capabilities Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

Software Roles & Capabilities Type Plugin Vulnerable versions = 1.1.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8732 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID dc79088c77ac Credits vgo0 Required...

WordPress MStore API Plugin <= 4.15.3 is vulnerable to Arbitrary File Upload

Software MStore API Type Plugin Vulnerable versions = 4.15.3 Fixed in 4.15.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-8242 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 5f5d39cca07a Credits stealthcopter Required privilege...

WordPress Carousel Slider Plugin < 2.2.14 is vulnerable to Cross Site Scripting (XSS)

Software Carousel Slider Type Plugin Vulnerable versions 2.2.14 Fixed in 2.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6850 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7f793427535a Credits Krugov Artyom Required...

WordPress WP Simple Booking Calendar Plugin <= 2.0.10 is vulnerable to Cross Site Scripting (XSS)

Software WP Simple Booking Calendar Type Plugin Vulnerable versions = 2.0.10 Fixed in 2.0.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8663 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 00e7be38a235 Credits vgo0...

WordPress Tweaker5 Theme <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Tweaker5 Type Theme Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5870 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID dc368d54393c Credits Francesco Carlucci Required privileg...

WordPress Stream Plugin <= 4.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Stream Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7423 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID c46db6dcec76 Credits vgo0 Required privilege...

WordPress CM Pop-Up banners Plugin < 1.7.3 is vulnerable to Cross Site Scripting (XSS)

Software CM Pop-Up banners Type Plugin Vulnerable versions 1.7.3 Fixed in 1.7.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5799 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 747794d443c6 Credits Eunho Kim Required...

WordPress WordPress Tag Cloud Plugin – Tag Groups Plugin <= 2.0.3 is vulnerable to Sensitive Data Exposure

Software WordPress Tag Cloud Plugin – Tag Groups Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-43237 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d69c3848e4ee Credits Pen...

WordPress Spiffy Calendar Plugin <= 4.9.13 is vulnerable to Cross Site Scripting (XSS)

Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.13 Fixed in 4.9.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-45458 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6044522ff419 Credits LVT-tholv2k Required privilege...

WordPress WP Meta SEO Plugin <= 4.5.13 is vulnerable to Cross Site Scripting (XSS)

Software WP Meta SEO Type Plugin Vulnerable versions = 4.5.13 Fixed in 4.5.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-45455 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3b8514759b32 Credits Robert DeVore Required privilege...

WordPress WPvivid Backup and Migration Plugin < 0.9.106 is vulnerable to Sensitive Data Exposure

Software WPvivid Backup and Migration Type Plugin Vulnerable versions 0.9.106 Fixed in 0.9.106 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-7315 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID d872d427e182 Credits Dmitrii...

WordPress WooCommerce Photo Reviews - Review Reminders - Review for Discounts Plugin <= 1.3.13.2 is vulnerable to Broken Authentication

Software WooCommerce Photo Reviews - Review Reminders - Review for Discounts Type Plugin Vulnerable versions = 1.3.13.2 Fixed in 1.3.14 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-8277 Patch priority High CVSS severity High 9.8...