WordPress Video Central Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Video Central Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0418 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6114cbd9fcb5 Credits Lana Codes Required...

WordPress FluentForm Plugin < 4.3.25 is vulnerable to Cross Site Scripting (XSS)

Software FluentForm Type Plugin Vulnerable versions 4.3.25 Fixed in 4.3.25 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0546 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 479c93086620 Credits Vaibhav Rajput Required...

WordPress Simple Giveaways Plugin < 2.45.1 is vulnerable to Cross Site Scripting (XSS)

Software Simple Giveaways Type Plugin Vulnerable versions 2.45.1 Fixed in 2.45.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1122 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 8adf4cd8d10f Credits Varun Required...

WordPress Simple Giveaways Plugin < 2.45.1 is vulnerable to Cross Site Scripting (XSS)

Software Simple Giveaways Type Plugin Vulnerable versions 2.45.1 Fixed in 2.45.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1120 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3822ab339f6d Credits ipatelsumit Required...

WordPress Stylish Cost Calculator Premium Plugin < 7.9.0 is vulnerable to Cross Site Scripting (XSS)

Software Stylish Cost Calculator Premium Type Plugin Vulnerable versions 7.9.0 Fixed in 7.9.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0983 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 344803b43355 Credits Flaviu...

WordPress WP Data Access Plugin <= 5.3.7 is vulnerable to Broken Access Control

Software WP Data Access Type Plugin Vulnerable versions = 5.3.7 Fixed in 5.3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-1874 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID d34193572ac0 Credits Chloe Chamberland Required...

WordPress Connections Business Directory Plugin <= 10.4.36 is vulnerable to Cross Site Scripting (XSS)

Software Connections Business Directory Type Plugin Vulnerable versions = 10.4.36 Fixed in 10.4.37 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-29437 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 584ffff6397a Credits...

WordPress Add User Role Plugin < 1.6.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Add User Role Type Plugin Vulnerable versions 1.6.7 Fixed in 1.6.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-0820 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 7eb1f185c259 Credits dc11 Required privilege...

WordPress TF Random Numbers Plugin < 2.0.1 is vulnerable to Broken Access Control

Software TF Random Numbers Type Plugin Vulnerable versions 2.0.1 Fixed in 2.0.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0889 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 611153a666ff Credits dc11 Required privilege...

WordPress WP Meta SEO Plugin < 4.5.5 is vulnerable to Deserialization of untrusted data

Software WP Meta SEO Type Plugin Vulnerable versions 4.5.5 Fixed in 4.5.5 OWASP Top 10 A1: Injection Classification Deserialization of untrusted data CVE CVE-2023-1381 Patch priority Medium CVSS severity Medium 6.6 Developer Claim ownership PSID 9880ffba76ab Credits Alex Sanford Required privileg...

WordPress HappyFiles Pro Plugin <= 1.8.1 is vulnerable to Broken Access Control

Software HappyFiles Pro Type Plugin Vulnerable versions = 1.8.1 Fixed in 1.8.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25445 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 518a5cea4b57 Credits Dave Jong Patchstack...

WordPress doctor-listing Plugin < 1.3.6 is vulnerable to Privilege Escalation

Software doctor-listing Type Plugin Vulnerable versions 1.3.6 Fixed in 1.3.6 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2020-36666 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 30151bcf23e5 Credits Omar Badran Required privilege...

WordPress Hotel Listing Plugin < 1.3.7 is vulnerable to Privilege Escalation

Software Hotel Listing Type Plugin Vulnerable versions 1.3.7 Fixed in 1.3.7 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2020-36666 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6e712961c58d Credits Omar Badran Required privilege...

WordPress Complianz Premium Plugin < 6.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Complianz Premium Type Plugin Vulnerable versions 6.4.2 Fixed in 6.4.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1069 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9c9adcf0c943 Credits Erwan LR WPScan...

WordPress real-estate-pro Plugin < 1.7.1 is vulnerable to Privilege Escalation

Software real-estate-pro Type Plugin Vulnerable versions 1.7.1 Fixed in 1.7.1 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2020-36666 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID a8f610e7b2fc Credits Omar Badran Required privilege...

WordPress photographer-directory Plugin < 1.0.9 is vulnerable to Privilege Escalation

Software photographer-directory Type Plugin Vulnerable versions 1.0.9 Fixed in 1.0.9 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2020-36666 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 44093df6ab0d Credits Omar Badran Required...

WordPress WP Dark Mode Plugin < 4.0.8 is vulnerable to Local File Inclusion

Software WP Dark Mode Type Plugin Vulnerable versions 4.0.8 Fixed in 4.0.8 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-0467 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID b9de22c09750 Credits Alex Sanford Required privilege Subscriber...

WordPress Albo Pretorio Online Plugin <= 4.6 is vulnerable to Cross Site Scripting (XSS)

Software Albo Pretorio Online Type Plugin Vulnerable versions = 4.6 Fixed in 4.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28750 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4e28c2ad9283 Credits Phd Required...

GHSA-H4CC-FXPP-PGW9 baserCMS File Uploader Remote Code Execution (RCE) vulnerability

Impact There is a Remote Code Execution RCE Vulnerability on the management system of baserCMS. Target baserCMS 4.7.3 and earlier versions Patches Update to the latest version of baserCMS Credits 島峰泰平＠三井物産セキュアディレクション株式会社...

WordPress WooCommerce Payments Plugin <= 5.6.1 is vulnerable to Privilege Escalation

Software WooCommerce Payments Type Plugin Vulnerable versions = 5.6.1 Fixed in 5.6.2 OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE CVE-2023-28121 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID af825d1466e0 Credits Michael Mazzolini...