WordPress WP Matterport Shortcode Plugin <= 2.1.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Matterport Shortcode Type Plugin Vulnerable versions = 2.1.9 Fixed in 2.2.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32109 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f8f5cab9e3ca Credits Nguyen Xuan...

WordPress Church Content – Sermons, Events and More Plugin <= 2.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Church Content – Sermons, Events and More Type Plugin Vulnerable versions = 2.6 Fixed in 2.6.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32094 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID edaae149d179...

WordPress Spa and Salon Theme <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Spa and Salon Type Theme Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31384 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e57c469e3394 Credits Dhabaleshwar Das...

WordPress AppPresser Plugin <= 4.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software AppPresser Type Plugin Vulnerable versions = 4.3.0 Fixed in 4.3.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31374 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID de5dfcfcccba Credits Mika Required privilege...

WordPress Element Pack Elementor Addons Plugin <= 5.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.5.3 Fixed in 5.5.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1428 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID baacef610d60 Credits Nikolas...

WordPress Panoramic Theme <= 1.1.56 is vulnerable to Cross Site Request Forgery (CSRF)

Software Panoramic Type Theme Vulnerable versions = 1.1.56 Fixed in 1.1.57 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31386 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e5f66021e2ac Credits Dhabaleshwar Das Require...

WordPress Login with phone number Plugin <= 1.6.93 is vulnerable to Cross Site Request Forgery (CSRF)

Software Login with phone number Type Plugin Vulnerable versions = 1.6.93 Fixed in 1.6.94 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-31424 Patch priority Low CVSS severity Low 8.8 Developer Hamid Alinia PSID 32dbb4921861 Credits Majed...

WordPress Post Type Builder (PTB) Plugin < 2.1.4 is vulnerable to Content Injection

Software Post Type Builder PTB Type Plugin Vulnerable versions 2.1.4 Fixed in 2.1.4 OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2024-31366 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 60019a0448c7 Credits Dave Jong Patchstack...

WordPress Slider Revolution Plugin <= 6.6.20 is vulnerable to Cross Site Scripting (XSS)

Software Slider Revolution Type Plugin Vulnerable versions = 6.6.20 Fixed in 6.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2306 Patch priority Low CVSS severity Low 5.9 Developer ThemePunch PSID 25a221b7c033 Credits wesley wcraft Nikolas - md...

varnish: HTTP/2 Broken Window Attack may result in denial of service

A flaw was found in the Varnish cache server, with HTTP/2 support enabled, that may allow a Denial of Service type of attack. A malicious actor can cause the server to run out of credits during the HTTP/2 connection control flow. As a consequence, the server will stop to properly process the acti...

varnish: HTTP/2 Broken Window Attack may result in denial of service

A flaw was found in the Varnish cache server, with HTTP/2 support enabled, that may allow a Denial of Service type of attack. A malicious actor can cause the server to run out of credits during the HTTP/2 connection control flow. As a consequence, the server will stop to properly process the acti...

WordPress FooGallery Plugin <= 2.4.14 is vulnerable to Cross Site Scripting (XSS)

Software FooGallery Type Plugin Vulnerable versions = 2.4.14 Fixed in 2.4.15 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2471 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ca4e1f65de9f Credits Tim Coen Required privilege...

WordPress WP-Stateless Plugin <= 3.4.0 is vulnerable to Broken Access Control

Software WP-Stateless Type Plugin Vulnerable versions = 3.4.0 Fixed in 3.4.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1385 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 12374ce1567e Credits Krzysztof Zając Required...

WordPress Bannerlid Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Bannerlid Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3048 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID febfae6c0eaf Credits Bob Matyas Required...

WordPress Tracking Code Manager Plugin <= 2.1.0 is vulnerable to Broken Access Control

Software Tracking Code Manager Type Plugin Vulnerable versions = 2.1.0 Fixed in 2.2.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31347 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 51665fb13771 Credits Abdi Pranata Required...

WordPress Passster – Password Protection Plugin <= 4.2.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Passster – Password Protection Type Plugin Vulnerable versions = 4.2.6.4 Fixed in 4.2.6.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2026 Patch priority Low CVSS severity Low 6.5 Developer Patrick Posner PSID e14038938ff1 Credits...

WordPress WP Import Export Lite Plugin <= 3.9.26 is vulnerable to PHP Object Injection

Software WP Import Export Lite Type Plugin Vulnerable versions = 3.9.26 Fixed in 3.9.27 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-31308 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 6bc80ca274a7 Credits Trình Vũ Sonicrrrr from VNPT-VCI...

WordPress WP Poll Maker Plugin <= 3.1 is vulnerable to Arbitrary File Deletion

Software WP Poll Maker Type Plugin Vulnerable versions = 3.1 Fixed in 3.4 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-31240 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 371f80c25178 Credits Yudistira Arya Required privile...

WordPress ARForms Form Builder Plugin <= 1.6.1 is vulnerable to Broken Access Control

Software ARForms Form Builder Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31270 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 4ca59fc15641 Credits Yudistira Arya Require...

WordPress MasterStudy LMS Plugin <= 3.3.3 is vulnerable to Local File Inclusion

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.3 Fixed in 3.3.4 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3136 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 0e613f9f337e Credits Hiroho Shimada Required privilege...