WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software WP User Profile Avatar Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52118 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4ce43b2baade Credits Khalid Yusuf Required privilege...

WordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data Exposure

Software 404 Solution Type Plugin Vulnerable versions = 2.33.0 Fixed in 2.33.1 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2023-52146 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8e10ffdc1b34 Credits Joshua Ch...

WordPress Simple Staff List Plugin <= 2.2.4 is vulnerable to Broken Access Control

Software Simple Staff List Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51526 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d6f5e64c564c Credits Abdi Pranata Required...

WordPress Easy Video Player Plugin <= 1.2.2.10 is vulnerable to Cross Site Scripting (XSS)

Software Easy Video Player Type Plugin Vulnerable versions = 1.2.2.10 Fixed in 1.2.2.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51689 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 279437fd940f Credits Ngô Thiên An ancorn from...

WordPress Thrive Automator Plugin <= 1.17 is vulnerable to Cross Site Request Forgery (CSRF)

Software Thrive Automator Type Plugin Vulnerable versions = 1.17 Fixed in 1.17.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51531 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2f7174a74dd1 Credits Brandon Roldan...

WordPress Backup Migration Plugin 1.0.8-1.3.9 is vulnerable to Remote File Inclusion

Software Backup Migration Type Plugin Vulnerable versions 1.0.8-1.3.9 Fixed in 1.4.0 OWASP Top 10 A5: Security Misconfiguration Classification Remote File Inclusion CVE CVE-2023-6971 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID e70590c9be58 Credits NP3228 - NFlabs...

WordPress Booster Elite for WooCommerce Plugin < 7.1.3 is vulnerable to Content Injection

Software Booster Elite for WooCommerce Type Plugin Vulnerable versions 7.1.3 Fixed in 7.1.3 OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2023-51511 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1e2bd30a7dcc Credits Dave Jong...

WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload

Software JVM rich text icons Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.6 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-51417 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID b7c089e25bbe Credits Rafie Muhammad Patchstack Required...

WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software Spam protection, AntiSpam, FireWall by CleanTalk Type Plugin Vulnerable versions = 6.20 Fixed in 6.21 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51535 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Checkout Mestres WP Plugin <= 7.1.9.7 is vulnerable to Privilege Escalation

Software Checkout Mestres WP Type Plugin Vulnerable versions = 7.1.9.7 Fixed in 7.1.9.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51472 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 9fb8ab95cc18 Credits...

WordPress Checkout Mestres WP Plugin <= 7.1.9.7 is vulnerable to Settings Change

Software Checkout Mestres WP Type Plugin Vulnerable versions = 7.1.9.7 Fixed in 7.1.9.8 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2023-51471 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID cfce7b38ed64 Credits Rafie Muhammad Patchstack...

WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS)

Software RegistrationMagic Type Plugin Vulnerable versions = 5.2.4.1 Fixed in 5.2.4.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51509 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 148ecca43f4d Credits Khalid Yusuf Required...

WordPress EmbedPress Plugin <= 3.8.3 is vulnerable to Broken Access Control

Software EmbedPress Type Plugin Vulnerable versions = 3.8.3 Fixed in 3.8.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51375 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID b1e657828f4d Credits Abdi Pranata Required...

WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX Plugin <= 5.0.2 is vulnerable to Broken Access Control

Software Product Catalog Enquiry for WooCommerce by MultiVendorX Type Plugin Vulnerable versions = 5.0.2 Fixed in 5.0.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50899 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 1d8bd2186a...

WordPress Essential Blocks for Gutenberg Plugin <= 4.2.0 is vulnerable to Broken Access Control

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51360 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID aa89b26b64fb Credits Rafie Muhamm...

WordPress Photo Gallery by 10Web Plugin <= 1.8.18 is vulnerable to Cross Site Scripting (XSS)

Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.18 Fixed in 1.8.19 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6924 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0bcf8b758508 Credits István Márton...

WordPress MF Gig Calendar Plugin <= 1.2.1 is vulnerable to SQL Injection

Software MF Gig Calendar Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-50842 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 54f1b98a01c0 Credits Khalid Yusuf Required privilege Contributor...

WordPress WP Crowdfunding Plugin < 2.1.8 is vulnerable to Cross Site Scripting (XSS)

Software WP Crowdfunding Type Plugin Vulnerable versions 2.1.8 Fixed in 2.1.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5757 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 341ae7773e99 Credits David Suho Lee Required...

WordPress Spice Post Slider Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Spice Post Slider Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5362 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 963f12e8b291 Credits István Márton Required...

WordPress Welcart e-Commerce Plugin <= 2.9.6 is vulnerable to Path Traversal

Software Welcart e-Commerce Type Plugin Vulnerable versions = 2.9.6 Fixed in 2.9.7 OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2023-6120 Patch priority Medium CVSS severity Medium 4.1 Developer Claim ownership PSID 545792f26683 Credits Marco Wotschka Required...