CVE-2023-35926

Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been vm2, but in light of several past vulnerabilities and...

WordPress Tutor LMS Plugin < 2.2.1 is vulnerable to Broken Access Control

Software Tutor LMS Type Plugin Vulnerable versions 2.2.1 Fixed in 2.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-3133 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 46e68bdc901b Credits A. S. M. Muhiminul Hasan Required...

WordPress Go Pricing Plugin <= 3.3.19 is vulnerable to Broken Access Control

Software Go Pricing Type Plugin Vulnerable versions = 3.3.19 Fixed in 3.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2494 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 71975662f90e Credits Lana Codes Required privilege...

WordPress WPForms Google Sheet Connector Plugin < 3.4.6 is vulnerable to Cross Site Scripting (XSS)

Software WPForms Google Sheet Connector Type Plugin Vulnerable versions 3.4.6 Fixed in 3.4.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2321 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID a08a279b1265 Credits Erwan LR...

WordPress Float menu Plugin < 5.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Float menu Type Plugin Vulnerable versions 5.0.3 Fixed in 5.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3225 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 59d256b130ab Credits Dipak Panchal th3.d1pak Require...

WordPress ReDi Restaurant Reservation Plugin <= 23.0211 is vulnerable to Broken Access Control

Software ReDi Restaurant Reservation Type Plugin Vulnerable versions = 23.0211 Fixed in 23.0212 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36510 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 27489b229824 Credits Abdi Pranat...

WordPress Contact Form Email Plugin < 1.3.38 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form Email Type Plugin Vulnerable versions 1.3.38 Fixed in 1.3.38 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2718 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 3c1617231fe6 Credits Andreas Damen...

WordPress Ninja Forms Google Sheet Connector Plugin < 1.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms Google Sheet Connector Type Plugin Vulnerable versions 1.2.7 Fixed in 1.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2333 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 3ac3c4160a9a Credits Erwan...

WordPress Icegram Plugin < 3.1.12 is vulnerable to Cross Site Scripting (XSS)

Software Icegram Type Plugin Vulnerable versions 3.1.12 Fixed in 3.1.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2398 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 94f0d322a79a Credits Erwan LR WPScan Required...

WordPress Custom 404 Pro Plugin < 3.8.1 is vulnerable to SQL Injection

Software Custom 404 Pro Type Plugin Vulnerable versions 3.8.1 Fixed in 3.8.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2032 Patch priority Low CVSS severity Low 7.6 Developer Kunal Nagar PSID a690a7cf2a89 Credits Alex Sanford Required privilege Administrator Published 2...

WordPress Protect WP Admin Plugin < 4.0 is vulnerable to Bypass Vulnerability

Software Protect WP Admin Type Plugin Vulnerable versions 4.0 Fixed in 4.0 OWASP Top 10 A5: Broken Access Control Classification Bypass Vulnerability CVE CVE-2023-3139 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 4511e654606c Credits Daniel Ruf Required privilege...

WordPress WP Activity Log Plugin < 4.5.2 is vulnerable to Sensitive Data Exposure

Software WP Activity Log Type Plugin Vulnerable versions 4.5.2 Fixed in 4.5.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-2261 Patch priority Medium CVSS severity Medium 4.3 Developer Melapress PSID 40c85e58b056 Credits Marco Wotschka Required...

WordPress KiviCare Plugin < 3.2.1 is vulnerable to Broken Access Control

Software KiviCare Type Plugin Vulnerable versions 3.2.1 Fixed in 3.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2627 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 5c0ff19791d9 Credits Erwan LR WPScan Required privileg...

WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)

Software Booking Calendar Contact Form Type Plugin Vulnerable versions = 1.2.40 Fixed in 1.2.41 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36384 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5ffa418dea78 Credits B...

WordPress Mailtree Log Mail Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Mailtree Log Mail Type Plugin Vulnerable versions = 1.0.0 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3135 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID e74e0d24830e Credits Alex Thomas Required...

WordPress Greeklish-permalink Plugin <= 3.3 is vulnerable to Privilege Escalation

Software Greeklish-permalink Type Plugin Vulnerable versions = 3.3 Fixed in N/A OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE CVE-2023-2495 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID fc7e9236dbd8 Credits Jonas Höbenreich Required...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.65 is vulnerable to Arbitrary File Upload

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.65 Fixed in 1.5.66 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-31231 Patch priority High CVSS severity High 9.9 Developer Unlimited Elements PSID...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (IDOR)

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-23679 Patch priority Low CVSS severity Low 4.6 Developer Claim ownership PSID...

WordPress Conditional Menus Plugin < 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Conditional Menus Type Plugin Vulnerable versions 1.2.1 Fixed in 1.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2654 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 0dced483a914 Credits Erwan LR WPScan Requir...

WordPress SupportCandy Plugin < 3.1.7 is vulnerable to SQL Injection

Software SupportCandy Type Plugin Vulnerable versions 3.1.7 Fixed in 3.1.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2719 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID c15c7e980643 Credits dc11 Required privilege Subscriber Published 19 June,...