PT-2024-24283 · Woocommerce · Currency Per Product For Woocommerce

Name of the Vulnerable Software and Affected Versions: Currency per Product for WooCommerce versions 1.6.0 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge or consent...

WordPress WP EasyCart Plugin <= 5.6.3 is vulnerable to SQL Injection

Software WP EasyCart Type Plugin Vulnerable versions = 5.6.3 Fixed in 5.6.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3211 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 68d2c07621df Credits Krzysztof Zając Required privilege Contributor Publish...

WordPress Product Feed PRO for WooCommerce Plugin <= 13.3.1 is vulnerable to Sensitive Data Exposure

Software Product Feed PRO for WooCommerce Type Plugin Vulnerable versions = 13.3.1 Fixed in 13.3.2 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-32513 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 20d6ccb380e3 Credits...

WordPress Testimonial Slider Plugin < 2.3.8 is vulnerable to Cross Site Scripting (XSS)

Software Testimonial Slider Type Plugin Vulnerable versions 2.3.8 Fixed in 2.3.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1746 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e974538b892e Credits Dmitrii Ignatyev Requir...

PT-2024-24067 · Data443 · Data443 Inline Related Posts

Name of the Vulnerable Software and Affected Versions: Data443 Inline Related Posts versions 3.3.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2024-24561 · Unknown · Wp All Import

Name of the Vulnerable Software and Affected Versions: WP All Import Import Users from CSV versions 1.2 and earlier Description: The issue is related to Deserialization of Untrusted Data, which affects the Import Users from CSV functionality. Recommendations: For versions 1.2 and earlier, update ...

WordPress Mailster Plugin <= 4.0.6 is vulnerable to Local File Inclusion

Software Mailster Type Plugin Vulnerable versions = 4.0.6 Fixed in 4.0.7 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-32523 Patch priority Low CVSS severity Low 8.1 Developer EverPress PSID 620c4e294bfd Credits Rafie Muhammad Patchstack Required privilege...

PT-2024-24387 · Unknown · Kp4Coder Sync Post With Other Site

Name of the Vulnerable Software and Affected Versions: kp4coder Sync Post With Other Site versions n/a through 1.5.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross-Site Scripting XSS in kp4coder Sync Post With Other Site. Recommendations: For versions...

WordPress Multi Currency For WooCommerce Plugin <= 1.5.5 is vulnerable to Broken Access Control

Software Multi Currency For WooCommerce Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32516 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5c91ef8d2e42 Credits Abdi Pranata...

WordPress Advanced Post Block - Post Grid for WordPress block editor Plugin <= 1.13.4 is vulnerable to Broken Access Control

Software Advanced Post Block - Post Grid for WordPress block editor Type Plugin Vulnerable versions = 1.13.4 Fixed in 1.13.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0908 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID...

WordPress Everest Backup Plugin < 2.2.5 is vulnerable to Arbitrary File Upload

Software Everest Backup Type Plugin Vulnerable versions 2.2.5 Fixed in 2.2.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-7201 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID e4434e41add7 Credits Emad Required privilege Administrator Publish...

PT-2024-24443 · Ghozylab · Ghozylab Easy Contact Form Lite

Name of the Vulnerable Software and Affected Versions: GhozyLab Easy Contact Form Lite versions 1.1.23 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Stored XSS in the GhozyLab Eas...

Infinite loop

Overview BouncyCastle is a C implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Infinite loop in ED25519 verification in the ScalarUtil class. An attacker can send a malicious signature and public key to trigger denial of service. Remediation There is ...

WordPress Download Manager Plugin <= 3.2.82 is vulnerable to Bypass Vulnerability

Software Download Manager Type Plugin Vulnerable versions = 3.2.82 Fixed in 3.2.83 OWASP Top 10 A1: Broken Access Control Classification Bypass Vulnerability CVE CVE-2024-32131 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d970a3e505ee Credits Liu Shaohong Required...

WordPress BWL Advanced FAQ Manager Plugin <= 2.0.3 is vulnerable to SQL Injection

Software BWL Advanced FAQ Manager Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-32136 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 3156ca152b4d Credits Ivan Spiridonov Required privilege...

WordPress Podlove Podcast Publisher Plugin <= 4.0.12 is vulnerable to SQL Injection

Software Podlove Podcast Publisher Type Plugin Vulnerable versions = 4.0.12 Fixed in 4.0.14 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-32139 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID d7f41e298937 Credits Peng Zhou Required privilege...

WordPress ActiveCampaign Plugin <= 8.1.14 is vulnerable to Server Side Request Forgery (SSRF)

Software ActiveCampaign Type Plugin Vulnerable versions = 8.1.14 Fixed in 8.1.15 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-32430 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 8ad18b5a9350 Credits Yuche...

WordPress Import Users from CSV Plugin <= 1.2 is vulnerable to PHP Object Injection

Software Import Users from CSV Type Plugin Vulnerable versions = 1.2 Fixed in 1.3 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-32431 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID e3f19c84ef38 Credits Trình Vũ Sonicrrrr from VNPT-VCI Require...

WordPress Easy Contact Form Lite Plugin <= 1.1.23 is vulnerable to Cross Site Scripting (XSS)

Software Easy Contact Form Lite Type Plugin Vulnerable versions = 1.1.23 Fixed in 1.1.25 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32147 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1074c1b0d54 Credits Abdi Pranata Required privile...

WordPress AffiEasy Plugin <= 1.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software AffiEasy Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32435 Patch priority Low CVSS severity Low 4.3 Developer AffiEasy PSID 0bbb7a2d55c1 Credits Dhabaleshwar Das Required privile...