WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Order Delivery Date for WooCommerce Type Plugin Vulnerable versions = 3.20.2 Fixed in 3.21.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32434 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 18c901690cac Credi...

WordPress BA Book Everything Plugin <= 1.6.4 is vulnerable to SQL Injection

Software BA Book Everything Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-32125 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID d47407126364 Credits Thanh Nam Tran Required privilege Contributor...

WordPress InstaWP Connect Plugin <= 0.1.0.22 is vulnerable to Arbitrary File Upload

Software InstaWP Connect Type Plugin Vulnerable versions = 0.1.0.22 Fixed in 0.1.0.23 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-2667 Patch priority High CVSS severity High 10 Developer InstaWP PSID 6dfa02024fd7 Credits AtaTurk1925 Required privilege...

WordPress Remove Footer Credit Plugin <= 1.0.13 is vulnerable to Cross Site Scripting (XSS)

Software Remove Footer Credit Type Plugin Vulnerable versions = 1.0.13 Fixed in 1.0.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32429 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 27a2181f0b9d Credits savphill Required privilege...

WordPress bizcalendar-web Plugin <= 1.1.0.25 is vulnerable to Cross Site Scripting (XSS)

Software bizcalendar-web Type Plugin Vulnerable versions = 1.1.0.25 Fixed in 1.1.0.26 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1780 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 262671a35eab Credits WordFence...

WordPress Event Manager for WooCommerce Plugin <= 4.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Event Manager for WooCommerce Type Plugin Vulnerable versions = 4.1.2 Fixed in 4.1.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32110 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d7bf2c59ce4e Credits...

WordPress Novelist Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Novelist Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32093 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID a2c840335cd8 Credits Dhabaleshwar Das Required...

WordPress Bold Page Builder Plugin <= 4.8.8 is vulnerable to Cross Site Scripting (XSS)

Software Bold Page Builder Type Plugin Vulnerable versions = 4.8.8 Fixed in 4.8.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2734 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 5fea2c44055d Credits João Pedro Soares de...

WordPress Church Content – Sermons, Events and More Plugin <= 2.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Church Content – Sermons, Events and More Type Plugin Vulnerable versions = 2.6 Fixed in 2.6.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32094 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID edaae149d179...

WordPress Sheets To WP Table Live Sync Plugin <= 3.5.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Sheets To WP Table Live Sync Type Plugin Vulnerable versions = 3.5.0 Fixed in 3.5.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32110 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d93f2ef6de2e Credits...

WordPress Page Builder: Live Composer Plugin <= 1.5.35 is vulnerable to Cross Site Request Forgery (CSRF)

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.35 Fixed in 1.5.36 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31933 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID c287b96c4dbe Credits Brand...

WordPress NewsXpress Theme <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software NewsXpress Type Theme Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31938 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fbdf2aa209f9 Credits Dhabaleshwar Das Required...

PT-2024-21369 · Enpass · Enpass Password Manager Desktop Client

Name of the Vulnerable Software and Affected Versions: Enpass Password Manager Desktop Client version 6.9.2 Description: The issue allows attackers to run arbitrary HTML code via the creation of a crafted note, potentially leading to HTML injection. This can occur in the Enpass Password Manager...

WordPress Smash Balloon Social Post Feed Plugin <= 4.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Smash Balloon Social Post Feed Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-31379 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0081dd599b5c Credits Majed Refa...

PT-2024-21420 · Livemesh · Elementor Addons

Name of the Vulnerable Software and Affected Versions: Elementor Addons by Livemesh plugin for WordPress versions up to, and including, 8.3.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Post widgets due to insufficient input sanitization and output escaping o...

WordPress Currency per Product for WooCommerce Plugin <= 1.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Currency per Product for WooCommerce Type Plugin Vulnerable versions = 1.6.0 Fixed in 1.7.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31920 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9bdf124686da Credit...

WordPress CP Media Player Plugin <= 1.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software CP Media Player Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.2.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31941 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9a90502753a6 Credits Steven Julian...

WordPress Ultimate Bootstrap Elements for Elementor Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Bootstrap Elements for Elementor Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2132 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID dc6fc1769629 Credit...

WordPress Feather Login Page Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Feather Login Page Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31923 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5a2ea7b8b70e Credits Steven Julian...

PT-2024-2773 · Microsoft · Azure Identity Library For .Net

Name of the Vulnerable Software and Affected Versions: Azure Identity Library for .NET versions prior to the fixed version Description: The vulnerability in the Azure Identity Library for .NET is related to insufficient protection of registration data, which can allow an attacker to gain...