WordPress Easy Appointments Plugin <= 3.11.18 is vulnerable to Broken Access Control

Software Easy Appointments Type Plugin Vulnerable versions = 3.11.18 Fixed in 3.11.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-2844 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d5cb3e5ca959 Credits Krzysztof Zając Required...

PT-2024-23433 · Vsourz Digital · Vsourz Digital All In One Redirection

Name of the Vulnerable Software and Affected Versions: Vsourz Digital All In One Redirection versions 2.2.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker c...

WordPress WP ERP Plugin <= 1.12.9 is vulnerable to SQL Injection

Software WP ERP Type Plugin Vulnerable versions = 1.12.9 Fixed in 1.30.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0952 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 116fb228aac5 Credits Edwin Siebel edwinsiebel Required privilege Administrator...

WordPress OceanWP Theme <= 3.5.4 is vulnerable to Local File Inclusion

Software OceanWP Type Theme Vulnerable versions = 3.5.4 Fixed in 3.5.5 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-2476 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 32c5ee7f6e9f Credits Webbernaut Required privilege Subscriber Published 2...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.25 is vulnerable to Server Side Request Forgery (SSRF)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.25 Fixed in 3.2.26 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-24888 Patch priority Low CVSS severity Low 6.4 Developer KadenceWP PSID ca4cec35c250...

PT-2024-23381 · Unknown · Pluginops Landing Page Builder

Name of the Vulnerable Software and Affected Versions: PluginOps Landing Page Builder versions 1.5.1.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

WordPress Builderall Builder for WordPress Plugin <= 2.0.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Builderall Builder for WordPress Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-30532 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 22729fc307...

WordPress Calendarista Basic Edition Plugin <= 3.0.5 is vulnerable to Broken Access Control

Software Calendarista Basic Edition Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30534 Patch priority Medium CVSS severity Medium 6.5 Developer Typps PSID 013b5129fc7c Credits Mochamad Sofyan Requir...

WordPress Media Library Assistant Plugin <= 3.13 is vulnerable to Cross Site Scripting (XSS)

Software Media Library Assistant Type Plugin Vulnerable versions = 3.13 Fixed in 3.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2475 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 37f010ff5d22 Credits stealthcopter...

CVE-2024-29882

CVE-2024-29882 affects SRS (simple, high-efficiency real-time video server). The vulnerability lies in the /api/v1/vhosts/vid-?callback= endpoint, where the callback name was not filtered, enabling injection of malicious JavaScript and XSS. Multiple connected sources corroborate that the issue ma...

CVE-2024-29200 API returns timesheet entries a user should not be authorized to view

Kimai is a web-based multi-user time-tracking application. The permission viewothertimesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the viewothertimesheet permission to true, on the frontend, users can only see timesheet...

WordPress Pz-LinkCard Plugin < 2.5.3 is vulnerable to Server Side Request Forgery (SSRF)

Software Pz-LinkCard Type Plugin Vulnerable versions 2.5.3 Fixed in 2.5.3 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-0677 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID f4404e8dcdac Credits Dmitrii Ignatyev Required privilege...

WordPress PageLayer Plugin <= 1.8.1 is vulnerable to Broken Access Control

Software PageLayer Type Plugin Vulnerable versions = 1.8.1 Fixed in 1.8.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30465 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bc48f4fa9379 Credits Rafie Muhammad Patchstack Required...

WordPress Church Admin Plugin <= 4.1.18 is vulnerable to Broken Access Control

Software Church Admin Type Plugin Vulnerable versions = 4.1.18 Fixed in 4.1.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30505 Patch priority Medium CVSS severity Medium 5.4 Developer Andy Moyle PSID 4be0d3ba3cb9 Credits CatFather Required privilege...

WordPress Fluent CRM Plugin <= 2.8.44 is vulnerable to Cross Site Scripting (XSS)

Software Fluent CRM Type Plugin Vulnerable versions = 2.8.44 Fixed in 2.8.45 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30430 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a52c9396d7a9 Credits Ananda Dhakal Patchstack Required privile...

WordPress GamiPress Plugin <= 6.9.0 is vulnerable to Cross Site Scripting (XSS)

Software GamiPress Type Plugin Vulnerable versions = 6.9.0 Fixed in 6.9.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2783 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8fbfaab2d300 Credits Krzysztof Zając Required...

WordPress Elementor Addon Elements Plugin <= 1.13.2 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.13.2 Fixed in 1.13.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2792 Patch priority Low CVSS severity Low 6.5 Developer WPVibes PSID ba0e36a92b8e Credits wesley wcraft Require...

WordPress Molongui Plugin <= 4.7.7 is vulnerable to Insecure Direct Object References (IDOR)

Software Molongui Type Plugin Vulnerable versions = 4.7.7 Fixed in 4.7.8 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-30507 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID c7f745bc9de4 Credits CatFather Required...

WordPress Tumult Hype Animations Plugin <= 1.9.11 is vulnerable to Cross Site Scripting (XSS)

Software Tumult Hype Animations Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-30461 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 98402ce486d0 Credits Majed...

WordPress Sliced Invoices Plugin <= 3.9.2 is vulnerable to Broken Access Control

Software Sliced Invoices Type Plugin Vulnerable versions = 3.9.2 Fixed in 3.9.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30517 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f6c77e858dd8 Credits Lucio Sá Required privilege...