WordPress LearnPress Plugin <= 4.2.6.5 is vulnerable to Broken Access Control

Software LearnPress Type Plugin Vulnerable versions = 4.2.6.5 Fixed in 4.2.6.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-4444 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5f824fed280f Credits 1337Wannabe Required privilege...

WordPress White Label CMS Plugin <= 2.7.3 is vulnerable to Broken Access Control

Software White Label CMS Type Plugin Vulnerable versions = 2.7.3 Fixed in 2.7.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4280 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a368614cfe17 Credits Krzysztof Zając Required...

WordPress Hotel Booking Lite Plugin <= 4.11.1 is vulnerable to PHP Object Injection

Software Hotel Booking Lite Type Plugin Vulnerable versions = 4.11.1 Fixed in 4.11.2 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-4413 Patch priority High CVSS severity High 9 Developer Claim ownership PSID f9d7cef7773f Credits Trinh Vu Sonicrrrr Required privilege...

WordPress Meow Gallery Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)

Software Meow Gallery Type Plugin Vulnerable versions = 5.1.3 Fixed in 5.1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4386 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ff273a246878 Credits Krzysztof Zając Required...

WordPress Easy Digital Downloads Plugin <= 3.2.11 is vulnerable to Sensitive Data Exposure

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.11 Fixed in 3.2.12 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-32100 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c5d829b14d8d Credits Dhabaleshwar D...

PT-2024-25871 · Unknown · Configure Login Timeout

Name of the Vulnerable Software and Affected Versions: Configure Login Timeout versions from n/a through 1.0 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: F...

WordPress Swift Performance Lite Plugin <= 2.3.6.18 is vulnerable to Broken Access Control

Software Swift Performance Lite Type Plugin Vulnerable versions = 2.3.6.18 Fixed in 2.3.6.19 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3722 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4365655c4219 Credits Lucio Sá Required...

PT-2024-6208 · Unknown +2 · Hdf5 Library +2

Name of the Vulnerable Software and Affected Versions: HDF5 Library versions prior to 1.14.4 Description: The issue is related to the function H5E printf stack in the file H5Eint.c of the HDF5 Library, which is associated with uncontrolled recursion. This can lead to stack consumption. Exploitati...

PT-2024-25890 · Unknown · Skt Addons For Elementor

Name of the Vulnerable Software and Affected Versions: SKT Addons for Elementor versions 1.8 and earlier Description: The issue affects SKT Addons for Elementor, allowing Stored XSS due to improper neutralization of input during web page generation. This is a type of Cross-site Scripting...

WordPress Church Admin Plugin <= 4.1.32 is vulnerable to Cross Site Request Forgery (CSRF)

Software Church Admin Type Plugin Vulnerable versions = 4.1.32 Fixed in 4.2.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-34828 Patch priority Low CVSS severity Low 4.3 Developer Andy Moyle PSID 2d0beb058c1b Credits Dhabaleshwar Das Required...

WordPress Porto Theme - Functionality Plugin <= 3.1.0 is vulnerable to Local File Inclusion

Software Porto Theme - Functionality Type Plugin Vulnerable versions = 3.1.0 Fixed in 3.1.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3808 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 05d6982e8315 Credits István Márton Required privileg...

CVE-2024-27281

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdocoptions used for configuration in RDoc as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be...

CVE-2024-27280

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. 3.0.3 is the main fix...

PT-2024-25343 · Vitepos · Vitepos

Name of the Vulnerable Software and Affected Versions: Vitepos versions 3.0.1 and earlier Description: A Missing Authorization issue affects the software, allowing potential unauthorized access. The estimated number of potentially affected devices worldwide is not specified. There is no informati...

WordPress Link Library Plugin <= 7.6.11 is vulnerable to Cross Site Scripting (XSS)

Software Link Library Type Plugin Vulnerable versions = 7.6.11 Fixed in 7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4281 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID abed5ec79423 Credits Krzysztof Zając Required...

Trix Editor Arbitrary Code Execution Vulnerability

The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts...

WordPress SKT Addons for Elementor Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software SKT Addons for Elementor Type Plugin Vulnerable versions = 1.8 Fixed in 1.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34445 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79dec302ec7b Credits Khalid Yusuf Required privilege...

WordPress Fancy Elementor Flipbox Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS)

Software Fancy Elementor Flipbox Type Plugin Vulnerable versions = 2.5.2 Fixed in 2.6.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34572 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6fdd1efa32f5 Credits Khalid Yusuf Required privileg...

WordPress Beaver Builder Plugin <= 2.8.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Beaver Builder Type Plugin Vulnerable versions = 2.8.1.1 Fixed in 2.8.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3923 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 38b338352313 Credits wesley wcraft Require...

WordPress Gold Addons for Elementor Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Gold Addons for Elementor Type Plugin Vulnerable versions = 1.2.9 Fixed in 1.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34563 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4ec8bc999d21 Credits Khalid Yusuf Required...