WordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability

Insecure Direct Object References IDOR Vulnerability discovered by ch4r0n in WordPress Plugin Maya Business versions = 1.2.0...

WordPress Ultimate WP Mail plugin 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function vulnerability

WordPress Ultimate WP Mail plugin 1.0.17 - 1.3.6 - Missing Authorization to Authenticated Contributor+ Privilege Escalation via getemaillogdetails Function vulnerability discovered by kr0d in WordPress Plugin Ultimate WP Mail versions 1.0.17 - 1.3.6...

WordPress WP Event Manager plugin <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name' vulnerability

Unauthenticated Stored Cross-Site Scripting via 'organizername' vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin WP Event Manager versions = 3.1.50...

WordPress ProfileGrid plugin <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function vulnerability

Reflected Cross-Site Scripting via 'pmgetmessengernotification' function vulnerability discovered by Kenneth Billones Kenziy in WordPress Plugin ProfileGrid versions = 5.9.5.4...

Medium Strength Cipher Suites detected on port on ports 9000 and 8036

Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on ports 9000 and 8036. Those ports are internal ports...

WordPress Friends plugin <= 3.5.1 - Authenticated (Admin+) PHP Object Injection vulnerability

Authenticated Admin+ PHP Object Injection vulnerability discovered by Pham Nguyen Khoa in WordPress Plugin Friends versions = 3.5.1...

WordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin Product XML Feed Manager for WooCommerce versions = 2.9.2...

WordPress Contest Gallery <= 26.0.6 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by domiee13 in WordPress Plugin Contest Gallery versions = 26.0.6...

WordPress Broken Link Notifier plugin <= 1.3.0 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Broken Link Notifier versions = 1.3.0...

WordPress Hostel plugin < 1.1.5.8 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Tommaso Gregori p1s1o in WordPress Plugin Hostel versions 1.1.5.8...

WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin Wishlist for WooCommerce versions = 3.2.3...

WordPress WP Lightbox 2 plugin < 3.0.6.8 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin WP Lightbox 2 versions 3.0.6.8...

WordPress WP File Download plugin < 6.2.6 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Kevin Camus in WordPress Plugin WP File Download versions 6.2.6...

WordPress Gwolle Guestbook plugin <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via gwollegbcontent Parameter vulnerability discovered by zer0gh0st in WordPress Plugin Gwolle Guestbook versions = 4.9.2...

WordPress wpForo Forum plugin <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via Profile Avatar vulnerability discovered by Muhan Luo in WordPress Plugin wpForo Forum versions = 2.4.5...

July Security Advisory Ivanti Connect Secure and Ivanti Policy Secure (Multiple CVEs)

Ivanti has released updates for Ivanti Connect Secure ICS and Ivanti Policy Secure IPS, which address medium severity vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability Details: CVE Number | Description | CVSS Score...

WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by astra.r3verii Patchstack Alliance in WordPress Plugin Internal Linking of Related Contents versions = 1.1.8...

WordPress AI Engine plugin <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via mwaichatbot Shortcode id Parameter vulnerability discovered by mikemyers in WordPress Plugin AI Engine versions = 2.8.4...

WordPress WP Human Resource Management plugin 2.0.0-2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation vulnerability

Missing Authorization to Authenticated Employee+ Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin WP Human Resource Management versions 2.0.0-2.2.17...

WordPress Contact Form 7 Database Addon plugin <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting via tmpD Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via tmpD Parameter vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Contact Form 7 Database Addon – CFDB7 versions = 1.3.1...