WordPress WP Githuber MD Plugin <= 1.16.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Githuber MD Type Plugin Vulnerable versions = 1.16.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52422 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 80930d0544eb Credits Fazle Mawla Required privilege Contribut...

WordPress CF7 Reply Manager Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload

Software CF7 Reply Manager Type Plugin Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52404 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID ea9af17f6366 Credits stealthcopter Required privilege...

WordPress AJAX Random Posts Plugin <= 0.3.3 is vulnerable to PHP Object Injection

Software AJAX Random Posts Type Plugin Vulnerable versions = 0.3.3 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52409 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 88448bab09ca Credits Bonds Required privilege Unauthenticated...

WordPress WDES Responsive Mobile Menu Plugin <= 5.3.18 is vulnerable to PHP Object Injection

Software WDES Responsive Mobile Menu Type Plugin Vulnerable versions = 5.3.18 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52414 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 3807cf50f771 Credits Mika Required privilege...

WordPress Advanced Personalization Plugin <= 1.1.2 is vulnerable to PHP Object Injection

Software Advanced Personalization Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52411 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 2cda7f7032dc Credits Bonds Required privilege...

WordPress Kognetiks Chatbot for WordPress Plugin <= 2.1.7 is vulnerable to Broken Access Control

Software Kognetiks Chatbot for WordPress Type Plugin Vulnerable versions = 2.1.7 Fixed in 2.1.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10530 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 918318d433d6 Credits Tieu Pham Tro...

WordPress Hacklog DownloadManager Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Hacklog DownloadManager Type Plugin Vulnerable versions = 2.1.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-52401 Patch priority Low CVSS severity Low 9.6 Developer Claim ownership PSID ba0d306fec3c Credits Joshua Chan...

WordPress Debug Tool Plugin <= 2.2 is vulnerable to Remote Code Execution (RCE)

Software Debug Tool Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-52416 Patch priority Medium CVSS severity Medium 10 Developer Claim ownership PSID d30460ac8a3a Credits Mika Required privilege Unauthenticated...

WordPress Writer Helper Plugin <= 3.1.6 is vulnerable to Arbitrary File Upload

Software Writer Helper Type Plugin Vulnerable versions = 3.1.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52399 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID fb7a09ece40a Credits Mika Required privilege Subscriber Publishe...

WordPress Referrer Detector Plugin <= 4.2.1.0 is vulnerable to PHP Object Injection

Software Referrer Detector Type Plugin Vulnerable versions = 4.2.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-52410 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 462ef6116947 Credits Bonds Required privilege Unauthenticat...

WordPress BasePress Migration Tools Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload

Software BasePress Migration Tools Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52407 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID fc45329ebd4c Credits stealthcopter Required privileg...

WordPress Copy Anything to Clipboard Plugin <= 4.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Copy Anything to Clipboard Type Plugin Vulnerable versions = 4.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52419 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 84f47f9b6dd8 Credits LVT-tholv2k Required privileg...

WordPress CSV to html Plugin <= 3.06 is vulnerable to Arbitrary File Upload

Software CSV to html Type Plugin Vulnerable versions = 3.06 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52406 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID f31bd5d837b7 Credits stealthcopter Required privilege Subscriber...

WordPress MultiManager WP Plugin <= 1.0.5 is vulnerable to Broken Authentication

Software MultiManager WP Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.1.0 OWASP Top 10 A4: Insecure Design Classification Broken Authentication CVE CVE-2024-11028 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 80e81dabfc85 Credits shaman0x01 Required privilege...

WordPress WP Project Manager Plugin <= 2.6.13 is vulnerable to Insecure Direct Object References (IDOR)

Software WP Project Manager Type Plugin Vulnerable versions = 2.6.13 Fixed in 2.6.14 OWASP Top 10 A4: Insecure Design Classification Insecure Direct Object References IDOR CVE CVE-2024-10174 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 6aaed61c0d51 Credits stealthcopt...

Context is King: Using API Sessions for Security Context

There’s no doubt that API security is a hot topic these days. The continued growth in API-related breaches and increase in publicized API vulnerabilities has pushed API security to the top of CISO’s lists. The tools in the market for API security still have room for improvement, of course. One of...

WordPress Hide Links Plugin <= 1.4.2 is vulnerable to Broken Authentication

Software Hide Links Type Plugin Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9578 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 4b4a91ec2385 Credits Francesco...

WordPress xili-tidy-tags Plugin <= 1.12.04 is vulnerable to Cross Site Scripting (XSS)

Software xili-tidy-tags Type Plugin Vulnerable versions = 1.12.04 Fixed in 1.12.05 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9357 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0b09fba83740 Credits vgo0 Required...

WordPress RSS Feed Widget Plugin < 3.0.1 is vulnerable to Cross Site Scripting (XSS)

Software RSS Feed Widget Type Plugin Vulnerable versions 3.0.1 Fixed in 3.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9835 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a28316c34943 Credits Bob Matyas Required...

WordPress Luna Web Radio Player Plugin <= 6.24.01.24 is vulnerable to Directory Traversal

Software Luna Web Radio Player Type Plugin Vulnerable versions = 6.24.01.24 Fixed in 6.24.11.07 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-10816 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 24e0a47712fe Credits Tonn Required privilege...