WordPress RLM Elementor Widgets Pack Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software RLM Elementor Widgets Pack Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.4.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50542 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 13798bc26100 Credits Gab Required privilege...

WordPress Download Manager Plugin < 3.3.00 is vulnerable to Cross Site Scripting (XSS)

Software Download Manager Type Plugin Vulnerable versions 3.3.00 Fixed in 3.3.00 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8444 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 72a55938734a Credits Miguel Xavier Penha Net...

WordPress WeChat Subscribers Lite Plugin <= 1.6.6 is vulnerable to Cross Site Scripting (XSS)

Software WeChat Subscribers Lite Type Plugin Vulnerable versions = 1.6.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50522 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6111364515e3 Credits Muhamad Agil Fachrian...

WordPress Woo Manage Fraud Orders Plugin <= 6.1.7 is vulnerable to Sensitive Data Exposure

Software Woo Manage Fraud Orders Type Plugin Vulnerable versions = 6.1.7 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-10544 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 66ee55b75466 Credits Colin Xu Required...

WordPress Administrator Z Plugin <= 2024.11.20 is vulnerable to SQL Injection

Software Administrator Z Type Plugin Vulnerable versions = 2024.11.20 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-50524 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 23203529cd48 Credits stealthcopter Required privilege Subscriber...

WordPress Get Quote For Woocommerce Plugin <= 1.0.0 is vulnerable to Broken Access Control

Software Get Quote For Woocommerce Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9430 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ed4687422c20 Credits stehled Required...

WordPress Step by Step Plugin <= 0.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Step by Step Type Plugin Vulnerable versions = 0.4.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50535 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e27be9b81170 Credits SOPROBRO Required privilege Contributor...

WordPress ID-SK Toolkit Plugin <= 1.7.2 is vulnerable to Cross Site Scripting (XSS)

Software ID-SK Toolkit Type Plugin Vulnerable versions = 1.7.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50517 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8f37480f4086 Credits Gab Required privilege Contributor Publish...

WordPress Pricer Ninja Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Pricer Ninja Type Plugin Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50518 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 057e1d4e73d1 Credits SOPROBRO Required privilege Contributor...

WordPress RSVPMaker for Toastmasters Plugin <= 6.2.4 is vulnerable to Arbitrary File Upload

Software RSVPMaker for Toastmasters Type Plugin Vulnerable versions = 6.2.4 Fixed in 6.2.5 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50531 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 44944f5e5051 Credits stealthcopter Required...

WordPress affiliate-toolkit Plugin <= 3.6.5 is vulnerable to Cross Site Scripting (XSS)

Software affiliate-toolkit Type Plugin Vulnerable versions = 3.6.5 Fixed in 3.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10227 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 78a335fc5aaa Credits Peter Thaleikis...

WordPress StreamWeasels YouTube Integration Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Software StreamWeasels YouTube Integration Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.3.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10185 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 861dc6844504 Credits Peter...

WordPress Enable Shortcodes inside Widgets,Comments and Experts Plugin <= 1.0.0 is vulnerable to Arbitrary Code Execution

Software Enable Shortcodes inside Widgets,Comments and Experts Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary Code Execution CVE CVE-2024-9846 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 5e00f716955b Credits...

WordPress FileOrganizer Plugin <= 1.0.9 is vulnerable to Arbitrary File Upload

Software FileOrganizer Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.1.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7985 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 9a28a4363098 Credits TANG Cheuk Hei siunam Required privilege...

WordPress Easy Pricing Tables Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Easy Pricing Tables Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8871 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 642ead38dfc7 Credits vgo0 Required...

WordPress Subscribe to Comments Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Subscribe to Comments Type Plugin Vulnerable versions = 2.3 Fixed in 2.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8792 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e73a4a4fc1e2 Credits vgo0 Required...

GHSA-HXF3-VGPM-FV9P CycloneDX cdxgen may execute code contained within build-related files

CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

CycloneDX cdxgen may execute code contained within build-related files

CycloneDX cdxgen prior to 11.1.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation,...

WordPress Woocommerce Product Design Plugin <= 1.0.0 is vulnerable to Arbitrary File Deletion

Software Woocommerce Product Design Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-50509 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 072219981f36 Credits ghsinfosec...

WordPress SEUR Oficial Plugin <= 2.2.11 is vulnerable to Cross Site Scripting (XSS)

Software SEUR Oficial Type Plugin Vulnerable versions = 2.2.11 Fixed in 2.2.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9438 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 09ee4a264f33 Credits vgo0 Required...