WordPress Stacks Mobile App Builder Plugin <= 5.2.3 is vulnerable to Broken Authentication

Software Stacks Mobile App Builder Type Plugin Vulnerable versions = 5.2.3 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-50477 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 02ff662824ca Credit...

WordPress WatchTowerHQ Plugin <= 3.10.1 is vulnerable to Broken Authentication

Software WatchTowerHQ Type Plugin Vulnerable versions = 3.10.1 Fixed in 3.10.4 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9933 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 5b771d8428a0 Credits István...

WordPress Meetup Plugin <= 0.1 is vulnerable to Broken Authentication

Software Meetup Type Plugin Vulnerable versions = 0.1 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-50483 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 6432286e77c7 Credits Bonds Required...

WordPress Trip Plan Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)

Software Trip Plan Type Plugin Vulnerable versions = 1.0.10 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50471 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID be92d248bf15 Credits SOPROBRO Required privilege Contributor...

WordPress Templately Plugin <= 3.1.5 is vulnerable to Broken Access Control

Software Templately Type Plugin Vulnerable versions = 3.1.5 Fixed in 3.1.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-50424 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 91fcded45c2b Credits Rafie Muhammad Patchstack...

WordPress Themes4WP YouTube External Subtitles Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Themes4WP YouTube External Subtitles Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50470 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID eced79030f8a Credits SOPROBRO Required...

WordPress EmbedPress Plugin <= 4.0.14 is vulnerable to Cross Site Scripting (XSS)

Software EmbedPress Type Plugin Vulnerable versions = 4.0.14 Fixed in 4.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50461 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bd680c64cbcd Credits Thanayut Maktheppongt Required privilege...

WordPress EventPrime Plugin <= 4.0.4.7 is vulnerable to Cross Site Scripting (XSS)

Software EventPrime Type Plugin Vulnerable versions = 4.0.4.7 Fixed in 4.0.4.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9864 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1a0ade328fdb Credits zer0gh0st Required...

WordPress WPS Telegram Chat Plugin <= 4.5.4 is vulnerable to Broken Access Control

Software WPS Telegram Chat Type Plugin Vulnerable versions = 4.5.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9630 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9cb16fad33b1 Credits István Márton Required privile...

WordPress Magazine Blocks Plugin <= 1.3.15 is vulnerable to Cross Site Scripting (XSS)

Software Magazine Blocks Type Plugin Vulnerable versions = 1.3.15 Fixed in 1.3.18 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50429 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6916204a3487 Credits João Pedro S Alcântara Kinorth...

WordPress Bamazoo Button Generator Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Bamazoo Button Generator Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10150 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 296ef2edb58f Credits Francesco Carlucci...

WordPress BuddyPress Plugin <= 14.1.0 is vulnerable to Directory Traversal

Software BuddyPress Type Plugin Vulnerable versions = 14.1.0 Fixed in 14.2.1 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-10011 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 06408034e9a6 Credits Domons Required privilege Subscriber Publish...

WordPress WPC Shop as a Customer for WooCommerce Plugin <= 1.2.6 is vulnerable to PHP Object Injection

Software WPC Shop as a Customer for WooCommerce Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-50416 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID ffccd26940cf Credits LVT-tholv2k...

WordPress Textboxes Plugin <= 0.1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Textboxes Type Plugin Vulnerable versions = 0.1.3.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50469 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 50ef1a0649e6 Credits SOPROBRO Required privilege Contributor...

WordPress Contact Form 7 - Repeatable Fields Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 - Repeatable Fields Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10180 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d39a0f706c9a Credits Pete...

WordPress Mapster WP Maps Plugin <= 1.5.0 is vulnerable to Settings Change

Software Mapster WP Maps Type Plugin Vulnerable versions = 1.5.0 Fixed in 1.6.0 OWASP Top 10 A3: Injection Classification Settings Change CVE CVE-2024-9235 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID b9bebd7cfde8 Credits Sean Murphy Required privilege Contributor...

WordPress WordPress Stripe Donation and Payment Plugin Plugin <= 3.2.3 is vulnerable to Broken Access Control

Software WordPress Stripe Donation and Payment Plugin Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-50459 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID bb58320243b3 Credits...

WordPress aDirectory Plugin <= 1.3 is vulnerable to Arbitrary File Upload

Software aDirectory Type Plugin Vulnerable versions = 1.3 Fixed in 1.3.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50420 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 8b5cfce5fa20 Credits stealthcopter Required privilege Unauthenticate...

WordPress Premium SEO Pack Plugin <= 1.6.001 is vulnerable to SQL Injection

Software Premium SEO Pack Type Plugin Vulnerable versions = 1.6.001 Fixed in 1.6.002 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-50465 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 56b65671a73e Credits Hakiduck Required privilege Contributor...

WordPress Advanced Sermons Plugin <= 3.4 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Sermons Type Plugin Vulnerable versions = 3.4 Fixed in 3.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50458 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0e069038bb43 Credits SOPROBRO Required privilege Contributor...