WordPress Hello World Plugin <= 2.1.1 is vulnerable to Arbitrary File Download

Software Hello World Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-9224 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 936cc3342bfb Credits yudha Required privilege...

WordPress Empowerment Theme <= 1.0.2 is vulnerable to PHP Object Injection

Software Empowerment Type Theme Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7433 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 0e87e0a8a717 Credits Francesco Carlucci Required privilege...

WordPress Geo Mashup Plugin <= 1.13.13 is vulnerable to Cross Site Scripting (XSS)

Software Geo Mashup Type Plugin Vulnerable versions = 1.13.13 Fixed in 1.13.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8990 Patch priority Low CVSS severity Low 6.5 Developer Dylan Kuhn PSID e149f169bae9 Credits Peter Thaleikis Required...

WordPress WP Easy Gallery Plugin <= 4.8.5 is vulnerable to SQL Injection

Software WP Easy Gallery Type Plugin Vulnerable versions = 4.8.5 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-9018 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 3b54f86f6ce5 Credits Peter Thaleikis Required privilege Contributor...

WordPress Stars Testimonials Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Stars Testimonials Type Plugin Vulnerable versions = 3.3.1 Fixed in 3.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8989 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b53073d7e5ac Credits Peter Thaleikis...

WordPress Elastik Page Builder Plugin <= 0.27.4 is vulnerable to Cross Site Scripting (XSS)

Software Elastik Page Builder Type Plugin Vulnerable versions = 0.27.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9274 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e7cb14e17099 Credits Francesco Carlucci...

WordPress AVIF & SVG Uploader Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software AVIF & SVG Uploader Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9060 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6e662df81c43 Credits Francesco Carlucci...

WordPress QS Dark Mode Plugin <= 2.9 is vulnerable to Cross Site Scripting (XSS)

Software QS Dark Mode Type Plugin Vulnerable versions = 2.9 Fixed in 3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9118 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 4e085a92e1ee Credits Francesco Carlucci Required...

WordPress Loggedin Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Loggedin Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9228 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ab329401c416 Credits vgo0 Required privilege...

Decidim has a cross-site scripting vulnerability in the version control page

Impact The version control feature used in resources is subject to potential cross-site scripting XSS attack through a malformed URL. Workarounds Not available References OWASP ASVS v4.0.3-5.1.3 Credits This issue was discovered in a security audit organized by Open Source Politics against Decidi...

WordPress Author Avatars List/Block Plugin <= 2.1.21 is vulnerable to Cross Site Scripting (XSS)

Software Author Avatars List/Block Type Plugin Vulnerable versions = 2.1.21 Fixed in 2.1.22 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47370 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7fcface20444 Credits Hwang Se-yeon Requir...

WordPress The Post Grid Plugin < 7.5.0 is vulnerable to Cross Site Scripting (XSS)

Software The Post Grid Type Plugin Vulnerable versions 7.5.0 Fixed in 7.5.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3635 Patch priority Low CVSS severity Low 6.5 Developer Mamunur Rashid PSID e1b0ed6ba0a7 Credits Dmitrii Ignatyev Required...

WordPress Confetti Fall Animation Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Confetti Fall Animation Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47641 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e1b31f88b4d3 Credits stealthcopter Required privilege...

WordPress BuddyForms Plugin <= 2.8.12 is vulnerable to Cross Site Scripting (XSS)

Software BuddyForms Type Plugin Vulnerable versions = 2.8.12 Fixed in 2.8.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47377 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9418faef5fbf Credits SOPROBRO Required privilege Editor...

WordPress Depicter Slider Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Depicter Slider Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.5.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47381 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c88e18af2d73 Credits savphill Required privilege Editor...

WordPress Create Theme <= 2.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Create Type Theme Vulnerable versions = 2.9.1 Fixed in 2.9.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47356 Patch priority Low CVSS severity Low 5.1 Developer Claim ownership PSID 075203a385e4 Credits Michael Required privilege Author Published 30...

WordPress Zoho Forms Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software Zoho Forms Type Plugin Vulnerable versions = 4.0 Fixed in 4.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47633 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cd73af6a9904 Credits Trương Hữu Phúc truonghuuphuc Required...

WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.13.0 is vulnerable to Cross Site Scripting (XSS)

Software YITH WooCommerce Product Add-Ons Type Plugin Vulnerable versions = 4.13.0 Fixed in 4.13.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47367 Patch priority Medium CVSS severity Medium 7.1 Developer YITH PSID 4f86ebd3a7b4 Credits Le Ngoc Anh Required...

WordPress Depicter Slider Plugin <= 3.2.2 is vulnerable to Broken Access Control

Software Depicter Slider Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.5.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47359 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID fe95aaab539d Credits Rafie Muhammad Patchstack...

WordPress GiveWP Plugin <= 3.16.2 is vulnerable to PHP Object Injection

Software GiveWP Type Plugin Vulnerable versions = 3.16.2 Fixed in 3.16.3 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-8353 Patch priority High CVSS severity High 10 Developer Liquid Web / StellarWP PSID ab27727ec281 Credits cuokon Required privilege Unauthenticated...