WordPress Multipurpose Ticket Booking Manager Plugin <= 4.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Multipurpose Ticket Booking Manager Type Plugin Vulnerable versions = 4.2.2 Fixed in 4.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44037 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b472848aaab9 Credits Jorge Diaz ddiax...

WordPress Quiz And Survey Master Plugin < 9.1.3 is vulnerable to Cross Site Scripting (XSS)

Software Quiz And Survey Master Type Plugin Vulnerable versions 9.1.3 Fixed in 9.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8758 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1f4eb044984c Credits Dmitrii Ignatyev...

WordPress Themify – WooCommerce Product Filter Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Themify – WooCommerce Product Filter Type Plugin Vulnerable versions = 1.5.1 Fixed in 1.5.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44046 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b38cdc945b73 Credits bugcraftx Require...

WordPress MC4WP Plugin 4.9.9 - 4.9.16 is vulnerable to Cross Site Scripting (XSS)

Software MC4WP Type Plugin Vulnerable versions 4.9.9 - 4.9.16 Fixed in 4.9.17 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-8850 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 37434d44abfc Credits kauenavarro Required privilege...

WordPress WP Custom Fields Search Plugin <= 1.2.35 is vulnerable to Cross Site Scripting (XSS)

Software WP Custom Fields Search Type Plugin Vulnerable versions = 1.2.35 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8364 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 701b94a643a3 Credits Krzysztof Zając...

Mautic has an XSS in contact tracking and page hits report

Summary Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report. Patches Please update to 4.4.13 or 5.1.1 or later. Workarounds None References https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScriptingXSS...

GHSA-73GR-32WG-QHH7 Mautic vulnerable to XSS in contact/company tracking (no authentication)

Summary Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable. Patches Please update to 4.4.13 or 5.1.1 or later. Workarounds None References https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScriptingXSS...

GHSA-CP65-5M9R-VC2C Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)

A path traversal vulnerability accessible via MediaController's downloadprivatefile method allows authenticated users to download any file on the web server Camaleon CMS is running on depending on the file permissions. In the downloadprivatefile method: ruby def downloadprivatefile...

WordPress WP Hardening Plugin <= 1.2.6 is vulnerable to Bypass Vulnerability

Software WP Hardening Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-6641 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5e3f8dc1dce6 Credits Felipe Caon Required privilege...

Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)

A path traversal vulnerability accessible via MediaController's downloadprivatefile method allows authenticated users to download any file on the web server Camaleon CMS is running on depending on the file permissions. In the downloadprivatefile method: ruby def downloadprivatefile...

WordPress PropertyHive Plugin <= 2.0.19 is vulnerable to Cross Site Request Forgery (CSRF)

Software PropertyHive Type Plugin Vulnerable versions = 2.0.19 Fixed in 2.0.20 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8490 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID d53c1264ba06 Credits wesley wcraft Require...

WordPress Share This Image Plugin <= 2.03 is vulnerable to Open Redirection

Software Share This Image Type Plugin Vulnerable versions = 2.03 Fixed in 2.04 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2024-8761 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 2b483c93b8d5 Credits Krzysztof Zając Required privilege Unauthenticat...

WordPress Houzez Login Register Plugin <= 3.2.5 is vulnerable to Privilege Escalation

Software Houzez Login Register Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.3.0 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2024-21743 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 864db44c0749 Credits luc Required...

WordPress Posts reminder Plugin <= 0.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software Posts reminder Type Plugin Vulnerable versions = 0.20 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8093 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f49f52b3e7c5 Credits Daniel Ruf Required...

GHSA-VVQW-FQWX-MQMM Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor

Impact The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to change e.g. to if they know how to craft these requests themselves. Patches N/A Workarounds Review the user accounts tha...

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log

Impact The admin panel is subject to potential XSS attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. Patches N/A Workarounds Redirect the pages /admin and /admin/logs to other admi...

GHSA-RX9F-5GGV-5RH6 Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log

Impact The admin panel is subject to potential XSS attach in case an admin assigns a valuator to a proposal, or does any other action that generates an admin activity log where one of the resources has an XSS crafted. Patches N/A Workarounds Redirect the pages /admin and /admin/logs to other admi...

WordPress Roseta Theme <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Roseta Type Theme Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-45451 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 90104539cfb5 Credits stealthcopter Required privilege Contributor...

WordPress Bricks Builder Theme <= 1.10.1 is vulnerable to Cross Site Scripting (XSS)

Software Bricks Builder Type Theme Vulnerable versions = 1.10.1 Fixed in 1.10.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3410 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID acd84adffb41 Credits Ram Required privilege...

WordPress Septera Theme <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Septera Type Theme Vulnerable versions = 1.5.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-45452 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2a58cc08c97a Credits stealthcopter Required privilege Contributor...