WordPress Master Addons for Elementor Plugin <= 2.0.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Master Addons for Elementor Type Plugin Vulnerable versions = 2.0.6.4 Fixed in 2.0.6.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6282 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4a14125827b6 Credits Webberna...

WordPress Nova Blocks by Pixelgrade Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)

Software Nova Blocks by Pixelgrade Type Plugin Vulnerable versions = 2.1.7 Fixed in 2.1.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8241 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1f5ae0b10869 Credits Francesco...

WordPress Bit File Manager Plugin <= 6.5.5 is vulnerable to Arbitrary File Upload

Software Bit File Manager Type Plugin Vulnerable versions = 6.5.5 Fixed in 6.5.6 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7770 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 4d22ee982f55 Credits TANG Cheuk Hei siunam Required privileg...

WordPress Slider comparison image before and after Plugin <= 0.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Slider comparison image before and after Type Plugin Vulnerable versions = 0.8.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8543 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bdbfcf7211bf Credits...

WordPress Floating Contact Button Plugin < 2.8 is vulnerable to Cross Site Scripting (XSS)

Software Floating Contact Button Type Plugin Vulnerable versions 2.8 Fixed in 2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7891 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2bb2b652e147 Credits Kientt Required...

WordPress Affiliate Super Assistent Plugin <= 1.5.3 is vulnerable to Broken Access Control

Software Affiliate Super Assistent Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-8478 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 5f6f408b4c81 Credits Francesco...

WordPress Tutor LMS Plugin <= 2.7.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.4 Fixed in 2.7.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2919 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a0dbe6193554 Credits Ram Required privilege...

WordPress Starbox Plugin < 3.5.2 is vulnerable to Cross Site Scripting (XSS)

Software Starbox Type Plugin Vulnerable versions 3.5.2 Fixed in 3.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7955 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8d336cf2178c Credits Krugov Artyom Required privilege...

Risky Deserialization Calls - benryanconversion ( Office Connector Plugin)

The benryanconversion plugin contains a code path that eventually ends up with a partially user-controlled filename being treated as the input for a call to readObject see FileBackedCache.loadFile. To trigger this, an attacker would need to call the following, with a payload in the sheetName...

WordPress WP ULike Plugin < 4.7.2.1 is vulnerable to Cross Site Scripting (XSS)

Software WP ULike Type Plugin Vulnerable versions 4.7.2.1 Fixed in 4.7.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6792 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fcd51aa95df1 Credits stealthcopter Required...

WordPress Big File Uploads Plugin <= 2.1.2 is vulnerable to Full Path Disclosure (FPD)

Software Big File Uploads Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A3: Sensitive Data Exposure Classification Full Path Disclosure FPD CVE CVE-2024-8538 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7d70a0318727 Credits netc4t Required privileg...

WordPress Pinpoint Booking System Plugin <= 2.9.9.5.0 is vulnerable to SQL Injection

Software Pinpoint Booking System Type Plugin Vulnerable versions = 2.9.9.5.0 Fixed in 2.9.9.5.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-7112 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 3f6ddfc5c651 Credits Piotr Kuśpit Required privilege...

WordPress Popup Maker Plugin < 1.19.1 is vulnerable to Cross Site Scripting (XSS)

Software Popup Maker Type Plugin Vulnerable versions 1.19.1 Fixed in 1.19.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5561 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 28c13e8e0eab Credits Dmitrii Ignatyev Required...

WordPress Ninja Forms File Uploads Extension Plugin <= 3.3.16 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms File Uploads Extension Type Plugin Vulnerable versions = 3.3.16 Fixed in 3.3.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1596 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 261b89d2f6fa Credi...

WordPress Customizer Export/Import Plugin <= 0.9.7 is vulnerable to Arbitrary File Upload

Software Customizer Export/Import Type Plugin Vulnerable versions = 0.9.7 Fixed in 0.9.7.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7620 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 9417048c628d Credits Luk6785 Required privilege...

WordPress Advanced Sermons Plugin <= 3.3 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Sermons Type Plugin Vulnerable versions = 3.3 Fixed in 3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7599 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d85d91823452 Credits vgo0 Required privilege...

WordPress WP AdCenter Plugin <= 2.5.6 is vulnerable to Cross Site Scripting (XSS)

Software WP AdCenter Type Plugin Vulnerable versions = 2.5.6 Fixed in 2.5.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8317 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cf77f095bc05 Credits Francesco Carlucci Required...

WordPress ForumWP Plugin <= 2.0.2 is vulnerable to Privilege Escalation

Software ForumWP Type Plugin Vulnerable versions = 2.0.2 Fixed in 2.1.0 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8428 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 04472abbfa0c Credits wesley wcraft...

WordPress LifterLMS Plugin <= 7.7.5 is vulnerable to SQL Injection

Software LifterLMS Type Plugin Vulnerable versions = 7.7.5 Fixed in 7.7.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-7349 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 171b245559b0 Credits FKSEC Required privilege Administrator Published 6...

[9.0] Fix Risky deserialization calls

h3. Issue Summary fix This is reproducible on Data Center: Yes h3. Steps to Reproduce Cannot be reproduced h3. Expected Results Where possible, restrict the set of classes that can be deserialized. OWASP’s recommendation for readObject calls is to subclass the ObjectInputStream class, and overrid...