WordPress Flash & HTML5 Video Plugin <= 2.5.31 is vulnerable to Sensitive Data Exposure

Software Flash & HTML5 Video Type Plugin Vulnerable versions = 2.5.31 Fixed in 2.5.32 OWASP Top 10 A4: Insecure Design Classification Sensitive Data Exposure CVE CVE-2024-43319 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e3846f722ce9 Credits Ananda Dhakal Patchstack...

WordPress JetElements For Elementor Plugin <= 2.6.20 is vulnerable to Local File Inclusion

Software JetElements For Elementor Type Plugin Vulnerable versions = 2.6.20 Fixed in 2.6.20.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-7145 Patch priority Low CVSS severity Low 7.5 Developer Crocoblock PSID f91f48f5ffcb Credits stealthcopter Required privilege...

WordPress myCred Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

Software myCred Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43353 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a2faf75ac250 Credits LVT-tholv2k Required privilege Contributor...

WordPress Stripe Payments For WooCommerce by Checkout Plugin <= 1.9.1 is vulnerable to Insecure Direct Object References (IDOR)

Software Stripe Payments For WooCommerce by Checkout Type Plugin Vulnerable versions = 1.9.1 Fixed in 1.9.2 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-43315 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID...

WordPress Brave Popup Builder Plugin <= 0.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Brave Popup Builder Type Plugin Vulnerable versions = 0.7.0 Fixed in 0.7.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43337 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 04312f740763 Credits Ananda Dhakal...

WordPress GivingPress Lite Theme <= 1.8.6 is vulnerable to Cross Site Scripting (XSS)

Software GivingPress Lite Type Theme Vulnerable versions = 1.8.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43352 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID dc2d25ba2424 Credits stealthcopter Required privilege...

WordPress wpForo Forum Plugin <= 2.3.4 is vulnerable to Sensitive Data Exposure

Software wpForo Forum Type Plugin Vulnerable versions = 2.3.4 Fixed in 2.3.5 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-43289 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID ac5555013147 Credits Ananda Dhakal Patchstack...

WordPress Fonts Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Fonts Type Plugin Vulnerable versions = 3.7.7 Fixed in 3.7.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43301 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 27e6a6b5f399 Credits Rafie Muhammad Patchstack...

WordPress PowerPack for Beaver Builder Plugin < 2.37.4 is vulnerable to Cross Site Scripting (XSS)

Software PowerPack for Beaver Builder Type Plugin Vulnerable versions 2.37.4 Fixed in 2.37.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43330 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ff58b27c7462 Credits Rafie Muhammad...

WordPress Insert PHP Code Snippet plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Insert PHP Code Snippet versions = 1.3.6...

WordPress Insert PHP Code Snippet Plugin <= 1.3.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Insert PHP Code Snippet Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43275 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f6953adb666a Credits Rafie...

WordPress TrueBooker Plugin <= 1.0.2 is vulnerable to SQL Injection

Software TrueBooker Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-6924 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID bf0618e9b2e8 Credits Project Black Required privilege Unauthenticated...

WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin plugin <= 1.3.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Icegram Collect versions = 1.3.14...

WordPress Widgets for WooCommerce Products on Elementor plugin <= 2.0.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Woo Products Widgets For Elementor versions = 2.0.4...

WordPress WP BackItUp plugin <= 1.50 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP BackItUp versions = 1.50...

WordPress Analytify plugin <= 5.3.1 - CSRF Leading to Optout Vulnerability

CSRF Leading to Optout Vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Analytify versions = 5.3.1...

WordPress Create by Mediavine plugin <= 1.9.8 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peng Zhou Patchstack Alliance in WordPress Plugin Create by Mediavine versions = 1.9.8...

WordPress Compute Links plugin <= 1.2.1 - Remote File Inclusion vulnerability

Remote File Inclusion vulnerability discovered by YCInfosec Patchstack Alliance in WordPress Plugin Compute Links versions = 1.2.1...

WordPress Store Locator Plus® for WordPress plugin <= 2311.17.01 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peng Zhou Patchstack Alliance in WordPress Plugin Store Locator Plus versions = 2311.17.01...

WordPress Smart Online Order for Clover plugin <= 1.5.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Smart Online Order for Clover versions = 1.5.6...