WordPress SmartMag theme < 10.1.0 - Sensitive Data Exposure via Log File vulnerability

Sensitive Data Exposure via Log File vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme SmartMag versions 10.1.0...

WordPress User Activity Log Pro plugin <= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerability

Subscriber+ Multiple Broken Access Control vulnerability discovered by Dave Jong Patchstack in WordPress Plugin User Activity Log Pro versions = 2.3.4...

WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WP Accessibility Helper WAH versions = 0.6.2.9...

WordPress BuddyBoss Theme theme <= 2.4.61 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dave Jong Patchstack in WordPress Theme BuddyBoss Theme versions = 2.4.61...

WordPress Cliengo – Chatbot plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Cliengo – Chatbot versions = 3.0.4...

WordPress PayPlus Payment Gateway plugin <= 7.0.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin PayPlus Payment Gateway versions = 7.0.7...

WordPress WP User Switch plugin <= 1.1.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin WP User Switch versions = 1.1.2...

WordPress Woocommerce OpenPos Plugin <= 6.4.4 is vulnerable to Arbitrary File Deletion

Software Woocommerce OpenPos Type Plugin Vulnerable versions = 6.4.4 Fixed in 7.0.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-37932 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 80d70b64099f Credits Dave Jong Patchstack...

WordPress Woocommerce OpenPos Plugin <= 6.4.4 is vulnerable to SQL Injection

Software Woocommerce OpenPos Type Plugin Vulnerable versions = 6.4.4 Fixed in 7.0.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-37933 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID ffbf45a16888 Credits Dave Jong Patchstack Required privilege...

WordPress SociallyViral Theme <= 1.0.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software SociallyViral Type Theme Vulnerable versions = 1.0.10 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37938 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f7e692acf4dc Credits Dhabaleshwar Das Requir...

WordPress Woocommerce OpenPos Plugin <= 7.0.1 is vulnerable to Broken Access Control

Software Woocommerce OpenPos Type Plugin Vulnerable versions = 7.0.1 Fixed in 7.0.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37935 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID d6898ddc425e Credits Dave Jong Patchstack...

WordPress WPFavicon plugin <= 2.1.1 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin WPFavicon versions = 2.1.1...

WordPress WP Cookie Law Info plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by filime Patchstack Alliance in WordPress Plugin WP Cookie Law Info versions = 1.1...

WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Social Media & Share Icons versions = 2.9.1...

WordPress Simple Social Share plugin <=3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sharanabasappa Patchstack Alliance in WordPress Plugin Simple Social Share versions = 3.0...

WordPress Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Image Hover Effects - Caption Hover with Carousel versions = 3.0.2...

WordPress Ultimate Auction plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Ultimate Auction versions = 4.2.5...

WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Responsive Image Gallery, Gallery Album versions = 2.0.3...

WordPress Link To Bible plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sharanabasappa Patchstack Alliance in WordPress Plugin Link To Bible versions = 2.5.9...

WordPress WP To Do Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software WP To Do Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37539 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8e78be231480 Credits younsoung kim, SeoHyeon Lee, MyungJu Kim, SeoHe...