9481 matches found
WordPress SEO Change Monitor Plugin <= 1.2 is vulnerable to SQL Injection
Software SEO Change Monitor Type Plugin Vulnerable versions = 1.2 Fixed in 1.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-33209 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 184c1106a607 Credits Nithissh S Required privilege Subscriber Publish...
WordPress Waiting: One-click countdowns Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS)
Software Waiting: One-click countdowns Type Plugin Vulnerable versions = 0.6.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2757 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 5e454859cceb Credits István...
WordPress SpiderMag Theme <= 1.1.7 is vulnerable to Broken Access Control
Software SpiderMag Type Theme Vulnerable versions = 1.1.7 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32959 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID ebe1f256ec21 Credits Dave Jong Patchstack Required...
WordPress SparkleStore Theme <= 1.6.0 is vulnerable to Broken Access Control
Software SparkleStore Type Theme Vulnerable versions = 1.6.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32959 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID eac4d697c839 Credits Dave Jong Patchstack Required...
WordPress Online eStore Theme <= 1.0.9 is vulnerable to Broken Access Control
Software Online eStore Type Theme Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32959 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 729988cdbce6 Credits Dave Jong Patchstack Require...
WordPress MetroStore Theme <= 1.3.2 is vulnerable to Broken Access Control
Software MetroStore Type Theme Vulnerable versions = 1.3.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32959 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID d697dae9407a Credits Dave Jong Patchstack Required...
WordPress Kingcabs Theme <= 1.1.6 is vulnerable to Broken Access Control
Software Kingcabs Type Theme Vulnerable versions = 1.1.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32959 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 2d230f2e2cbf Credits Dave Jong Patchstack Required...
CVE-2023-2179
The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making...
WooCommerce Ship to Multiple Addresses < 3.8.4 - Subscriber+ Shipping Address Disclosure via IDOR
The plugin does not ensure that the order to display the shipping address from belong to the user making the request, allowing any authenticated users, such as subscriber to view other shipping addresses via an IDOR https://example.com/checkout/shipping-addresses/?orderid=106...
WooCommerce Ship to Multiple Addresses < 3.8.4 - Subscriber+ Shipping Address Disclosure via IDOR
The plugin does not ensure that the order to display the shipping address from belong to the user making the request, allowing any authenticated users, such as subscriber to view other shipping addresses via an IDOR PoC https://example.com/checkout/shipping-addresses/?orderid=106...
WordPress reCAPTCHA for all Plugin <= 1.22 is vulnerable to Broken Access Control
Software reCAPTCHA for all Type Plugin Vulnerable versions = 1.22 Fixed in 1.23 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32599 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 97d938ca1868 Credits Jonas Höbenreich Required...
WordPress WordPress Announcement & Notification Banner Plugin – Bulletin Plugin <= 3.6.0 is vulnerable to Broken Access Control
Software WordPress Announcement & Notification Banner Plugin – Bulletin Type Plugin Vulnerable versions = 3.6.0 Fixed in 3.7.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2066 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSI...
WordPress WoodMart Theme <= 7.2.1 is vulnerable to Broken Access Control
Software WoodMart Type Theme Vulnerable versions = 7.2.1 Fixed in 7.2.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32240 Patch priority Medium CVSS severity Medium 5.4 Developer Xtemos PSID b409a147912c Credits Dave Jong Patchstack Required privilege...
WordPress WoodMart Theme <= 7.2.1 is vulnerable to Cross Site Scripting (XSS)
Software WoodMart Type Theme Vulnerable versions = 7.2.1 Fixed in 7.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32239 Patch priority Medium CVSS severity Medium 5.4 Developer Xtemos PSID 157d641b350c Credits Dave Jong Patchstack Required...
WordPress AnyWhere Elementor Plugin < 1.2.8 is vulnerable to Sensitive Data Exposure
Software AnyWhere Elementor Type Plugin Vulnerable versions 1.2.8 Fixed in 1.2.8 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-0443 Patch priority Low CVSS severity Low 5 Developer WPVibes PSID 5959639f04b8 Credits Sanjay Das Required privilege...
Cross site scripting
Auth. subscriber+ Stored Cross-Site Scripting XSS vulnerability in Rymera Web Co Wholesale Suite plugin = 2.1.5 versions...
CVE-2023-28493
Auth subscriber+ Reflected Cross-Site Scripting XSS vulnerability in Macho Themes NewsMag theme = 2.4.4 versions...
Sql injection
The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks...