WordPress Product Designer Plugin <= 1.0.33 is vulnerable to Broken Access Control

Software Product Designer Type Plugin Vulnerable versions = 1.0.33 Fixed in 1.0.34 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3608 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7913547b43c1 Credits Lucio Sá Required privilege...

CVE-2024-40605

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40600

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

WordPress WP To Do Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software WP To Do Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37539 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8e78be231480 Credits younsoung kim, SeoHyeon Lee, MyungJu Kim, SeoHe...

PT-2024-28936 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki Metrolook skin versions through 1.42.1 Description: An issue was discovered in the Metrolook skin for MediaWiki, where there is stored XSS via MediaWiki:Sidebar top-level menu entries. Recommendations: For versions through 1.42.1,...

WordPress WPFavicon Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WPFavicon Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Request Forgery CSRF CVE CVE-2024-37558 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f7589e2e3c1a Credits Cronus Required privilege Administrator...

CVE-2024-40600

Affected software: Metrolook skin for MediaWiki up to version 1.42.1. Vulnerability: stored XSS via MediaWiki:Sidebar top-level menu entries. Impact: can lead to execution of arbitrary script in a victim’s browser; exploitation details are not provided in the documents. Root cause: improper handl...

PT-2024-28938 · Mediawiki · Mediawiki

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.42.1 Description: An issue was discovered in the Tempo skin for MediaWiki. There is stored XSS via MediaWiki:Sidebar top-level menu entries. Recommendations: For versions through 1.42.1, consider disabling the Tem...

CVE-2024-40600

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

WordPress Save as PDF plugin by Pdfcrowd Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Save as PDF plugin by Pdfcrowd Type Plugin Vulnerable versions = 4.0.0 Fixed in 4.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37549 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5b92af9f47f3 Credits Cronus Required privile...

WordPress Leaky Paywall Plugin <= 4.21.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Leaky Paywall Type Plugin Vulnerable versions = 4.21.2 Fixed in 4.21.3 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-37540 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6553531150a7 Credits Ananda Dhakal Patchstack...

WordPress Ultimate Auction Plugin <= 4.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Ultimate Auction Type Plugin Vulnerable versions = 4.2.5 Fixed in 4.2.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37543 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ed8502cd34a3 Credits Majed Refaea...

CVE-2024-40605

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

WordPress XPlainer - WooCommerce Product FAQ Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS)

Software XPlainer - WooCommerce Product FAQ Type Plugin Vulnerable versions = 1.6.3 Fixed in 1.6.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37515 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 4539c5a9e2c2 Credits LVT-tholv2k...

WordPress WS Contact Form Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Software WS Contact Form Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37537 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9166c1a50a0c Credits younsoung kim, SeoHyeon Lee, MyungJu...

WordPress zBench Theme <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software zBench Type Theme Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37521 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2c4afe226653 Credits stealthcopter Required privilege Contributor...

WordPress Spectra Plugin <= 2.13.7 is vulnerable to Broken Access Control

Software Spectra Type Plugin Vulnerable versions = 2.13.7 Fixed in 2.13.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37517 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID dc287e0a3ecb Credits Rafie Muhammad Patchstack Required...

WordPress Zephyr Project Manager Plugin <= 3.3.97 is vulnerable to Privilege Escalation

Software Zephyr Project Manager Type Plugin Vulnerable versions = 3.3.97 Fixed in 3.3.99 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-37484 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 0ba7243a615b Credits shaman0x01 Required...

WordPress Ninja Forms Plugin <= 3.8.4 is vulnerable to Broken Access Control

Software Ninja Forms Type Plugin Vulnerable versions = 3.8.4 Fixed in 3.8.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37934 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5bd0529a71e3 Credits Rafie Muhammad Patchstack Require...

WordPress Nested Pages Plugin <= 3.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Nested Pages Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-5943 Patch priority Low CVSS severity Low 8.3 Developer Claim ownership PSID ec525e948d0f Credits Bassem Essam Required...