WordPress Podlove Podcast Publisher Plugin <= 4.0.11 is vulnerable to Broken Access Control

Software Podlove Podcast Publisher Type Plugin Vulnerable versions = 4.0.11 Fixed in 4.0.12 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1110 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 51ffbbb85b7f Credits Lucio Sá Required...

WordPress Booking Calendar Plugin <= 9.9 is vulnerable to SQL Injection

Software Booking Calendar Type Plugin Vulnerable versions = 9.9 Fixed in 9.9.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-1207 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID f33b420f42e8 Credits Muhammad Hassham Nagori Required privilege...

WordPress Customer Reviews for WooCommerce Plugin <= 5.38.12 is vulnerable to Broken Access Control

Software Customer Reviews for WooCommerce Type Plugin Vulnerable versions = 5.38.12 Fixed in 5.39.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-1044 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7bfc65d6b633 Credits Francesco...

WordPress Starbox Plugin <= 3.4.8 is vulnerable to Cross Site Scripting (XSS)

Software Starbox Type Plugin Vulnerable versions = 3.4.8 Fixed in 3.5.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6806 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1adb996175e5 Credits Sh Required privilege...

WordPress AMP for WP Plugin <= 1.0.93.1 is vulnerable to Broken Access Control

Software AMP for WP Type Plugin Vulnerable versions = 1.0.93.1 Fixed in 1.0.93.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-1043 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9c0cb8faa4a6 Credits Sean Murphy Required privileg...

WordPress Elementor Addon Elements Plugin <= 1.12.11 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.12.11 Fixed in 1.12.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0834 Patch priority Low CVSS severity Low 6.5 Developer WPVibes PSID 65cab16f462f Credits Webbernaut Required...

WordPress AI Engine: ChatGPT Chatbot Plugin <= 2.1.4 is vulnerable to Arbitrary File Upload

Software AI Engine: ChatGPT Chatbot Type Plugin Vulnerable versions = 2.1.4 Fixed in 2.1.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-0699 Patch priority Medium CVSS severity Medium 6.6 Developer Claim ownership PSID a07cf1730f82 Credits rootxsudip Required...

WordPress Elementor Website Builder Plugin <= 3.19.0 is vulnerable to Arbitrary File Deletion

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.19.0 Fixed in 3.19.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-24934 Patch priority Low CVSS severity Low 8.5 Developer Elementor PSID 8c8af1fc63cc Credits Rhynorater Justin...

WordPress Advanced Database Cleaner Plugin <= 3.1.3 is vulnerable to PHP Object Injection

Software Advanced Database Cleaner Type Plugin Vulnerable versions = 3.1.3 Fixed in 3.1.4 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-0668 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID ae822ac39b98 Credits Richard Telleng stueotue Required...

WordPress WP Club Manager Plugin <= 2.2.10 is vulnerable to Broken Access Control

Software WP Club Manager Type Plugin Vulnerable versions = 2.2.10 Fixed in 2.2.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1177 Patch priority Low CVSS severity Low 5.3 Developer WP Club Manager PSID 6e13e5e19043 Credits Francesco Carlucci Required...

WordPress Anonymous Restricted Content Plugin <= 1.6.2 is vulnerable to Bypass Vulnerability

Software Anonymous Restricted Content Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-0909 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 3b50fe0358a1 Credits Francesco Carlucci...

WordPress Blocksy Theme <= 2.0.19 is vulnerable to Cross Site Scripting (XSS)

Software Blocksy Type Theme Vulnerable versions = 2.0.19 Fixed in 2.0.20 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24871 Patch priority Low CVSS severity Low 6.5 Developer Creative Themes PSID 07c604dd56fb Credits savphill Required privilege Editor Published ...

WordPress LearnDash LMS Plugin <= 4.10.1 is vulnerable to Sensitive Data Exposure

Software LearnDash LMS Type Plugin Vulnerable versions = 4.10.1 Fixed in 4.10.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-1209 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b49f2746f70f Credits Karl Emil Nikka Required...

WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF)

Software Link Library Type Plugin Vulnerable versions = 7.5.13 Fixed in 7.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24875 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 771a2cb13065 Credits Dhabaleshwar Das Requir...

WordPress RSS Aggregator by Feedzy Plugin <= 4.4.1 is vulnerable to Broken Access Control

Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions = 4.4.1 Fixed in 4.4.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1092 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d6dde9967d92 Credits Muhammad Daffa Requir...

WordPress LearnDash LMS Plugin <= 4.10.1 is vulnerable to Sensitive Data Exposure

Software LearnDash LMS Type Plugin Vulnerable versions = 4.10.1 Fixed in 4.10.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-1210 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID eac39e71b914 Credits Karl Emil Nikka Required...

WordPress Apollo13 Framework Extensions Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)

Software Apollo13 Framework Extensions Type Plugin Vulnerable versions = 1.9.2 Fixed in 1.9.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24880 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c7023587281d Credits LVT-tholv2k Required...

WordPress CP Polls Plugin <= 1.0.71 is vulnerable to Content Injection

Software CP Polls Type Plugin Vulnerable versions = 1.0.71 Fixed in 1.0.72 OWASP Top 10 A5: Security Misconfiguration Classification Content Injection CVE CVE-2024-24874 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 01d54802a0ee Credits Kyle Sanchez Required privilege...

WordPress Contest Gallery Plugin <= 21.2.8.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Contest Gallery Type Plugin Vulnerable versions = 21.2.8.4 Fixed in 21.2.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24887 Patch priority Low CVSS severity Low 5.4 Developer Wasiliy Strecker PSID bc8832951ec5 Credits Dhabaleshwar D...

Blocking Compromised Tokens with Wallarm

In our Annual API ThreatStats report, we highlighted the increasing threat of API Leaks. An API Leak is the disclosure of sensitive API information, such as a token, credential, or private schema. These leaks can occur directly via the API itself, but also via third party tools used to manage...