WordPress MultiManager WP Plugin <= 1.0.5 is vulnerable to Broken Authentication

Software MultiManager WP Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.1.0 OWASP Top 10 A4: Insecure Design Classification Broken Authentication CVE CVE-2024-11028 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 80e81dabfc85 Credits shaman0x01 Required privilege...

CISA, FBI, NSA, and International Partners Release Joint Advisory on 2023 Top Routinely Exploited Vulnerabilities

Today, the Cybersecurity and Infrastructure Security Agency CISA, the Federal Bureau of Investigation FBI, National Security Agency NSA, and international partners released joint Cybersecurity Advisory, 2023 Top Routinely Exploited Vulnerabilities. This advisory supplies details on the top Common...

WordPress RSS Feed Widget Plugin < 3.0.1 is vulnerable to Cross Site Scripting (XSS)

Software RSS Feed Widget Type Plugin Vulnerable versions 3.0.1 Fixed in 3.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9835 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a28316c34943 Credits Bob Matyas Required...

WordPress Hide Links Plugin <= 1.4.2 is vulnerable to Broken Authentication

Software Hide Links Type Plugin Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9578 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 4b4a91ec2385 Credits Francesco...

WordPress xili-tidy-tags Plugin <= 1.12.04 is vulnerable to Cross Site Scripting (XSS)

Software xili-tidy-tags Type Plugin Vulnerable versions = 1.12.04 Fixed in 1.12.05 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9357 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0b09fba83740 Credits vgo0 Required...

WordPress Luna Web Radio Player Plugin <= 6.24.01.24 is vulnerable to Directory Traversal

Software Luna Web Radio Player Type Plugin Vulnerable versions = 6.24.01.24 Fixed in 6.24.11.07 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-10816 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 24e0a47712fe Credits Tonn Required privilege...

WordPress Slickstream Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Slickstream Type Plugin Vulnerable versions = 1.4.4 Fixed in 2.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10179 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 483fb63a8894 Credits Peter Thaleikis Required...

WordPress Admin and Site Enhancements (ASE) Plugin <= 7.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Admin and Site Enhancements ASE Type Plugin Vulnerable versions = 7.5.1 Fixed in 7.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10790 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 84f75f3f7186 Credits Frances...

WordPress MPG Plugin <= 4.0.2 is vulnerable to Path Traversal

Software MPG Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-10672 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID 3c7693c48068 Credits Arkadiusz Hydzik Required privilege Editor...

WordPress Futurio Extra Plugin <= 2.0.13 is vulnerable to Broken Access Control

Software Futurio Extra Type Plugin Vulnerable versions = 2.0.13 Fixed in 2.0.14 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-10695 Patch priority Low CVSS severity Low 4.3 Developer FuturioWP PSID 162172e1702f Credits Francesco Carlucci Required privile...

WordPress WP-Strava Plugin <= 2.12.1 is vulnerable to Cross Site Scripting (XSS)

Software WP-Strava Type Plugin Vulnerable versions = 2.12.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10038 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID dd6efa54c071 Credits paupu Required privilege...

WordPress Kognetiks Chatbot for WordPress Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)

Software Kognetiks Chatbot for WordPress Type Plugin Vulnerable versions = 2.1.7 Fixed in 2.1.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10684 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e89537076c29 Credits L...

WordPress Styler for Ninja Forms Plugin <= 3.3.4 is vulnerable to Settings Change

Software Styler for Ninja Forms Type Plugin Vulnerable versions = 3.3.4 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Settings Change CVE CVE-2024-10717 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2b68f06a005e Credits...

WordPress Razorpay Payment Button Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)

Software Razorpay Payment Button Type Plugin Vulnerable versions = 2.4.6 Fixed in 2.4.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10851 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 88605e5d5760 Credits Peter...

WordPress Advanced Form Integration Plugin <= 1.92.0 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Form Integration Type Plugin Vulnerable versions = 1.92.0 Fixed in 1.92.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10877 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c8dcdef7d81d Credits Peter...

WordPress Master Addons for Elementor Plugin <= 2.0.6.6 is vulnerable to Cross Site Scripting (XSS)

Software Master Addons for Elementor Type Plugin Vulnerable versions = 2.0.6.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52387 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID fab3ef01c18f Credits Michael Required privilege...

WordPress Boat Rental Plugin for WordPress Plugin <= 1.0.1 is vulnerable to Arbitrary File Upload

Software Boat Rental Plugin for WordPress Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52376 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 3fb792ad560d Credits stealthcopter Required...

WordPress Team Member Plugin <= 7.3 is vulnerable to Local File Inclusion

Software Team Member Type Plugin Vulnerable versions = 7.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-52385 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f127efd80d70 Credits João Pedro S Alcântara Kinorth Require...

WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One Plugin <= 2.1.2 is vulnerable to Broken Access Control

Software Ai Auto Tool Content Writing Assistant Gemini Writer, ChatGPT All in One Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-52383 Patch priority High CVSS severity High 7.5 Developer Claim...

WordPress WOLF Plugin <= 1.0.8.3 is vulnerable to Path Traversal

Software WOLF Type Plugin Vulnerable versions = 1.0.8.3 Fixed in 1.0.8.4 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-52396 Patch priority Medium CVSS severity Medium 4.9 Developer Claim ownership PSID 1a1949b4101b Credits Trương Hữu Phúc truonghuuphuc Require...