WordPress Uncanny Groups for LearnDash Plugin <= 6.1.0.1 is vulnerable to Broken Access Control

Software Uncanny Groups for LearnDash Type Plugin Vulnerable versions = 6.1.0.1 Fixed in 6.1.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8350 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID d89e217025ab Credits Karl Emil Nikka...

WordPress Bit Form – Contact Form Plugin Plugin <= 2.13.10 is vulnerable to Arbitrary File Upload

Software Bit Form – Contact Form Plugin Type Plugin Vulnerable versions = 2.13.10 Fixed in 2.13.11 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-47319 Patch priority Low CVSS severity Low 8 Developer Claim ownership PSID 4ad1bd9ca230 Credits Certus Cybersecurity...

WordPress WP Datepicker Plugin <= 2.1.1 is vulnerable to Broken Access Control

Software WP Datepicker Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47321 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 43063696ef76 Credits Mika Required privilege...

WordPress Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads Plugin <= 2.0.84 is vulnerable to Broken Access Control

Software Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads Type Plugin Vulnerable versions = 2.0.84 Fixed in 2.0.85 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47317 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3ea101b7f4e3...

WordPress Livemesh Addons for Elementor Plugin <= 8.5 is vulnerable to Cross Site Scripting (XSS)

Software Livemesh Addons for Elementor Type Plugin Vulnerable versions = 8.5 Fixed in 8.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8858 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c027727b1dcc Credits stealthcopte...

WordPress Secure Copy Content Protection and Content Locking Plugin <= 4.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Secure Copy Content Protection and Content Locking Type Plugin Vulnerable versions = 4.2.3 Fixed in 4.2.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47306 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fc78d82843ef Credi...

WordPress Wheel of Life Plugin <= 1.1.8 is vulnerable to Broken Access Control

Software Wheel of Life Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.1.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47311 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID dc57c1e20b9a Credits hunter85 Required privilege...

CVE-2024-8741: Improper Neutralization of Input During Web Page Generation

The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to inject...

WordPress Fluent Support Plugin <= 1.8.0 is vulnerable to Broken Access Control

Software Fluent Support Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47302 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 1b6430288129 Credits Khalid Yusuf Required privileg...

WordPress Ninja Forms Plugin <= 3.8.15 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms Type Plugin Vulnerable versions = 3.8.15 Fixed in 3.8.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3866 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 8846b83daea8 Credits wesley wcraft Required...

WordPress Use Any Font Plugin <= 6.3.08 is vulnerable to Cross Site Request Forgery (CSRF)

Software Use Any Font Type Plugin Vulnerable versions = 6.3.08 Fixed in 6.3.09 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-47305 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 15cf8c1d7c9e Credits Rafie Muhammad...

WordPress ThemeHunk Plugin <= 1.0.9 is vulnerable to Broken Access Control

Software ThemeHunk Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.1.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8434 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 0bcea717beb5 Credits Lucio Sá Required privilege Subscrib...

WordPress Easy PayPal Events Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Easy PayPal Events Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8476 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 61a92fe21d38 Credits Krzysztof Zając...

WordPress CP Polls Plugin <= 1.0.74 is vulnerable to Cross Site Scripting (XSS)

Software CP Polls Type Plugin Vulnerable versions = 1.0.74 Fixed in 1.0.75 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47297 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bd0fc6118ee8 Credits Muhamad Agil Fachrian Required...

WordPress Checkout Mestres WP Plugin <= 8.6 is vulnerable to Local File Inclusion

Software Checkout Mestres WP Type Plugin Vulnerable versions = 8.6 Fixed in 8.6.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44030 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 15bf1846430c Credits tahu.datar Required privilege...

WordPress Podiant Plugin <= 1.1 is vulnerable to Local File Inclusion

Software Podiant Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44016 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 8fe4bbbe7fea Credits tahu.datar Required privilege Unauthenticated...

WordPress Vmax Project Manager Plugin <= 1.0 is vulnerable to Local File Inclusion

Software Vmax Project Manager Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44014 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID 0a143d09e270 Credits tahu.datar Required privilege...

WordPress AnWP Football Leagues Plugin <= 0.16.7 is vulnerable to Cross Site Scripting (XSS)

Software AnWP Football Leagues Type Plugin Vulnerable versions = 0.16.7 Fixed in 0.16.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8917 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1862a8d1a35e Credits Francesco Carluc...

WordPress Webba Booking Plugin <= 5.0.48 is vulnerable to Broken Access Control

Software Webba Booking Type Plugin Vulnerable versions = 5.0.48 Fixed in 5.0.50 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8432 Patch priority Low CVSS severity Low 4.3 Developer Webba Plugins PSID fd2912e23a57 Credits Lucio Sá Required privilege...

WordPress Seriously Simple Stats Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Seriously Simple Stats Type Plugin Vulnerable versions = 1.6.0 Fixed in 1.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8738 Patch priority Medium CVSS severity Medium 7.1 Developer Castos PSID f8f850e73781 Credits vgo0 Required...