WordPress Nested Pages Plugin <= 3.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Nested Pages Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-5943 Patch priority Low CVSS severity Low 8.3 Developer Claim ownership PSID ec525e948d0f Credits Bassem Essam Required...

WordPress Ninja Forms Plugin <= 3.8.4 is vulnerable to Broken Access Control

Software Ninja Forms Type Plugin Vulnerable versions = 3.8.4 Fixed in 3.8.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37934 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5bd0529a71e3 Credits Rafie Muhammad Patchstack Require...

WordPress Advanced Classifieds & Directory Pro Plugin <= 3.1.3 is vulnerable to Local File Inclusion

Software Advanced Classifieds & Directory Pro Type Plugin Vulnerable versions = 3.1.3 Fixed in 3.2.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-37501 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 09c35e44898b Credits João Pedro S Alcântar...

WordPress BookYourTravel Theme <= 8.18.17 is vulnerable to Privilege Escalation

Software BookYourTravel Type Theme Vulnerable versions = 8.18.17 Fixed in 8.18.19 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-37952 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 8b015f16ebdc Credits Dave Jong Patchstack...

WordPress Zephyr Project Manager Plugin <= 3.3.97 is vulnerable to Privilege Escalation

Software Zephyr Project Manager Type Plugin Vulnerable versions = 3.3.97 Fixed in 3.3.99 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-37484 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 0ba7243a615b Credits shaman0x01 Required...

WordPress Livemesh Addons for Elementor Plugin <= 8.4.1 is vulnerable to Cross Site Scripting (XSS)

Software Livemesh Addons for Elementor Type Plugin Vulnerable versions = 8.4.1 Fixed in 8.4.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3638 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8c5eeeb75963 Credits Webbernaut...

WordPress Paid Memberships Pro Plugin <= 3.0.5 is vulnerable to SQL Injection

Software Paid Memberships Pro Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-37486 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 6111a0093c77 Credits Trương Hữu Phúc truonghuuphuc Required...

WordPress IMGspider Plugin <= 2.3.10 is vulnerable to Arbitrary File Upload

Software IMGspider Type Plugin Vulnerable versions = 2.3.10 Fixed in 2.3.11 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6319 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 7f35690ce29e Credits István Márton Required privilege...

WordPress The Post Grid Plugin <= 7.7.4 is vulnerable to Broken Access Control

Software The Post Grid Type Plugin Vulnerable versions = 7.7.4 Fixed in 7.7.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37482 Patch priority Low CVSS severity Low 4.3 Developer Mamunur Rashid PSID cde94030335f Credits Rafie Muhammad Patchstack Requir...

WordPress Bakes And Cakes Theme <= 1.2.6 is vulnerable to Broken Access Control

Software Bakes And Cakes Type Theme Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37496 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c1a64d1962d4 Credits Dhabaleshwar Das Required...

WordPress Table & Contact Form 7 Database – Tablesome Plugin <= 1.0.33 is vulnerable to Sensitive Data Exposure

Software Table & Contact Form 7 Database – Tablesome Type Plugin Vulnerable versions = 1.0.33 Fixed in 1.0.34 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-37498 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b592d73e1659...

WordPress Rara Business Theme <= 1.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Rara Business Type Theme Vulnerable versions = 1.2.5 Fixed in 1.2.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37937 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 36fd5a858830 Credits Dhabaleshwar Das...

WordPress Charitable Plugin <= 1.8.1.7 is vulnerable to Broken Access Control

Software Charitable Type Plugin Vulnerable versions = 1.8.1.7 Fixed in 1.8.1.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37506 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4942d8e7ca80 Credits Manab Jyoti Dowarah Required...

WordPress TotalRating Pro Plugin <= 1.8.4 is vulnerable to Backdoor

Software TotalRating Pro Type Plugin Vulnerable versions = 1.8.4 Fixed in 1.8.5 OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 63434ea7cd48 Credits Sansec.io Required privilege Unauthenticated Published 3 July, 20...

WordPress Alfred Easy Shipping Plugin <= 1.0.5 is vulnerable to Backdoor

Software Alfred Easy Shipping Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c071f3d22627 Credits Sansec.io Required privilege Unauthenticated Published 3 July,...

WordPress Logic Hop Plugin <= 3.8.8 is vulnerable to Backdoor

Software Logic Hop Type Plugin Vulnerable versions = 3.8.8 Fixed in 3.9.0 OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e54343bdaeda Credits Sansec.io Required privilege Unauthenticated Published 3 July, 2024...

WordPress Amelia Plugin <= 1.1.8 is vulnerable to Backdoor

Software Amelia Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.1.9 OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 9adf81355a51 Credits Sansec.io Required privilege Unauthenticated Published 3 July, 2024...

WordPress WebSitter Pro Plugin <= 4.0.11 is vulnerable to Backdoor

Software WebSitter Pro Type Plugin Vulnerable versions = 4.0.11 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b32be3e9bd16 Credits Sansec.io Required privilege Unauthenticated Published 3 July, 2024...

WordPress YAHMAN Add-ons Plugin <= 0.9.28 is vulnerable to Backdoor

Software YAHMAN Add-ons Type Plugin Vulnerable versions = 0.9.28 Fixed in 0.9.29 OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 26c7f39721f9 Credits Sansec.io Required privilege Unauthenticated Published 3 July,...

WordPress WP Lightbox 2 Plugin <= 3.0.6.6 is vulnerable to Cross Site Scripting (XSS)

Software WP Lightbox 2 Type Plugin Vulnerable versions = 3.0.6.6 Fixed in 3.0.6.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6263 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8a2088ef7bb8 Credits Webbernaut Required...