WordPress Gravity Forms: Multiple Form Instances Plugin <= 1.1.1 is vulnerable to Full Path Disclosure (FPD)

Software Gravity Forms: Multiple Form Instances Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-6550 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID af3116244e6e Credits...

WordPress ScrollTo Top plugin <= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload vulnerability

Cross-Site Request Forgery to Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin ScrollTo Top versions = 1.2.2...

WordPress Point Theme <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Point Type Theme Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37931 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7886c1ba47d8 Credits Dhabaleshwar Das Required privileg...

WordPress Squelch Tabs and Accordions Shortcodes Plugin <= 0.4.8 is vulnerable to Cross Site Scripting (XSS)

Software Squelch Tabs and Accordions Shortcodes Type Plugin Vulnerable versions = 0.4.8 Fixed in 0.4.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5946 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b92bc9205697 Credits...

WordPress Generate PDF using Contact Form 7 Plugin <= 4.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Generate PDF using Contact Form 7 Type Plugin Vulnerable versions = 4.1.2 Fixed in 4.1.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-6317 Patch priority Low CVSS severity Low 8.1 Developer Claim ownership PSID 8ce1a2d4086e Credits...

WordPress Patricia Lite Theme <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Patricia Lite Type Theme Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37939 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7674798b0489 Credits Dhabaleshwar Das Require...

WordPress User Activity Log Pro Plugin <= 2.3.4 is vulnerable to Broken Access Control

Software User Activity Log Pro Type Plugin Vulnerable versions = 2.3.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37929 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID a51ba27e9212 Credits Dave Jong Patchstac...

WordPress Easy Pixels Plugin <= 2.13 is vulnerable to Cross Site Scripting (XSS)

Software Easy Pixels Type Plugin Vulnerable versions = 2.13 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5479 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4b79cc61de42 Credits Lucio Sá Required privile...

WordPress Pie Register Plugin <= 3.8.3.4 is vulnerable to Broken Access Control

Software Pie Register Type Plugin Vulnerable versions = 3.8.3.4 Fixed in 3.8.3.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6069 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 62f61e484b06 Credits Lucio Sá Required privilege...

WordPress Bit Form – Contact Form Plugin Plugin <= 2.12.3 is vulnerable to Arbitrary File Upload

Software Bit Form – Contact Form Plugin Type Plugin Vulnerable versions = 2.12.3 Fixed in 2.13.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6123 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 569eb657724e Credits István Márton Required...

WordPress ScrollTo Top Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software ScrollTo Top Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-6320 Patch priority Medium CVSS severity Medium 9.6 Developer Claim ownership PSID 2d9ac3963025 Credits István Márton...

WordPress Chained Quiz Plugin <= 1.3.2.8 is vulnerable to Broken Access Control

Software Chained Quiz Type Plugin Vulnerable versions = 1.3.2.8 Fixed in 1.3.2.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37921 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 76baa1346d76 Credits Manab Jyoti Dowarah Required...

PT-2024-37541 · WordPress · Cg Scroll To Top

Name of the Vulnerable Software and Affected Versions: ScrollTo Top plugin for WordPress versions up to, and including, 1.2.2 Description: The issue is due to missing nonce validation and missing file type validation in the options page function, making it possible for unauthenticated attackers t...

WordPress Easy Table of Contents Plugin < 2.0.67 is vulnerable to Cross Site Scripting (XSS)

Software Easy Table of Contents Type Plugin Vulnerable versions 2.0.67 Fixed in 2.0.67.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6334 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cb1a71a30d2b Credits Dmitrii Ignatye...

WordPress DN Footer Contacts Plugin < 1.6.3 is vulnerable to Cross Site Scripting (XSS)

Software DN Footer Contacts Type Plugin Vulnerable versions 1.6.3 Fixed in 1.6.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3410 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 42414855e20a Credits Dikshita Trivedi...

WordPress Cliengo – Chatbot Plugin <= 3.0.1 is vulnerable to Broken Access Control

Software Cliengo – Chatbot Type Plugin Vulnerable versions = 3.0.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5993 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 950b128377a0 Credits Lucio Sá Required privilege...

WordPress oik Plugin <= 4.10.3 is vulnerable to Cross Site Scripting (XSS)

Software oik Type Plugin Vulnerable versions = 4.10.3 Fixed in 4.12.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6391 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2605d2118ca1 Credits Rafshanzani Suhada Required...

WordPress Generate PDF using Contact Form 7 Plugin <= 4.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Generate PDF using Contact Form 7 Type Plugin Vulnerable versions = 4.1.2 Fixed in 4.1.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37555 Patch priority Low CVSS severity Low 9.6 Developer Claim ownership PSID 2989195e2c48 Credits...

WordPress Woocommerce OpenPos Plugin <= 7.0.1 is vulnerable to Broken Access Control

Software Woocommerce OpenPos Type Plugin Vulnerable versions = 7.0.1 Fixed in 7.0.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37935 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID d6898ddc425e Credits Dave Jong Patchstack...

WordPress SociallyViral Theme <= 1.0.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software SociallyViral Type Theme Vulnerable versions = 1.0.10 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37938 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f7e692acf4dc Credits Dhabaleshwar Das Requir...