WordPress Panda Video Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)

Software Panda Video Type Plugin Vulnerable versions = 1.4.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5457 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c11128533b22 Credits stealthcopter Required privile...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.112 is vulnerable to Cross Site Scripting (XSS)

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.112 Fixed in 1.5.113 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6169 Patch priority Low CVSS severity Low 6.5 Developer Unlimited...

WordPress Product Designer Plugin <= 1.0.33 is vulnerable to Broken Access Control

Software Product Designer Type Plugin Vulnerable versions = 1.0.33 Fixed in 1.0.34 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3608 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7913547b43c1 Credits Lucio Sá Required privilege...

CVE-2024-6320: Cross-Site Request Forgery (CSRF)

The ScrollTo Top plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.2.2. This is due to missing nonce validation and missing file type validation in the 'optionspage' function. This makes it possible for unauthenticated...

WordPress Houzez CRM Plugin <= 1.4.2 is vulnerable to SQL Injection

Software Houzez CRM Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-5792 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 666665555649 Credits István Márton Required privilege Seller Published 9 Jul...

WordPress Jobmonster Theme <= 4.7.4 is vulnerable to Privilege Escalation

Software Jobmonster Type Theme Vulnerable versions = 4.7.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-37927 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 2a728f531379 Credits Dave Jong Patchstack Required...

WordPress PayPlus Payment Gateway Plugin <= 7.0.7 is vulnerable to SQL Injection

Software PayPlus Payment Gateway Type Plugin Vulnerable versions = 7.0.7 Fixed in 7.0.8 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-37564 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 282d31811f37 Credits LVT-tholv2k Required privilege Subscrib...

WordPress Comment Images Reloaded Plugin <= 2.2.1 is vulnerable to Broken Access Control

Software Comment Images Reloaded Type Plugin Vulnerable versions = 2.2.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-5856 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID a3534aef50ef Credits Lucio Sá Required...

WordPress Just Custom Fields Plugin <= 3.3.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Just Custom Fields Type Plugin Vulnerable versions = 3.3.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-6168 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9fc0b88e6af6 Credits Francesco Carlucci...

CVE-2024-40600

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40605

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40599: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40602: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40605: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

WordPress Save as PDF plugin by Pdfcrowd Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Save as PDF plugin by Pdfcrowd Type Plugin Vulnerable versions = 4.0.0 Fixed in 4.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37549 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5b92af9f47f3 Credits Cronus Required privile...

PT-2024-28935

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.42.1 Description An issue was discovered in the GuMaxDD skin for MediaWiki. There is stored XSS via MediaWiki:Sidebar top-level menu entries. Recommendations For versions through 1.42.1, consider disabling the...

WordPress Leaky Paywall Plugin <= 4.21.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Leaky Paywall Type Plugin Vulnerable versions = 4.21.2 Fixed in 4.21.3 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-37540 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6553531150a7 Credits Ananda Dhakal Patchstack...

CVE-2024-40602

An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

WordPress WPFavicon Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WPFavicon Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Request Forgery CSRF CVE CVE-2024-37558 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f7589e2e3c1a Credits Cronus Required privilege Administrator...

PT-2024-28938

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.42.1 Description An issue was discovered in the Tempo skin for MediaWiki. There is stored XSS via MediaWiki:Sidebar top-level menu entries. Recommendations For versions through 1.42.1, consider disabling the Tempo...