WordPress Newsletter - API addon (Premium) Plugin <= 2.4.5 is vulnerable to Broken Access Control

Software Newsletter - API addon Premium Type Plugin Vulnerable versions = 2.4.5 Fixed in 2.4.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5674 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID f2621f00fec2 Credits Arkadiusz...

Top 10 Critical Pentest Findings 2024: What You Need to Know

One of the most effective ways for information technology IT professionals to uncover a company's weaknesses before the bad guys do is penetration testing. By simulating real-world cyberattacks, penetration testing, sometimes called pentests, provides invaluable insights into an organization's...

WordPress ShopLentor Plugin <= 2.9.0 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.9.0 Fixed in 2.9.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5530 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7f83560dcee5 Credits wesley wcraft Required...

WordPress Ocean Extra Plugin <= 2.2.8 is vulnerable to Cross Site Scripting (XSS)

Software Ocean Extra Type Plugin Vulnerable versions = 2.2.8 Fixed in 2.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5531 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3783e8eb79e7 Credits wesley wcraft Required...

WordPress Metform Elementor Contact Form Builder Plugin <= 3.8.8 is vulnerable to Sensitive Data Exposure

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.8.8 Fixed in 3.8.9 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-4266 Patch priority Low CVSS severity Low 5.3 Developer Wpmet PSID f8748d7d1a5f Credits Tim Coen...

WordPress DiviTorque – Divi Theme, Divi Builder and Extra Theme Plugin <= 3.6.6 is vulnerable to Cross Site Scripting (XSS)

Software DiviTorque – Divi Theme, Divi Builder and Extra Theme Type Plugin Vulnerable versions = 3.6.6 Fixed in 4.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5892 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...

WordPress Left right image slideshow gallery Plugin <= 1.8.1 is vulnerable to SQL Injection

Software Left right image slideshow gallery Type Plugin Vulnerable versions = 1.8.1 Fixed in 1.8.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-5543 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 26f19037ceb8 Credits Krzysztof Zając Required...

WordPress Bookly Plugin <= 23.2 is vulnerable to Cross Site Scripting (XSS)

Software Bookly Type Plugin Vulnerable versions = 23.2 Fixed in 23.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5584 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6392bd62a07f Credits 0xBishop Required privilege...

WordPress Activity Reactions For Buddypress Plugin <= 12.5.0 is vulnerable to Cross Site Scripting (XSS)

Software Activity Reactions For Buddypress Type Plugin Vulnerable versions = 12.5.0 Fixed in 12.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4892 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0a3e1e0166ec Credit...

WordPress Premium Addons for Elementor Plugin <= 4.10.33 is vulnerable to Cross Site Scripting (XSS)

Software Premium Addons for Elementor Type Plugin Vulnerable versions = 4.10.33 Fixed in 4.10.34 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5553 Patch priority Low CVSS severity Low 6.5 Developer LeapWorx PSID 89dccdfaef3d Credits wesley wcraft...

WordPress Custom Field Template Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom Field Template Type Plugin Vulnerable versions = 2.6.1 Fixed in 2.6.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0627 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79102f5cc8d6 Credits Luk 6785 Required...

WordPress SiteOrigin Widgets Bundle Plugin <= 1.61.1 is vulnerable to Cross Site Scripting (XSS)

Software SiteOrigin Widgets Bundle Type Plugin Vulnerable versions = 1.61.1 Fixed in 1.62.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5090 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e67670e2ff92 Credits Ngô Thiên An...

WordPress Custom Field Template Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom Field Template Type Plugin Vulnerable versions = 2.6.1 Fixed in 2.6.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-0653 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID fe4e0cf2229e Credits Sh Required privilege Administrat...

WordPress Quiz And Survey Master Plugin <= 9.0.1 is vulnerable to SQL Injection

Software Quiz And Survey Master Type Plugin Vulnerable versions = 9.0.1 Fixed in 9.0.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3592 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 26d19aa78d42 Credits Lucio Sá Required privilege Contributor...

WordPress Tutor LMS Plugin <= 2.7.1 is vulnerable to Insecure Direct Object References (IDOR)

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-5438 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 04944e6bcf56 Credits Thanh Nam Tran...

WordPress Music Store Plugin <= 1.1.13 is vulnerable to SQL Injection

Software Music Store Type Plugin Vulnerable versions = 1.1.13 Fixed in 1.1.14 OWASP Top 10 A3: Injection Classification SQL Injection CVE N/A Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 3ee22c619ee0 Credits Noriko Totsuka JPCERT/CC Required privilege Unauthenticated...

WordPress Photo Gallery by 10Web Plugin <= 1.8.23 is vulnerable to Cross Site Scripting (XSS)

Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.23 Fixed in 1.8.24 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5426 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5c5bb3f62973 Credits Tobias Weißhaar...

WordPress Market Exporter Plugin <= 2.0.19 is vulnerable to Arbitrary File Deletion

Software Market Exporter Type Plugin Vulnerable versions = 2.0.19 Fixed in 2.0.20 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-5637 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID c9e019d8b649 Credits Lucio Sá Required...

WordPress SKT Addons for Elementor Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software SKT Addons for Elementor Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5091 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 81d64b5eccce Credits stealthcopter...

WordPress ARForms Plugin < 6.6 is vulnerable to Cross Site Scripting (XSS)

Software ARForms Type Plugin Vulnerable versions 6.6 Fixed in 6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4621 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 54c970f6100c Credits Bob Matyas Required privilege...