WordPress Penci Soledad Data Migrator Plugin <= 1.3.0 is vulnerable to Local File Inclusion

Software Penci Soledad Data Migrator Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3551 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 00732af89875 Credits M.Awad Required privilege...

WordPress Post Grid Elementor Addon Plugin <= 2.0.16 is vulnerable to Cross Site Scripting (XSS)

Software Post Grid Elementor Addon Type Plugin Vulnerable versions = 2.0.16 Fixed in 2.0.17 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34789 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a126fad23f02 Credits 4rCanJ0x! Required privile...

WordPress ShopLentor Plugin <= 2.8.7 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34767 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 98f1de88eaf5 Credits Ngô Thiên An ancorn from VNPT-VCI Required...

WordPress Rank Math SEO Plugin <= 1.0.218 is vulnerable to Cross Site Scripting (XSS)

Software Rank Math SEO Type Plugin Vulnerable versions = 1.0.218 Fixed in 1.0.219-beta OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4617 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e1bcca408b13 Credits Ngô Thiên An anco...

WordPress Tutor LMS Pro Plugin <= 2.7.0 is vulnerable to Broken Access Control

Software Tutor LMS Pro Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-4352 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 7694afbc9e58 Credits villu164 Required privilege...

WordPress Tutor LMS Plugin <= 2.7.0 is vulnerable to Insecure Direct Object References (IDOR)

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-4279 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID b3b3270c166a Credits Thanh Nam Tran...

WordPress Tutor LMS Plugin <= 2.7.0 is vulnerable to Broken Access Control

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4223 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 86348e33f1ae Credits villu164 Required privilege...

WordPress Tutor LMS Pro Plugin <= 2.7.0 is vulnerable to Broken Access Control

Software Tutor LMS Pro Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4222 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 2853424c7113 Credits villu164 Required privilege...

WordPress Tutor LMS Plugin <= 2.7.0 is vulnerable to SQL Injection

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-4318 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 529631119255 Credits Thanh Nam Tran Required privilege Instructor Published 1...

WordPress Custom Post Type Attachment Plugin <= 3.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Custom Post Type Attachment Type Plugin Vulnerable versions = 3.4.5 Fixed in 3.4.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4546 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3e22d0f6f243 Credits Francesco...

WordPress Tutor LMS Pro Plugin <= 2.7.0 is vulnerable to Privilege Escalation

Software Tutor LMS Pro Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-4351 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID fc3d215c9303 Credits villu164...

WordPress ReviewX Plugin <= 1.6.27 is vulnerable to Broken Access Control

Software ReviewX Type Plugin Vulnerable versions = 1.6.27 Fixed in 1.6.28 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3609 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ba8ab4855491 Credits Lucio Sá Required privilege Subscrib...

WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.57 is vulnerable to PHP Object Injection

Software ShiftController Employee Shift Scheduling Type Plugin Vulnerable versions = 4.9.57 Fixed in 4.9.58 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-4733 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID c137dcbad43b Credits Peter...

WordPress All-in-One Video Gallery Plugin <= 3.6.5 is vulnerable to Local File Inclusion

Software All-in-One Video Gallery Type Plugin Vulnerable versions = 3.6.5 Fixed in 3.7.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-4670 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 402ad478bb5f Credits Ngô Thiên An ancorn Required...

WordPress LetterPress Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software LetterPress Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3590 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6967a7d78047 Credits SANU P.L Required privileg...

WordPress HL Twitter Plugin <= 2014.1.18 is vulnerable to Cross Site Request Forgery (CSRF)

Software HL Twitter Type Plugin Vulnerable versions = 2014.1.18 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3629 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 106b877d04b5 Credits Bob Matyas Required...

WordPress Advanced Custom Fields PRO Plugin < 6.2.10 is vulnerable to Local File Inclusion

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 6.2.10 Fixed in 6.2.10 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-34762 Patch priority Low CVSS severity Low 9.9 Developer Claim ownership PSID c63a5562f29a Credits Security audit Required privile...

WordPress SP Project & Document Manager Plugin <= 4.71 is vulnerable to Insecure Direct Object References (IDOR)

Software SP Project & Document Manager Type Plugin Vulnerable versions = 4.71 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-3748 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 1c7d92437a35 Credits...

WordPress Mega Elements Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Mega Elements Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4702 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ecd07d502745 Credits stealthcopter Required...

WordPress Exclusive Addons Elementor Plugin <= 2.6.9.6 is vulnerable to Cross Site Scripting (XSS)

Software Exclusive Addons Elementor Type Plugin Vulnerable versions = 2.6.9.6 Fixed in 2.6.9.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4618 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3341f0baa50a Credits wesley...