WordPress Modal Window Plugin < 5.3.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Modal Window Type Plugin Vulnerable versions 5.3.10 Fixed in 5.3.10 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3472 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9d7096a40943 Credits Bob Matyas Required...

WordPress Side Menu Lite Plugin < 4.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Side Menu Lite Type Plugin Vulnerable versions 4.2.1 Fixed in 4.2.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3476 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 570b701cebb0 Credits Bob Matyas Required...

WordPress Contact Form by WPForms Plugin <= 1.8.7.2 is vulnerable to Broken Access Control

Software Contact Form by WPForms Type Plugin Vulnerable versions = 1.8.7.2 Fixed in 1.8.8.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-3649 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f3183fdcee99 Credits Asaf Mozes Require...

WordPress Follow Us Badges Plugin <= 3.1.10 is vulnerable to Cross Site Scripting (XSS)

Software Follow Us Badges Type Plugin Vulnerable versions = 3.1.10 Fixed in 3.1.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3280 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b115b59a801a Credits Lucio Sá Required...

WordPress Popup Box Plugin < 2.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Popup Box Type Plugin Vulnerable versions 2.2.7 Fixed in 2.2.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3477 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID d1f8f6b4cec4 Credits Bob Matyas Required privileg...

WordPress Elements kit Elementor addons Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.1.2 Fixed in 3.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3650 Patch priority Low CVSS severity Low 6.5 Developer Wpmet PSID 4df1a764f7bd Credits wesley wcraft Requir...

WordPress Essential Addons for Elementor Plugin <= 5.9.17 is vulnerable to Cross Site Scripting (XSS)

Software Essential Addons for Elementor Type Plugin Vulnerable versions = 5.9.17 Fixed in 5.9.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4156 Patch priority Low CVSS severity Low 6.5 Developer WPDeveloper PSID cdf8bfb02af3 Credits wesley wcra...

WordPress Slider Revolution Plugin <= 6.7.7 is vulnerable to Cross Site Scripting (XSS)

Software Slider Revolution Type Plugin Vulnerable versions = 6.7.7 Fixed in 6.7.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4092 Patch priority Low CVSS severity Low 6.5 Developer ThemePunch PSID 82a59957f3ec Credits wesley wcraft Required...

freerdp: invalid offset validation leading to Out Of Bound Write

A flaw was found in FreeRDP. An out-of-bounds write may occur when the values rect-left and rect-top are exactly equal to surface-width and surface-height. eg. rect-left == surface-width && rect-top == surface-height. This issue can result in a crash...

kernel: drm/amd/display: populate subvp cmd info only for the top pipe

An out-of-bounds array access was found in the AMD display driver in the Linux kernel. When populating SubVP command info, the driver incorrectly processes both pipes instead of just the top pipe. This causes an out-of-bounds array access leading to a page fault and system restart when changing t...

WordPress Event Management Tickets Booking Plugin <= 1.3.4 is vulnerable to PHP Object Injection

Software Event Management Tickets Booking Type Plugin Vulnerable versions = 1.3.4 Fixed in 1.3.5 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-1895 Patch priority Medium CVSS severity Medium 7.4 Developer Claim ownership PSID d93e6770a231 Credits Francesco Carlucci...

WordPress RegistrationMagic Plugin <= 5.3.2.0 is vulnerable to Cross Site Scripting (XSS)

Software RegistrationMagic Type Plugin Vulnerable versions = 5.3.2.0 Fixed in 5.3.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33947 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3253d446e4b2 Credits Dimas Maulana Required...

WordPress Unique Theme <= 0.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Unique Type Theme Vulnerable versions = 0.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33952 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 16b24989455c Credits stealthcopter Required privilege Contributor...

WordPress ACF On-The-Go Plugin <= 1.0.1 is vulnerable to Broken Access Control

Software ACF On-The-Go Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3071 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6d532a3fc713 Credits Francesco Carlucci Required...

WordPress MailerLite – Signup forms Plugin <= 1.7.6 is vulnerable to Broken Access Control

Software MailerLite – Signup forms Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-2797 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d779eba11e1c Credits Krzysztof Zając...

WordPress Adventure Journal Theme <= 1.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Adventure Journal Type Theme Vulnerable versions = 1.7.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33953 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 85579307b5bb Credits stealthcopter Required privilege...

WordPress The Post Grid Plugin <= 7.6.1 is vulnerable to Broken Access Control

Software The Post Grid Type Plugin Vulnerable versions = 7.6.1 Fixed in 7.7.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3936 Patch priority Low CVSS severity Low 4.3 Developer Mamunur Rashid PSID ba4fe441d17b Credits Pavel Palii Required privilege...

WordPress TweetScroll Widget Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

Software TweetScroll Widget Type Plugin Vulnerable versions = 1.3.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33948 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 3dc090758c1a Credits Joshua Chan Required privilege...

WordPress Cost Calculator Builder Pro Plugin <= 3.1.67 is vulnerable to Cross Site Scripting (XSS)

Software Cost Calculator Builder Pro Type Plugin Vulnerable versions = 3.1.67 Fixed in 3.1.68 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4097 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 99ec603c6f20 Credits andrea...

WordPress Calendar Plugin <= 1.3.14 is vulnerable to SQL Injection

Software Calendar Type Plugin Vulnerable versions = 1.3.14 Fixed in 1.3.15 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-2831 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 8a403f3f03cd Credits Krzysztof Zając Required privilege Contributor Publishe...