WordPress MailMunch – Grow your Email List Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)

Software MailMunch – Grow your Email List Type Plugin Vulnerable versions = 3.1.6 Fixed in 3.1.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31349 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7297ea028cbf Credits Ray Wilson Required...

WordPress Smart Online Order for Clover Plugin <= 1.5.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Smart Online Order for Clover Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31238 Patch priority Low CVSS severity Low 5.4 Developer Zaytech PSID dad95ce21a7d Credits thiennv...

WordPress WordPress Gallery Exporter Plugin <= 1.3 is vulnerable to Arbitrary File Download

Software WordPress Gallery Exporter Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-31342 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6307ae9c3c1f Credits Abdi Prawira Negara...

WordPress Profile Builder Plugin <= 3.11.2 is vulnerable to Bypass Vulnerability

Software Profile Builder Type Plugin Vulnerable versions = 3.11.2 Fixed in 3.11.3 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-31341 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b21686841f84 Credits Ananda Dhakal Patchstack...

WordPress Wholesale For WooCommerce Plugin <= 2.3.0 is vulnerable to Arbitrary Content Deletion

Software Wholesale For WooCommerce Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2024-31297 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID f0f4371cb999 Credits Dave Jong...

WordPress Easy Digital Downloads Plugin <= 3.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.6 Fixed in 3.2.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31293 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 89807a8f40a1 Credits Dhabaleshwar...

WordPress FG Drupal to WordPress Plugin <= 3.70.3 is vulnerable to Sensitive Data Exposure

Software FG Drupal to WordPress Type Plugin Vulnerable versions = 3.70.3 Fixed in 3.71.0 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-31247 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 3795aae4239d Credits...

WordPress Classified Listing Plugin <= 3.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Classified Listing Type Plugin Vulnerable versions = 3.0.4 Fixed in 3.0.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1315 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 27f9fddfe733 Credits Francesco Carlucc...

WordPress Passster – Password Protection Plugin <= 4.2.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Passster – Password Protection Type Plugin Vulnerable versions = 4.2.6.4 Fixed in 4.2.6.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2026 Patch priority Low CVSS severity Low 6.5 Developer Patrick Posner PSID e14038938ff1 Credits...

WordPress Relevanssi Plugin <= 4.22.1 is vulnerable to Broken Access Control

Software Relevanssi Type Plugin Vulnerable versions = 4.22.1 Fixed in 4.22.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3213 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8c3f0b93ac8a Credits Thura Moe Myint mgthuramoemyint...

WordPress WP Directory Kit Plugin <= 1.3.0 is vulnerable to SQL Injection

Software WP Directory Kit Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3217 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 19868a4ed5a4 Credits Lucio Sá Required privilege Subscriber Publishe...

WordPress ARForms Form Builder Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software ARForms Form Builder Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31272 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 5543120d9779 Credits Yudistira Arya...

WordPress Church Admin Plugin <= 4.1.6 is vulnerable to Broken Access Control

Software Church Admin Type Plugin Vulnerable versions = 4.1.6 Fixed in 4.1.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31281 Patch priority Medium CVSS severity Medium 6.3 Developer Andy Moyle PSID 45a702e240da Credits Peng Zhou Required privilege...

WordPress File Manager Plugin <= 7.2.5 is vulnerable to Path Traversal

Software File Manager Type Plugin Vulnerable versions = 7.2.5 Fixed in 7.2.6 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-2654 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 1c905e547371 Credits DarkT Required privilege Administrator...

WordPress TaxoPress Plugin <= 3.12.0 is vulnerable to Cross Site Scripting (XSS)

Software TaxoPress Type Plugin Vulnerable versions = 3.12.0 Fixed in 3.20.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2830 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 812b03b02ecc Credits stealthcopter Required...

WordPress Spectra Plugin <= 2.10.3 is vulnerable to Cross Site Scripting (XSS)

Software Spectra Type Plugin Vulnerable versions = 2.10.3 Fixed in 2.10.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6486 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2ec9e8bd69ac Credits Akbar Kustirama Required...

WordPress ShopLentor Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.3 Fixed in 2.8.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2868 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1cdf46cdcf3 Credits wesley wcraft Required...

WordPress Easy Digital Downloads Plugin <= 3.2.9 is vulnerable to Sensitive Data Exposure

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.9 Fixed in 3.2.10 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2302 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4b720db13b09 Credits Colin Xu Required...

WordPress CMB2 Plugin <= 2.10.1 is vulnerable to PHP Object Injection

Software CMB2 Type Plugin Vulnerable versions = 2.10.1 Fixed in 2.11.0 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-1792 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID dc0ad3e4851e Credits Francesco Carlucci Required privilege Contributor...

WordPress BookingPress Plugin <= 1.0.87 is vulnerable to Arbitrary File Upload

Software BookingPress Type Plugin Vulnerable versions = 1.0.87 Fixed in 1.0.88 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-3022 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 95c9a0019f7e Credits Dian Sun Required privilege Administrator...