WordPress Page Restriction WordPress (WP) Plugin <= 1.3.4 is vulnerable to Bypass Vulnerability

Software Page Restriction WordPress WP Type Plugin Vulnerable versions = 1.3.4 Fixed in 1.3.5 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-0681 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID cfef51f8afd9 Credits Francesco Carlucci...

WordPress Yuki Theme <= 1.3.14 is vulnerable to Cross Site Request Forgery (CSRF)

Software Yuki Type Theme Vulnerable versions = 1.3.14 Fixed in 1.3.15 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1943 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d0c2045710bf Credits Lucio Sá Required privilege...

WordPress Oliver POS Plugin <= 2.4.1.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Oliver POS Type Plugin Vulnerable versions = 2.4.1.8 Fixed in 2.4.1.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1954 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 749d54aee74a Credits Francesco Carlucci...

WordPress Download Manager Plugin <= 3.2.84 is vulnerable to Broken Access Control

Software Download Manager Type Plugin Vulnerable versions = 3.2.84 Fixed in 3.2.85 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6785 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 049e661b5aa7 Credits wesley wcraft Required...

WordPress MainWP Plugin <= 4.6.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software MainWP Type Plugin Vulnerable versions = 4.6.0.1 Fixed in 5.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1642 Patch priority Low CVSS severity Low 4.3 Developer MainWP PSID 4e2dc997b3cf Credits Krzysztof Zając Required privilege...

WordPress Chat Bubble Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Chat Bubble Type Plugin Vulnerable versions = 2.3 Fixed in 2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0898 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 32320d8c2073 Credits Dipak Panchal th3.d1p4k Required...

WordPress Envo's Elementor Templates & Widgets for WooCommerce Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Envo's Elementor Templates & Widgets for WooCommerce Type Plugin Vulnerable versions = 1.4.4 Fixed in 1.4.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0768 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress CodeMirror Blocks Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software CodeMirror Blocks Type Plugin Vulnerable versions = 1.2.4 Fixed in 2.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1791 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8f146af67463 Credits RandomRoot Required...

WordPress LifterLMS Plugin <= 7.5.1 is vulnerable to Broken Access Control

Software LifterLMS Type Plugin Vulnerable versions = 7.5.1 Fixed in 7.5.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0377 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 017a17d1f987 Credits Francesco Carlucci Required privileg...

WordPress JobSearch Plugin < 2.3.4 is vulnerable to Broken Authentication

Software JobSearch Type Plugin Vulnerable versions 2.3.4 Fixed in 2.3.4 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2023-6584 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID f4a18b4236e5 Credits Marc Montpas...

WordPress JobSearch Plugin < 2.3.4 is vulnerable to Remote Code Execution (RCE)

Software JobSearch Type Plugin Vulnerable versions 2.3.4 Fixed in 2.3.4 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-6585 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 637575b94b70 Credits Furkan Gedik Required privilege Published 27...

WordPress PageLayer Plugin < 1.8.1 is vulnerable to Cross Site Scripting (XSS)

Software PageLayer Type Plugin Vulnerable versions 1.8.1 Fixed in 1.8.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7115 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e7001c2ee296 Credits websafe2021 Required privilege...

WordPress Smart Forms Plugin < 2.6.87 is vulnerable to Broken Access Control

Software Smart Forms Type Plugin Vulnerable versions 2.6.87 Fixed in 2.6.87 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-7203 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 959e4abbd849 Credits Mohammad Reza Omrani Require...

Three Tips to Protect Your Secrets from AI Accidents

Last year, the Open Worldwide Application Security Project OWASP published multiple versions of the "OWASP Top 10 For Large Language Models," reaching a 1.0 document in August and a 1.1 document in October. These documents not only demonstrate the rapidly evolving nature of Large Language Models,...

WordPress Duitku Payment Gateway Plugin <= 2.11.6 is vulnerable to Broken Access Control

Software Duitku Payment Gateway Type Plugin Vulnerable versions = 2.11.6 Fixed in 2.11.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0631 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 48de9cbc8e6d Credits Francesco Carlucci...

WordPress Brizy Plugin <= 2.4.40 is vulnerable to Directory Traversal

Software Brizy Type Plugin Vulnerable versions = 2.4.40 Fixed in 2.4.41 OWASP Top 10 A1: Broken Access Control Classification Directory Traversal CVE CVE-2024-1165 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d07c7816cd90 Credits wesley wcraft Required privilege...

WordPress WordPress Comments Fields Plugin <= 5.0 is vulnerable to Broken Access Control

Software WordPress Comments Fields Type Plugin Vulnerable versions = 5.0 Fixed in 5.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0829 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID cdb4c1c8e480 Credits Francesco Carlucci...

WordPress BeePress Plugin <= 6.9.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software BeePress Type Plugin Vulnerable versions = 6.9.8 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-27197 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 23f23a1e9a56 Credits Majed Refaea Required...

WordPress WordPress Comments Fields Plugin <= 5.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software WordPress Comments Fields Type Plugin Vulnerable versions = 5.0 Fixed in 5.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0830 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9c14d6f7a75c Credits Francesco...

WordPress WP Event Manager Plugin <= 3.1.41 is vulnerable to Cross Site Scripting (XSS)

Software WP Event Manager Type Plugin Vulnerable versions = 3.1.41 Fixed in 3.1.42 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0976 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 31df306c3173 Credits Maksim Kosenko...