WordPress ImageRecycle pdf & image compression Plugin <= 3.1.13 is vulnerable to Broken Access Control

Software ImageRecycle pdf & image compression Type Plugin Vulnerable versions = 3.1.13 Fixed in 3.1.14 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0984 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 35a4c2f10086 Credits Frances...

WordPress ImageRecycle pdf & image compression Plugin <= 3.1.13 is vulnerable to Cross Site Request Forgery (CSRF)

Software ImageRecycle pdf & image compression Type Plugin Vulnerable versions = 3.1.13 Fixed in 3.1.14 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1339 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d8c1f1233fec Credi...

WordPress Insert PHP Code Snippet Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Insert PHP Code Snippet Type Plugin Vulnerable versions = 1.3.4 Fixed in 1.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0658 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID af77943c0a22 Credits Felipe Restrepo...

WordPress Eventin Plugin <= 3.3.50 is vulnerable to Broken Access Control

Software Eventin Type Plugin Vulnerable versions = 3.3.50 Fixed in 3.3.51 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1122 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a2c7fec8c772 Credits Francesco Carlucci Required privileg...

WordPress MoveTo Plugin <= 6.2 is vulnerable to Denial of Service Attack

Software MoveTo Type Plugin Vulnerable versions = 6.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Denial of Service Attack CVE CVE-2024-25911 Patch priority Medium CVSS severity Medium 8.6 Developer Claim ownership PSID fbded13be6d8 Credits Dave Jong Patchstack Required...

WordPress SMTP Mail Plugin <= 1.3.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software SMTP Mail Type Plugin Vulnerable versions = 1.3.20 Fixed in 1.3.21 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-25914 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8c89b8d2051d Credits Abdi Pranata Required...

WordPress PB oEmbed HTML5 Audio Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)

Software PB oEmbed HTML5 Audio Type Plugin Vulnerable versions = 2.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-25098 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fd60f7f1dbad Credits Ngô Thiên An ancorn from VNPT-VCI...

WordPress ImageRecycle pdf & image compression Plugin <= 3.1.13 is vulnerable to Cross Site Request Forgery (CSRF)

Software ImageRecycle pdf & image compression Type Plugin Vulnerable versions = 3.1.13 Fixed in 3.1.14 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1336 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a40a0d1defb3 Credi...

WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload

Software WP Media folder Type Plugin Vulnerable versions = 5.7.2 Fixed in 5.7.3 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-25909 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID e05dfe398169 Credits Dave Jong Patchstack Required privilege...

WordPress Paytium Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Paytium Type Plugin Vulnerable versions = 4.4.2 Fixed in 4.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-25099 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5a3bcaaed120 Credits Ngô Thiên An ancorn from VNPT-VCI Required...

WordPress WP Editor Plugin <= 1.2.7 is vulnerable to Sensitive Data Exposure

Software WP Editor Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-25591 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 005894aaae3d Credits Joshua Chan...

top-fete.com Cross Site Scripting vulnerability OBB-3851570

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Ransomware in 2023 recap: 5 key takeaways

This article is based on research by Marcelo Rivero, Malwarebytes’ ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, “known attacks” are those where the victim did not pay a ransom. This provides the best overall picture of...

WordPress VK Poster Group Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software VK Poster Group Type Plugin Vulnerable versions = 2.0.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-24932 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1880d39de9c0 Credits Le Ngoc Anh Require...

WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection

Software Brooklyn Type Theme Vulnerable versions = 4.9.7.6 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-24926 Patch priority Medium CVSS severity Medium 7.5 Developer Claim ownership PSID 088c56b0b572 Credits Rafie Muhammad Patchstack Required privilege...

WordPress Matomo Analytics Plugin <= 4.15.3 is vulnerable to Cross Site Scripting (XSS)

Software Matomo Analytics Type Plugin Vulnerable versions = 4.15.3 Fixed in 5.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6923 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d69c8015e6ca Credits Felipe Restrepo...

WordPress Royal Elementor Addons Plugin < 1.3.81 is vulnerable to Broken Access Control

Software Royal Elementor Addons Type Plugin Vulnerable versions 1.3.81 Fixed in 1.3.81 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5922 Patch priority Low CVSS severity Low 5.3 Developer WProyal PSID 2215bda637be Credits Krzysztof Zając CERT PL Require...

WordPress Shortcodes Ultimate Plugin <= 7.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Shortcodes Ultimate Type Plugin Vulnerable versions = 7.0.1 Fixed in 7.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0792 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 60b85feef073 Credits Webbernaut Required...

WordPress Livemesh Addons for Elementor Plugin <= 8.3.2 is vulnerable to Cross Site Scripting (XSS)

Software Livemesh Addons for Elementor Type Plugin Vulnerable versions = 8.3.2 Fixed in 8.3.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1235 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ab5cdd31d383 Credits Webbernaut...

WordPress WP Recipe Maker Plugin <= 9.1.2 is vulnerable to Broken Access Control

Software WP Recipe Maker Type Plugin Vulnerable versions = 9.1.2 Fixed in 9.2.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1206 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 59c6b1fa45e4 Credits Lucio Sá Required privilege...