WordPress Anonymous Restricted Content Plugin <= 1.6.2 is vulnerable to Bypass Vulnerability

Software Anonymous Restricted Content Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-0909 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 3b50fe0358a1 Credits Francesco Carlucci...

WordPress LearnDash LMS Plugin <= 4.10.1 is vulnerable to Sensitive Data Exposure

Software LearnDash LMS Type Plugin Vulnerable versions = 4.10.1 Fixed in 4.10.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-1210 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID eac39e71b914 Credits Karl Emil Nikka Required...

WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF)

Software Link Library Type Plugin Vulnerable versions = 7.5.13 Fixed in 7.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24875 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 771a2cb13065 Credits Dhabaleshwar Das Requir...

Blocking Compromised Tokens with Wallarm

In our Annual API ThreatStats report, we highlighted the increasing threat of API Leaks. An API Leak is the disclosure of sensitive API information, such as a token, credential, or private schema. These leaks can occur directly via the API itself, but also via third party tools used to manage...

WordPress WP Dummy Content Generator Plugin <= 3.1.2 is vulnerable to Broken Access Control

Software WP Dummy Content Generator Type Plugin Vulnerable versions = 3.1.2 Fixed in 3.1.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24805 Patch priority Low CVSS severity Low 4.3 Developer Deepak Anand PSID cb426eb88b79 Credits Huynh Tien Si Require...

WordPress Structured Content Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Structured Content Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24839 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 74b9c66453a9 Credits LVT-tholv2k Required privilege...

WordPress Calculated Fields Form Plugin <= 1.2.52 is vulnerable to Cross Site Scripting (XSS)

Software Calculated Fields Form Type Plugin Vulnerable versions = 1.2.52 Fixed in 1.2.53 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0963 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 51ba9c951440 Credits Richard Telleng...

WordPress Post Thumbnail Editor Plugin <= 2.4.8 is vulnerable to Sensitive Data Exposure

Software Post Thumbnail Editor Type Plugin Vulnerable versions = 2.4.8 Fixed in N/A OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-24845 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5dbd01959d8e Credits Josh...

WordPress Element Pack Elementor Addons Plugin <= 5.4.11 is vulnerable to Broken Access Control

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.4.11 Fixed in 5.4.12 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24840 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 61b5b426744b Credits Khalid Yusuf...

WordPress SP Project & Document Manager Plugin <= 4.69 is vulnerable to SQL Injection

Software SP Project & Document Manager Type Plugin Vulnerable versions = 4.69 Fixed in 4.70 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-24868 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 55e058d86d8c Credits Yudistira Arya Required privilege...

WordPress Orbit Fox by ThemeIsle Plugin <= 2.10.29 is vulnerable to Cross Site Request Forgery (CSRF)

Software Orbit Fox by ThemeIsle Type Plugin Vulnerable versions = 2.10.29 Fixed in 2.10.230 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1162 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4eb624d90158 Credits Francesc...

WordPress Quicksand Post Filter jQuery Plugin Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Quicksand Post Filter jQuery Plugin Type Plugin Vulnerable versions = 3.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24849 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4fb38b54d1c3 Credits...

WordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)

Software Biteship Type Plugin Vulnerable versions = 2.2.24 Fixed in 2.2.25 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24866 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 138291b61ab9 Credits thiennv Required privilege...

WordPress ProfilePress Plugin <= 4.14.3 is vulnerable to Cross Site Scripting (XSS)

Software ProfilePress Type Plugin Vulnerable versions = 4.14.3 Fixed in 4.14.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1046 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 32548a65a82c Credits Ngô Thiên An ancorn...

WordPress EventPrime Plugin <= 3.3.9 is vulnerable to Broken Access Control

Software EventPrime Type Plugin Vulnerable versions = 3.3.9 Fixed in 3.4.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24832 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 611d9617bb60 Credits Abdi Pranata Required privilege...

WordPress FG Joomla to WordPress Plugin <= 4.15.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software FG Joomla to WordPress Type Plugin Vulnerable versions = 4.15.0 Fixed in 4.17.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24837 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 42d5ba5b9c5a Credits Friday...

WordPress Knowledge Base for Documentation, FAQs with AI Assistance Plugin <= 11.30.2 is vulnerable to PHP Object Injection

Software Knowledge Base for Documentation, FAQs with AI Assistance Type Plugin Vulnerable versions = 11.30.2 Fixed in 11.31.0 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-24842 Patch priority High CVSS severity High 8.7 Developer Claim ownership PSID 6e74033eecde...

WordPress Premium Addons for Elementor Plugin <= 4.10.16 is vulnerable to Cross Site Scripting (XSS)

Software Premium Addons for Elementor Type Plugin Vulnerable versions = 4.10.16 Fixed in 4.10.17 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24831 Patch priority Low CVSS severity Low 6.5 Developer LeapWorx PSID 69f3ad862bdd Credits Khalid Yusuf Required...

WordPress WP Visitor Statistics (Real Time Traffic) Plugin <= 6.9.4 is vulnerable to Sensitive Data Exposure

Software WP Visitor Statistics Real Time Traffic Type Plugin Vulnerable versions = 6.9.4 Fixed in 6.9.5 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-24867 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID...

WordPress Five Star Restaurant Reviews Plugin <= 2.3.5 is vulnerable to Cross Site Scripting (XSS)

Software Five Star Restaurant Reviews Type Plugin Vulnerable versions = 2.3.5 Fixed in 2.3.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24838 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 99e84e82442f Credits Steven Julian Required...