WordPress WPvivid Backup and Migration Plugin <= 0.9.68 is vulnerable to Broken Access Control

Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.68 Fixed in 0.9.69 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1982 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79947c67cdef Credits Denis Werner...

WordPress Revolut Gateway for WooCommerce Plugin <= 4.9.7 is vulnerable to Broken Access Control

Software Revolut Gateway for WooCommerce Type Plugin Vulnerable versions = 4.9.7 Fixed in 4.9.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52224 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 56db209d55d0 Credits Abdi Pranata...

WordPress Contact Form 7 Extension For Mailchimp Plugin <= 0.5.70 is vulnerable to Server Side Request Forgery (SSRF)

Software Contact Form 7 Extension For Mailchimp Type Plugin Vulnerable versions = 0.5.70 Fixed in N/A OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-22134 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID...

WordPress Profile Builder Plugin <= 3.10.7 is vulnerable to Insecure Direct Object References (IDOR)

Software Profile Builder Type Plugin Vulnerable versions = 3.10.7 Fixed in 3.10.8 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-6504 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4a72357868f4 Credits Francesco...

Service owners can accrue OLAS top-ups even when donating to their own services

Lines of code Vulnerability details Impact The basis of this exploit is the ability for a topUpEligible service owner — any registrant of a service who also stakes enough OLAS in the voting escrow contract — to accrue OLAS top-ups even when they donate to services that they own themselves. As lon...

WordPress Metform Elementor Contact Form Builder Plugin <= 3.8.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.8.1 Fixed in 3.8.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6788 Patch priority Low CVSS severity Low 5.4 Developer Wpmet PSID f512d659309a Credits Lucio S...

WordPress GD Rating System Plugin <= 3.5.0 is vulnerable to Cross Site Scripting (XSS)

Software GD Rating System Type Plugin Vulnerable versions = 3.5.0 Fixed in 3.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 343cc2dced19 Credits WordFence Required privileg...

CVE-2023-34322 top-level shadow reference dropped too early for 64-bit PV guests

For migration as well as to work around kernels unaware of L1TF see XSA-273, PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on th...

WordPress Quiz Maker Plugin <= 6.5.1.1 is vulnerable to Broken Access Control

Software Quiz Maker Type Plugin Vulnerable versions = 6.5.1.1 Fixed in 6.5.1.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-21743 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a1ecb2fb052d Credits Abdi Pranata Required...

WordPress Site Notes Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Site Notes Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6633 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 772e7c731cdb Credits Pedro Cuco Illex Required...

WordPress Weaver Xtreme Theme <= 6.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Weaver Xtreme Type Theme Vulnerable versions = 6.3.0 Fixed in 6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6990 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5fb809beeb50 Credits Francesco Carlucci Required...

WordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object Injection

Software WooCommerce Tranzila Gateway Type Plugin Vulnerable versions = 1.0.8 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-52218 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 69111059637e Credits Rafie Muhammad Patchstack...

WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection

Software WP ERP Type Plugin Vulnerable versions = 1.12.8 Fixed in 1.12.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-21747 Patch priority Medium CVSS severity Medium 7.6 Developer Claim ownership PSID bff329846441 Credits Arvandy Required privilege Accounting Manager...

WordPress Icegram Plugin <= 3.1.21 is vulnerable to Broken Access Control

Software Icegram Type Plugin Vulnerable versions = 3.1.21 Fixed in 3.1.22 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-21748 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 81671ed8c65a Credits Huynh Tien Si Required privilege...

WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Type Plugin Vulnerable versions = 8.2.2 Fixed in 8.3.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-52222 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 176f4af4b60c Credits Rafie Muhammad Patchsta...

WordPress My Sticky Bar Plugin <= 2.6.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software My Sticky Bar Type Plugin Vulnerable versions = 2.6.6 Fixed in 2.6.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-7048 Patch priority Low CVSS severity Low 3.1 Developer Claim ownership PSID 50c4e2183073 Credits Ulyses Saicha Required...

WordPress Depicter Slider Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Depicter Slider Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6493 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 15e2f683e7f4 Credits Rafshanzani Suhada...

WordPress Post SMTP Plugin <= 2.8.7 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7027 Patch priority Medium CVSS severity Medium 7.1 Developer WPExperts PSID 7142ca21bf69 Credits Sean Murphy Required privilege...

WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.15.2 is vulnerable to Cross Site Scripting (XSS)

Software 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Type Plugin Vulnerable versions = 1.15.2 Fixed in 1.15.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6776 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...

WordPress WP SMS Plugin <= 6.5 is vulnerable to SQL Injection

Software WP SMS Type Plugin Vulnerable versions = 6.5 Fixed in 6.5.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-6981 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 0cdcc4de6b6a Credits Krzysztof Zając Required privilege Administrator Published 3...