WordPress Comments Ratings Plugin <= 1.1.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Comments Ratings Type Plugin Vulnerable versions = 1.1.7 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45654 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3bde0ca43cfe Credits Mika Required...

WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Responsive Image Gallery, Gallery Album Type Plugin Vulnerable versions = 2.0.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45629 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID c264401c72ac Credi...

WordPress Campaign Monitor Forms Plugin < 2.5.6 is vulnerable to Broken Access Control

Software Campaign Monitor Forms Type Plugin Vulnerable versions 2.5.6 Fixed in 2.5.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-5098 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 224fc6fd923e Credits Francesco Marano...

WordPress Appointment Hour Booking Plugin <= 1.4.23 is vulnerable to Broken Access Control

Software Appointment Hour Booking Type Plugin Vulnerable versions = 1.4.23 Fixed in 1.4.24 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-45649 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ded4fde40f34 Credits konagash Required...

WordPress Get Custom Field Values Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Get Custom Field Values Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-45604 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8b0df9061359 Credits Satoo Nakano Required privilege...

WordPress Fattura24 Plugin < 6.2.8 is vulnerable to Cross Site Scripting (XSS)

Software Fattura24 Type Plugin Vulnerable versions 6.2.8 Fixed in 6.2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5211 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0ad9cd39b4a8 Credits Enrico Marcolini Claudio...

WordPress WPLegalPages Plugin <= 2.9.2 is vulnerable to Cross Site Scripting (XSS)

Software WPLegalPages Type Plugin Vulnerable versions = 2.9.2 Fixed in 2.9.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4968 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1998bb8e2095 Credits Lana Codes Required privile...

WordPress Tweeple Plugin <= 0.9.5 is vulnerable to Cross Site Scripting (XSS)

Software Tweeple Type Plugin Vulnerable versions = 0.9.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30781 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e25e53d003bc Credits Elliot Required privilege...

WordPress EventPrime Plugin <= 3.1.5 is vulnerable to Cross Site Scripting (XSS)

Software EventPrime Type Plugin Vulnerable versions = 3.1.5 Fixed in 3.1.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-45637 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 7c19ecb3f3a7 Credits Phd Required privilege Unauthenticated...

WordPress Responsive Tabs Plugin < 4.0.6 is vulnerable to Content Injection

Software Responsive Tabs Type Plugin Vulnerable versions 4.0.6 Fixed in 4.0.6 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2023-45635 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bf3a377a744c Credits Abdi Pranata Required privilege Contributor...

WordPress User Submitted Posts Plugin <= 20230902 is vulnerable to Arbitrary File Upload

Software User Submitted Posts Type Plugin Vulnerable versions = 20230902 Fixed in 20230914 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-45603 Patch priority High CVSS severity High 9 Developer Claim ownership PSID b7d676bf7c95 Credits Rafie Muhammad Patchstack...

WordPress Ebook Store Plugin <= 5.8002 is vulnerable to Cross Site Scripting (XSS)

Software Ebook Store Type Plugin Vulnerable versions = 5.8002 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-45602 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 98c678ae3282 Credits Le Ngoc Anh Required...

2023 OWASP Top-10 Series: Spotlight on Injection

Welcome to the 12th post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. In this series we are taking an in-depth look at each category – the details, the impact and what you can do about it. To see previous posts you might...

top-records.at Cross Site Scripting vulnerability OBB-3724999

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Mailrelay Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Mailrelay Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45108 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 19213d6f5e3d Credits Mika Required privilege...

WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 2.7.8 is vulnerable to Broken Access Control

Software ProductX – Gutenberg WooCommerce Blocks Type Plugin Vulnerable versions = 2.7.8 Fixed in 3.0.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-45271 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ca21a9a7374c Credits Abdi...

WordPress Blog Manager Light Plugin <= 1.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software Blog Manager Light Type Plugin Vulnerable versions = 1.20 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45102 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID e898fef1cf21 Credits Mika Required...

WordPress Hotjar Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

Software Hotjar Type Plugin Vulnerable versions = 1.0.15 Fixed in 1.0.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1259 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e7f6eb874af7 Credits Marco Wotschka Required privile...

WordPress affiliate-toolkit Plugin <= 3.3.9 is vulnerable to Open Redirection

Software affiliate-toolkit Type Plugin Vulnerable versions = 3.3.9 Fixed in 3.4.0 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2023-45105 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID c91af7e93b47 Credits minhtuanact Required privilege Unauthenticat...

WordPress Urvanov Syntax Highlighter Plugin <= 2.8.33 is vulnerable to Cross Site Request Forgery (CSRF)

Software Urvanov Syntax Highlighter Type Plugin Vulnerable versions = 2.8.33 Fixed in 2.8.34 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45106 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 73e06e46354c Credits Mika...