WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Arbitrary File Deletion

Software Simple File List Type Plugin Vulnerable versions = 6.1.9 Fixed in 6.1.10 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-44227 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID a7bcbbd71b3a Credits Rafshanzani Suhada...

WordPress Mediavine Control Panel Plugin <= 2.10.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Mediavine Control Panel Type Plugin Vulnerable versions = 2.10.2 Fixed in 2.10.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-44259 Patch priority Low CVSS severity Low 4.3 Developer Mediavine PSID d5d78ea56f25 Credits Rio Darmawan...

WordPress Schema App Structured Data Plugin <= 1.23.1 is vulnerable to Broken Access Control

Software Schema App Structured Data Type Plugin Vulnerable versions = 1.23.1 Fixed in 1.23.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-44258 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 9ad22840c42c Credits Rio Darmawan...

WordPress Track The Click Plugin < 0.3.12 is vulnerable to SQL Injection

Software Track The Click Type Plugin Vulnerable versions 0.3.12 Fixed in 0.3.12 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5041 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 1853e39ba601 Credits Karolis Narvilas Required privilege Author Publish...

WordPress WP Job Openings Plugin <= 3.4.2 is vulnerable to Sensitive Data Exposure

Software WP Job Openings Type Plugin Vulnerable versions = 3.4.2 Fixed in 3.4.3 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-4933 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 654671e3575f Credits Dmitrii Ignatyev Require...

WordPress ActivityPub Plugin < 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software ActivityPub Type Plugin Vulnerable versions 1.0.1 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3746 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4e185588c9f2 Credits Ben Bidner Required privilege...

WordPress Popup Builder Plugin < 4.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Popup Builder Type Plugin Vulnerable versions 4.2.2 Fixed in 4.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3226 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3861c79d8ad1 Credits Dipak Panchal th3.d1pak...

WordPress ActivityPub Plugin < 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software ActivityPub Type Plugin Vulnerable versions 1.0.0 Fixed in 1.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5057 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7a16cc70d522 Credits Ben Bidner Required privilege...

WordPress DoLogin Security Plugin < 3.7 is vulnerable to Cross Site Scripting (XSS)

Software DoLogin Security Type Plugin Vulnerable versions 3.7 Fixed in 3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4549 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ea7d8ad59ce2 Credits Bartlomiej Marek and...

WordPress Astra Bulk Edit Plugin <= 1.2.7 is vulnerable to Broken Access Control

Software Astra Bulk Edit Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-44148 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID eb8e23601d3b Credits Rafie Muhammad Patchstack...

WordPress Simple Posts Ticker Plugin < 1.1.6 is vulnerable to Cross Site Scripting (XSS)

Software Simple Posts Ticker Type Plugin Vulnerable versions 1.1.6 Fixed in 1.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4725 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID fb8f01332256 Credits Dmitrii Ignatyev...

WordPress ActivityPub Plugin < 1.0.0 is vulnerable to Sensitive Data Exposure

Software ActivityPub Type Plugin Vulnerable versions 1.0.0 Fixed in 1.0.0 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-3706 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e5fb73f459f7 Credits Erwan LR WPScan Required privilege...

WordPress User Avatar - Reloaded Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software User Avatar - Reloaded Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4798 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a4fd94410ec4 Credits Dmitrii Ignatyev...

WordPress User Activity Log Pro Plugin < 2.3.4 is vulnerable to Cross Site Scripting (XSS)

Software User Activity Log Pro Type Plugin Vulnerable versions 2.3.4 Fixed in 2.3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5167 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 89ef9c440ecf Credits Bartlomiej Mar...

WordPress Dreamfox Media Payment gateway per Product for Woocommerce Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Dreamfox Media Payment gateway per Product for Woocommerce Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-44144 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c8d06a423a...

WordPress Modal Window Plugin <= 5.3.5 is vulnerable to Cross Site Scripting (XSS)

Software Modal Window Type Plugin Vulnerable versions = 5.3.5 Fixed in 5.3.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5161 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 08629e325eb0 Credits Lana Codes Required privile...

WordPress User Activity Log Pro Plugin < 2.3.4 is vulnerable to Bypass Vulnerability

Software User Activity Log Pro Type Plugin Vulnerable versions 2.3.4 Fixed in 2.3.4 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-5133 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 06c08325ccb9 Credits Bartlomiej Marek and...

WordPress Inactive Logout Plugin <= 3.2.2 is vulnerable to Broken Access Control

Software Inactive Logout Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-44142 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 006870242fb0 Credits Elliot Required privilege...

WordPress Copy Anything to Clipboard Plugin <= 2.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Copy Anything to Clipboard Type Plugin Vulnerable versions = 2.6.4 Fixed in 2.6.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5086 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5b08bbb6e3a3 Credits Lana Codes...

WordPress WPvivid Backup and Migration Plugin <= 0.9.89 is vulnerable to Arbitrary File Deletion

Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.89 Fixed in 0.9.90 OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Deletion CVE CVE-2023-4274 Patch priority Low CVSS severity Low 8.7 Developer Claim ownership PSID 578242027a0b Credits Ivan...