WordPress Post SMTP Plugin < 2.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Post SMTP Type Plugin Vulnerable versions 2.5.7 Fixed in 2.5.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3179 Patch priority Low CVSS severity Low 8.8 Developer WPExperts PSID a42127c2ce5a Credits Erwan LR WPScan Required privilege...

WordPress My Content Management Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)

Software My Content Management Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34377 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f6e3eb68e74c Credits emad Required...

WordPress Menubar Plugin <= 5.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Menubar Type Plugin Vulnerable versions = 5.8.2 Fixed in 5.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-36687 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID d827ae024a19 Credits LEE SE HYOUNG hackintoanetwor...

WordPress Forminator Plugin < 1.24.1 is vulnerable to Race Condition

Software Forminator Type Plugin Vulnerable versions 1.24.1 Fixed in 1.24.1 OWASP Top 10 A6: Security Misconfiguration Classification Race Condition CVE CVE-2023-2010 Patch priority Low CVSS severity Low 3.7 Developer WPMU DEV PSID 6f5ec8b39b84 Credits Amirmohammad Vakili Required privilege...

WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to SQL Injection

Software SP Project & Document Manager Type Plugin Vulnerable versions = 4.67 Fixed in 4.68 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-36677 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 5776b5f22100 Credits Le Ngoc Anh Required privilege...

WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to Cross Site Scripting (XSS)

Software SP Project & Document Manager Type Plugin Vulnerable versions = 4.67 Fixed in 4.68 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36530 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bc56d5471ed7 Credits emad Requir...

WordPress Easy Accordion FAQ and Knowledge Base Software for WordPress Plugin <= 2.7 is vulnerable to Cross Site Scripting (XSS)

Software Easy Accordion FAQ and Knowledge Base Software for WordPress Type Plugin Vulnerable versions = 2.7 Fixed in 2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d0f6976b048f...

WordPress Request a Quote Plugin < 2.3.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software Request a Quote Type Plugin Vulnerable versions 2.3.11 Fixed in 2.3.11 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bdadec21f189 Credits N/A Required privilege...

2023 CWE Top 25 Most Dangerous Software Weaknesses

The Homeland Security Systems Engineering and Development Institute, sponsored by the Department of Homeland Security and operated by MITRE, has released the 2023 Common Weakness Enumeration CWE Top 25 Most Dangerous Software Weaknesseslink is external. The CWE Top 25 is calculated by analyzing...

WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.6.4 is vulnerable to Broken Authentication

Software WordPress Social Login and Register Discord, Google, Twitter, LinkedIn Type Plugin Vulnerable versions = 7.6.4 Fixed in 7.6.5 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-2982 Patch priority High CVSS severity High 9.8 Developer Claim ownership...

WordPress Zippy Plugin <= 1.6.5 is vulnerable to PHP Object Injection

Software Zippy Type Plugin Vulnerable versions = 1.6.5 Fixed in 1.6.6 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-36381 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 06b21be6012c Credits Jeong Seong Ho Required privilege Author Published 2...

WordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software Side Cart Woocommerce Ajax Type Plugin Vulnerable versions = 2.2 Fixed in 2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28415 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7030dc210c4b Credits Yuki Haruma...

WordPress Short URL Plugin <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Short URL Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1602 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 52582bfc5da0 Credits Etan Imanol Castro Aldrete...

WordPress WP Post Author Plugin <= 3.2.3 is vulnerable to Privilege Escalation

Software WP Post Author Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.3.0 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE N/A Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 6affa2eefe9f Credits N/A Required privilege Unauthenticated...

WordPress Short URL Plugin <= 1.6.4 is vulnerable to SQL Injection

Software Short URL Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-46860 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID dd0573e26311 Credits Le Ngoc Anh Required privilege Subscriber Published 2...

WordPress Salon booking system Plugin <= 8.4.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Salon booking system Type Plugin Vulnerable versions = 8.4.7 Fixed in 8.4.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3427 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8fa98b8f0a46 Credits István Márton...

WordPress LearnDash LMS Plugin <= 4.6.0 is vulnerable to Broken Authentication

Software LearnDash LMS Type Plugin Vulnerable versions = 4.6.0 Fixed in 4.6.0.1 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-3105 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID fcee4e28c7df Credits István Márton Required...

WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR)

Software Editorial Calendar Type Plugin Vulnerable versions = 3.7.12 Fixed in 3.8.0 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-36520 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5cbcd0860491 Credits Elliot...

WordPress Image Map Pro Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Image Map Pro Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3411 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 58704efd163a Credits Kenichiro Ito Required...

WordPress Booked Plugin < 2.4.4 is vulnerable to Sensitive Data Exposure

Software Booked Type Plugin Vulnerable versions 2.4.4 Fixed in 2.4.4 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2022-36399 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 0ab671e26c14 Credits coogee86 Required privilege...