WordPress User Activity Log Plugin <= 1.6.2 is vulnerable to SQL Injection

Software User Activity Log Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-37966 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 1ca9ff07b236 Credits LEE SE HYOUNG hackintoanetwork Required privile...

WordPress WP-FB-AutoConnect Plugin <= 4.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP-FB-AutoConnect Type Plugin Vulnerable versions = 4.6.1 Fixed in 4.6.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-37974 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6dc7649557b3 Credits Nguyen Xuan Chien...

WordPress Plugin Top 10: Cross-Site Request Forgery Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress WPAdmin AWS CDN Plugin <= 2.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

Software WPAdmin AWS CDN Type Plugin Vulnerable versions = 2.0.13 Fixed in 3.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-37889 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f2fa824bd0a1 Credits Mika Required...

WordPress Shortcode IMDB Plugin <= 6.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Shortcode IMDB Type Plugin Vulnerable versions = 6.0.8 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-37892 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f272d08c4cd6 Credits yuyudhn Required...

WordPress Exit Popups & Onsite Retargeting by OptiMonk Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Exit Popups & Onsite Retargeting by OptiMonk Type Plugin Vulnerable versions = 2.0.4 Fixed in 2.0.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-37891 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fedf86bcec9...

WordPress Mail Control Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Mail Control Type Plugin Vulnerable versions = 0.3.1 Fixed in 0.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3158 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 0eca928a8cff Credits Alex Thomas Required...

GHSA-MRR8-V49W-3333 sweetalert2 contains potentially undesirable behavior

sweetalert2 versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project's readme...

WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Cross Site Scripting (XSS)

Software HTTP Headers Type Plugin Vulnerable versions = 1.18.11 Fixed in 1.19.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-37874 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9021e283fb63 Credits emad Required privilege Administrator...

WordPress Premium Addons PRO Plugin <= 2.9.0 is vulnerable to Sensitive Data Exposure

Software Premium Addons PRO Type Plugin Vulnerable versions = 2.9.0 Fixed in 2.9.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-37868 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 61bc62d7d465 Credits Rafie Muhammad...

WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce GoCardless Gateway Type Plugin Vulnerable versions = 2.5.6 Fixed in 2.5.7 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-37871 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 5a7891bcb8a5 Credi...

WordPress Getnet Argentina para Woocommerce Plugin 0.0.1-0.0.4 is vulnerable to Broken Access Control

Software Getnet Argentina para Woocommerce Type Plugin Vulnerable versions 0.0.1-0.0.4 Fixed in 0.0.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-3525 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 026805019331 Credits Kijam...

PT-2023-33044 · Unknown · Sweetalert2

Name of the Vulnerable Software and Affected Versions: sweetalert2 versions 11.6.14 and above Description: The sweetalert2 package exhibits potentially undesirable behavior by outputting audio and/or video messages unrelated to its functionality when run on specific top-level domains TLDs. This...

WordPress Buy Me a Coffee Plugin <= 3.7 is vulnerable to Broken Access Control

Software Buy Me a Coffee Type Plugin Vulnerable versions = 3.7 Fixed in 3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2078 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4f9e072d5272 Credits Lana Codes Required privilege...

top-fishing.fr Cross Site Scripting vulnerability OBB-3490168

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress WP Dummy Content Generator Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Dummy Content Generator Type Plugin Vulnerable versions = 2.3.0 Fixed in 3.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-37392 Patch priority Low CVSS severity Low 5.4 Developer Deepak Anand PSID 29759436a0f1 Credits Elliot...

WordPress Coming Soon Plugin <= 1.5.9 is vulnerable to SQL Injection

Software Coming Soon Type Plugin Vulnerable versions = 1.5.9 Fixed in 1.6.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-46849 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 0a93f0e48b26 Credits Le Ngoc Anh Required privilege Administrator Publishe...

WordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL Injection

Software RSVPMarker Type Plugin Vulnerable versions 10.5.5 Fixed in 10.5.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-29095 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 4d11f7569f33 Credits Rafi Priatna Kasbiantoro Required privilege...

WordPress Classified Listing Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Classified Listing Type Plugin Vulnerable versions = 2.4.5 Fixed in 2.4.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-37387 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 58373c58e878 Credits István Márton...

WordPress Media Library Helper by Codexin Plugin <= 1.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Media Library Helper by Codexin Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.3.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-37386 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 31c3323d9133 Credits...