Trellix HAX 2023 Capture the Flag Results!

Trellix HAX 2023 Capture the Flag Results! By Mark Bereza · March 17, 2023 This story was also written by Jesse Chick. All good things must come to an end, and our annual CTF is unfortunately no exception. When this competition began, we asked each of you to try your hand at 12 new challenges –...

WordPress Hotel Booking Lite Plugin <= 4.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Hotel Booking Lite Type Plugin Vulnerable versions = 4.6.0 Fixed in 4.7.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-28498 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1b95488d4796 Credits yuyudhn Required...

WordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS)

Software Slide Anything Type Plugin Vulnerable versions = 2.4.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28499 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 20dca4f988b8 Credits RE-ALTER Required...

WordPress Contact Form Email Plugin <= 1.3.31 is vulnerable to Other Vulnerability Type

Software Contact Form Email Type Plugin Vulnerable versions = 1.3.31 Fixed in 1.3.32 OWASP Top 10 A5: Broken Access Control Classification Other Vulnerability Type CVE CVE-2023-28494 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1b66482cfee4 Credits István Márton Require...

WordPress Advanced Product Labels for WooCommerce Plugin <= 1.2.4 is vulnerable to Broken Access Control

Software Advanced Product Labels for WooCommerce Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.4.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45813 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 306429b28772 Credits...

WordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to SQL Injection

Software Slideshow Gallery Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-28491 Patch priority Low CVSS severity Low 6.7 Developer Claim ownership PSID 9644393e25c7 Credits minhtuanact Required privilege Administrator...

WordPress WP Shortcode by MyThemeShop Plugin <= 1.4.16 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Shortcode by MyThemeShop Type Plugin Vulnerable versions = 1.4.16 Fixed in 1.4.17 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-28495 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2089c32fb90d Credits Istvá...

WordPress Pagination Styler for WooCommerce Plugin <= 3.5.7.6 is vulnerable to Broken Access Control

Software Pagination Styler for WooCommerce Type Plugin Vulnerable versions = 3.5.7.6 Fixed in 3.5.7.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45813 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9700cfe7197b Credits István...

WordPress Brands for WooCommerce Plugin <= 3.7.0.5 is vulnerable to Broken Access Control

Software Brands for WooCommerce Type Plugin Vulnerable versions = 3.7.0.5 Fixed in 3.7.0.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45813 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9f2b0dfb0d37 Credits István Márton...

WordPress ProfileGrid Plugin <= 5.0.3 is vulnerable to Broken Access Control

Software ProfileGrid Type Plugin Vulnerable versions = 5.0.3 Fixed in 5.0.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-36352 Patch priority High CVSS severity High 6.3 Developer Claim ownership PSID 97a93e8f05e7 Credits István Márton Required privileg...

WordPress WordPress Ping Optimizer Plugin <= 2.35.1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software WordPress Ping Optimizer Type Plugin Vulnerable versions = 2.35.1.2.3 Fixed in 2.35.1.3.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-30705 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 85c31e5709c9 Credits...

WordPress Newsmag Theme <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Newsmag Type Theme Vulnerable versions = 2.4.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28493 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 919e42815591 Credits Brandon Roldan Required privileg...

WordPress Weaver Xtreme Theme Support Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Weaver Xtreme Theme Support Type Plugin Vulnerable versions = 5.0.2 Fixed in 6.2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7fef1f764ecf Credits Unknown Required...

WordPress Be POPIA Compliant Plugin <= 1.2.0 is vulnerable to SQL Injection

Software Be POPIA Compliant Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.3.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47445 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 90e83cd07291 Credits Team WeBoB Required privilege Unauthenticate...

WordPress WSB Brands Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)

Software WSB Brands Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47437 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8260354667d5 Credits Team WeBoB Required privilege...

WordPress Drag and Drop Multiple File Upload PRO Plugin <= 2.11.0 is vulnerable to Cross Site Scripting (XSS)

Software Drag and Drop Multiple File Upload PRO Type Plugin Vulnerable versions = 2.11.0 Fixed in 2.11.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 46354af3b04b Credits WordFen...

WordPress Auto Rename Media On Upload Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Auto Rename Media On Upload Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 67375a1ad894 Credits WordFence Required...

WordPress Modern Footnotes Plugin <= 1.4.15 is vulnerable to Cross Site Scripting (XSS)

Software Modern Footnotes Type Plugin Vulnerable versions = 1.4.15 Fixed in 1.4.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28423 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 67046b66cdee Credits Rio Darmawan Require...

WordPress Customify Plugin <= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Customify Type Plugin Vulnerable versions = 2.10.4 Fixed in 2.10.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27633 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 795d165c4d06 Credits Mika Required privilege...

WordPress Google XML Sitemap for Images Plugin <= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Google XML Sitemap for Images Type Plugin Vulnerable versions = 2.1.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-28173 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 59e1b35ecbae Credits Rio...