WordPress Hugo WP theme <= 1.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Hugo WP versions = 1.0.8...

WordPress Brite theme <= 1.0.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Brite versions = 1.0.11...

WordPress Backup Migration plugin <= 1.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Backup Migration versions = 1.4.1...

WordPress Enhanced Text Widget plugin <= 1.6.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Enhanced Text Widget versions = 1.6.4...

WordPress Pop-up plugin <= 1.2.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Pop-up versions = 1.2.3...

WordPress Salon booking system plugin <= 9.6.5 - Editor+ Stored XSS via Email Settings vulnerability

Editor+ Stored XSS via Email Settings vulnerability discovered by Bob Matyas in WordPress Plugin Salon booking system versions = 9.6.5...

WordPress Pop-up Plugin <= 1.2.3 is vulnerable to Broken Access Control

Software Pop-up Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31435 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f2085d0cd912 Credits Dhabaleshwar Das Required privilege...

WordPress plugin Flexible Shipping 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress cardealer plugin <= 4.15 - Content Injection vulnerability

Content Injection vulnerability discovered by Yash Chauhan Patchstack Alliance in WordPress Plugin Car Dealer versions = 4.15...

WordPress Serious Slider plugin <= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Serious Slider versions = 1.2.4...

WordPress Easy Set Favicon plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Easy Set Favicon versions = 1.1...

WordPress Pretty Google Calendar plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Pretty Google Calendar versions = 1.7.2...

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Piotnet Addons For Elementor Pro versions = 7.1.17...

WordPress SSU plugin <= 1.5.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin SSU versions = 1.5.0...

WordPress basepress plugin <= 2.16.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Knowledge Base documentation & wiki plugin – BasePress versions = 2.16.1...

WordPress EPROLO Dropshipping plugin <= 1.7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin EPROLO Dropshipping versions = 1.7.1...

WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Metform versions = 3.8.3...

WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability

Limited Arbitrary File Upload vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin XStore Core versions = 5.3.8...

CVE-2023-3597

Keycloak vulnerability CVE-2023-3597 affects the client step-up authentication logic (org.keycloak.authentication). A remote user authenticated with a password can register a false second authentication factor, enabling bypass of authentication. CVSSv3.1 base score 5.0 (MEDIUM). No explicit explo...

CVE-2023-3597 Keycloak: secondary factor bypass in step-up authentication

A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to register a false second authentication factor along with an existing one and bypass authentication...