WordPress Phlox Portfolio Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Phlox Portfolio Type Plugin Vulnerable versions = 2.3.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1384 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9c1fb070fd76 Credits Lucio Sá Required privileg...

WordPress Viral Signup Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

Software Viral Signup Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6927 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5b641fb65f6d Credits Bob Matyas Required privilege...

WordPress ElementsKit Pro Plugin <= 3.6.0 is vulnerable to Local File Inclusion

Software ElementsKit Pro Type Plugin Vulnerable versions = 3.6.0 Fixed in 3.6.8 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-43996 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8da27be920b8 Credits Ngô Thiên An ancorn from VNPT-VCI Required...

WordPress Ninja Forms Plugin <= 3.8.11 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms Type Plugin Vulnerable versions = 3.8.11 Fixed in 3.8.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43999 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f7b73633135b Credits Joel Indra Required privilege...

WordPress Podlove Podcast Publisher Plugin <= 4.1.13 is vulnerable to Cross Site Scripting (XSS)

Software Podlove Podcast Publisher Type Plugin Vulnerable versions = 4.1.13 Fixed in 4.1.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43983 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 71f42a372118 Credits Muhammad Daffa Required...

WordPress Spiffy Calendar Plugin <= 4.9.12 is vulnerable to SQL Injection

Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.12 Fixed in 4.9.13 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43969 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 7bc8db74206e Credits Certus Cybersecurity Required privilege...

WordPress Fota WP Theme <= 1.4.1 is vulnerable to Broken Access Control

Software Fota WP Type Theme Vulnerable versions = 1.4.1 Fixed in 1.4.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43980 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b10d5d19d02a Credits Fariq Fadillah Gusti Insani...

inigo-rs (>=0.1.1, <=0.1.4) potentially affected by CVE-2024-43414 via apollo-router (1.6.0)

apollo-router CARGO version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on apollo-router and may be impacted: - inigo-rs =0.1.1, =0.1.4 Source cves: CVE-2024-43414 Source advisory: OSV:GHSA-FMJ9-77Q8-G6C4...

@genesisx/graphql (>=3.0.0-beta.1, <=4.0.1), @genesisx/graphql-utils (>=3.0.0-beta.0, <=3.0.1) +9 more potentially affected by CVE-2024-43414 via @apollo/gateway (>=2.0.0-preview.2, <=2.8.4)

@apollo/gateway NPM version =2.0.0-preview.2, =3.0.0-beta.1, =3.0.0-beta.0, =0.11.46-alpha-bad726532.0, =0.0.1, =8.6.7, =2.8.54, =0.0.0-preview-20220428090254, =0.0.0-preview-20221125005457, =1.3.3, =0.0.3, =1.0.48 - nestjs-registry 0.0.1 Source cves: CVE-2024-43414 Source advisory:...

WordPress Xpro Elementor Addons Plugin <= 1.4.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Xpro Elementor Addons Type Plugin Vulnerable versions = 1.4.4.3 Fixed in 1.4.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7791 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 93f87661de72 Credits WordFence...

WordPress Oxygen Builder Plugin <= 4.8.3 is vulnerable to Broken Access Control

Software Oxygen Builder Type Plugin Vulnerable versions = 4.8.3 Fixed in 4.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6688 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 05a98a111db4 Credits Francesco Carlucci Required...

WordPress Simple Headline Rotator Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Simple Headline Rotator Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7860 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 30c399c6a90f Credits Daniel Ruf...

AZL-48300 CVE-2024-43806 affecting package cloud-hypervisor for versions less than 32.0-7

Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using rustix::fs::Dir using the linuxraw backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in rustix::fs::Dir::readmore, this can cause quick and...

WordPress WPMobile.App Plugin <= 11.48 is vulnerable to Cross Site Request Forgery (CSRF)

Software WPMobile.App Type Plugin Vulnerable versions = 11.48 Fixed in 11.49 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43933 Patch priority Low CVSS severity Low 7.1 Developer Amauri.IO PSID 8f2aea19dd33 Credits Muhammad Daffa Required...

WordPress SKT Blocks – Gutenberg based Page Builder Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

Software SKT Blocks – Gutenberg based Page Builder Type Plugin Vulnerable versions = 1.6 Fixed in 1.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43946 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 747508d88809 Credits 4rCanJ0x! Requir...

FastAPI Admin 安全漏洞

FastAPI Admin is FastAPI Admin open source a fast administration dashboard based on FastAPI and TortoiseORM. A security vulnerability exists in FastAPI Admin version v0.1.4, which stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary web...

WordPress WP Testimonial Widget Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Testimonial Widget Type Plugin Vulnerable versions = 3.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43967 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 886cd3de89e3 Credits hnwmn Required privilege Administrat...

WordPress DSGVO All in one for WP Plugin <= 4.5 is vulnerable to Cross Site Scripting (XSS)

Software DSGVO All in one for WP Type Plugin Vulnerable versions = 4.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43964 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7d6d328e43e7 Credits Ngô Thiên An ancorn from VNPT-VCI...

WordPress Envira Photo Gallery Plugin <= 1.8.14 is vulnerable to Broken Access Control

Software Envira Photo Gallery Type Plugin Vulnerable versions = 1.8.14 Fixed in 1.8.15 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43925 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9c53eb2407a8 Credits Rafie Muhammad...

WordPress plugin Store Locator Plus 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...