WordPress Shield Security 20.0.5 Cross Site Scripting

Exploit Title: CVE-2024-7313 - Reflected XSS to Unauthorised Administrator Account Creation Google Dork: inurl:"/wp-content/plugins/wp-simple-firewall/" Cannot find version numbers from this DORK Date: 16/08/2024 Exploit Author: Tim Lepp Vendor Homepage: https://getshieldsecurity.com/ Software...

WordPress SpeedyCache Plugin <= 1.1.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software SpeedyCache Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.1.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43299 Patch priority Low CVSS severity Low 5.4 Developer SpeedyCache PSID ed0a8c96439c Credits Rafie Muhammad Patchstack...

WordPress SEO Plugin by Squirrly SEO Plugin <= 12.3.19 is vulnerable to SQL Injection

Software SEO Plugin by Squirrly SEO Type Plugin Vulnerable versions = 12.3.19 Fixed in 12.3.20 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43286 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID a803fc913cd9 Credits Rafie Muhammad Patchstack Required...

WordPress Modal Window Plugin <= 6.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Modal Window Type Plugin Vulnerable versions = 6.0.3 Fixed in 6.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43346 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 956b00accf44 Credits LVT-tholv2k Required privilege Contributo...

WordPress Plugin Notes Plus Plugin <= 1.2.7 is vulnerable to Arbitrary Content Deletion

Software Plugin Notes Plus Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A1: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2024-43326 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 048345824ef6 Credits Trương Hữu Phúc...

WordPress Landing Page Builder Plugin <= 1.5.2.0 is vulnerable to Local File Inclusion

Software Landing Page Builder Type Plugin Vulnerable versions = 1.5.2.0 Fixed in 1.5.2.1 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-43345 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 5a6b1b187928 Credits 4rCanJ0x! Required...

WordPress Order Tracking Plugin < 3.3.13 is vulnerable to Broken Access Control

Software Order Tracking Type Plugin Vulnerable versions 3.3.13 Fixed in 3.3.13 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43343 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID da6200de622c Credits Abdi Pranata Required privileg...

WordPress Responsive Blocks Plugin <= 1.8.8 is vulnerable to Cross Site Scripting (XSS)

Software Responsive Blocks Type Plugin Vulnerable versions = 1.8.8 Fixed in 1.8.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43335 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID deeb36a6e784 Credits 4rCanJ0x! Required privilege...

WordPress Salon booking system Plugin <= 10.8.1 is vulnerable to Open Redirection

Software Salon booking system Type Plugin Vulnerable versions = 10.8.1 Fixed in 10.9 OWASP Top 10 A3: Injection Classification Open Redirection CVE CVE-2024-43280 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 26e2d99b4eb9 Credits Le Ngoc Anh Required privilege...

WordPress Advanced Form Integration Plugin <= 1.89.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Advanced Form Integration Type Plugin Vulnerable versions = 1.89.4 Fixed in 1.89.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43340 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 68886b7fa92b Credits Ananda...

WordPress Simple Share Plugin <= 0.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Simple Share Type Plugin Vulnerable versions = 0.5.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7556 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8e1bd7bd32f7 Credits Amandeep Singh Banga Required...

WordPress Element Pack Elementor Addons Plugin <= 5.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.7.2 Fixed in 5.7.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7247 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3540915b141a Credits Webbernaut...

WordPress Term And Category Based Posts Widget Plugin < 4.9.13 is vulnerable to Cross Site Scripting (XSS)

Software Term And Category Based Posts Widget Type Plugin Vulnerable versions 4.9.13 Fixed in 4.9.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-6158 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2ddaec10bd6e Credits Dmitrii Ignatyev...

Adobe Acrobat Reader AV3DVirtAnnot Object Format Event Use-After-Free Vulnerability

Talos Vulnerability Report TALOS-2024-2009 Adobe Acrobat Reader AV3DVirtAnnot Object Format Event Use-After-Free Vulnerability August 13, 2024 CVE Number CVE-2024-41830 SUMMARY A use-after-free vulnerability exists in the AV3DVirtAnnot functionality of Adobe Acrobat Reader 2024.002.20759. A...

WordPress Media Library Assistant Plugin <= 3.18 is vulnerable to Arbitrary File Upload

Software Media Library Assistant Type Plugin Vulnerable versions = 3.18 Fixed in 3.19 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6823 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID 84d8203c5d37 Credits wesley wcraft Required privile...

WordPress PDF Builder for WPForms Plugin <= 1.2.116 is vulnerable to Full Path Disclosure (FPD)

Software PDF Builder for WPForms Type Plugin Vulnerable versions = 1.2.116 Fixed in 1.2.117 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-7414 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c08822324936 Credits stealthcopt...

PT-2024-38560 · Sourcecodester · Sourcecodester Clinics Patient Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Clinics Patient Management System version 1.0 Description: A vulnerability was found in the system, classified as problematic, affecting an unknown part of the file /update medicine.php. The manipulation of the medicine name...

WordPress Busiprof Theme <= 2.4.8 is vulnerable to Cross Site Scripting (XSS)

Software Busiprof Type Theme Vulnerable versions = 2.4.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43262 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID eb128345a59b Credits stealthcopter Required privilege Contributor...

WordPress Bit Form Pro Plugin <= 2.6.4 is vulnerable to Settings Change

Software Bit Form Pro Type Plugin Vulnerable versions = 2.6.4 Fixed in 2.8.0 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43250 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 786f4284258a Credits Dave Jong Patchstack Required...

WordPress WP Bannerize Pro Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Bannerize Pro Type Plugin Vulnerable versions = 1.9.0 Fixed in 1.9.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7388 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e13c4b78a18d Credits Nguyễn Trung Kiên...