WordPress DearFlip Plugin <= 2.2.55 is vulnerable to Cross Site Scripting (XSS)

Software DearFlip Type Plugin Vulnerable versions = 2.2.55 Fixed in 2.2.56 OWASP Top 10 A6: Vulnerable and Outdated Components Classification Cross Site Scripting XSS CVE CVE-2024-4367 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b8b20eae5d21 Credits m3ez Required...

WordPress Ultimate Membership Pro Plugin <= 12.7 is vulnerable to Privilege Escalation

Software Ultimate Membership Pro Type Plugin Vulnerable versions = 12.7 Fixed in 12.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-43240 Patch priority High CVSS severity High 9.4 Developer Claim ownership PSID cfa9ba3d1675 Credits...

GLSA-202408-23 : GnuPG: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202408-23 GnuPG: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in GnuPG. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from...

CVE-2024-4350

Summary (Concrete CMS CVE-2024-4350): Concrete CMS versions 9.0.0–9.3.2 and below 8.5.18 are vulnerable to a Stored XSS in the RSS Displayer when user input is stored and later embedded into responses, due to insufficient input validation. Root cause: vulnerable code path in the RSS Displayer all...

WordPress Bitly Plugin <= 2.7.2 is vulnerable to Broken Access Control

Software Bitly Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43209 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1d22e84d1285 Credits Abdi Pranata Required privilege...

WordPress GiveWP Plugin <= 3.14.1 is vulnerable to PHP Object Injection

Software GiveWP Type Plugin Vulnerable versions = 3.14.1 Fixed in 3.14.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-37099 Patch priority High CVSS severity High 10 Developer Liquid Web / StellarWP PSID 44652f09d965 Credits LVT-tholv2k Required privilege...

WordPress WC Marketplace Plugin <= 4.1.17 is vulnerable to Cross Site Scripting (XSS)

Software WC Marketplace Type Plugin Vulnerable versions = 4.1.17 Fixed in 4.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43213 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9e24c9d497f1 Credits LVT-tholv2k Required privilege...

WordPress myCred Plugin <= 2.7.2 is vulnerable to Broken Access Control

Software myCred Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43214 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID fb17e972c338 Credits Mika Required privilege Unauthenticate...

WordPress YaMaps for WordPress Plugin <= 0.6.27 is vulnerable to Cross Site Scripting (XSS)

Software YaMaps for WordPress Type Plugin Vulnerable versions = 0.6.27 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43224 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID eb6f72d0e57f Credits LVT-tholv2k Required privilege...

WordPress Meta Box – WordPress Custom Fields Framework Plugin <= 5.9.10 is vulnerable to Broken Access Control

Software Meta Box – WordPress Custom Fields Framework Type Plugin Vulnerable versions = 5.9.10 Fixed in 5.9.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43235 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 05cac2b9959a Credit...

WordPress Form Maker by 10Web Plugin <= 1.15.26 is vulnerable to Cross Site Scripting (XSS)

Software Form Maker by 10Web Type Plugin Vulnerable versions = 1.15.26 Fixed in 1.15.27 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43220 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 77f57c6e5d92 Credits Le Ngoc Anh Required...

WordPress BSK Forms Blacklist Plugin <= 3.8 is vulnerable to Cross Site Scripting (XSS)

Software BSK Forms Blacklist Type Plugin Vulnerable versions = 3.8 Fixed in 3.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43233 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 39a05d2b3c1d Credits LVT-tholv2k Required privilege...

WordPress Amelia Plugin <= 1.2 is vulnerable to Sensitive Data Exposure

Software Amelia Type Plugin Vulnerable versions = 1.2 Fixed in 1.2.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6552 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 963ab0b19e24 Credits stealthcopter Required privilege...

WordPress Slider by 10Web Plugin <= 1.2.57 is vulnerable to SQL Injection

Software Slider by 10Web Type Plugin Vulnerable versions = 1.2.57 Fixed in 1.2.58 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-7150 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 4ad1a30beb69 Credits Arkadiusz Hydzik Required privilege Contributor...

PT-2024-37916 · WordPress · Falang Multilanguage For Wordpress

Name of the Vulnerable Software and Affected Versions: Falang multilanguage for WordPress plugin versions up to, and including, 1.3.52 Description: The issue allows authenticated attackers with Subscriber-level access and above to update and delete translations and expose the administrator email...

WordPress Search Filter Pro Plugin < 2.5.18 is vulnerable to Cross Site Scripting (XSS)

Software Search Filter Pro Type Plugin Vulnerable versions 2.5.18 Fixed in 2.5.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6481 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0f5364627440 Credits Felipe Caon Required...

WordPress Spectra Plugin <= 2.14.1 is vulnerable to Cross Site Scripting (XSS)

Software Spectra Type Plugin Vulnerable versions = 2.14.1 Fixed in 2.15.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-7590 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a51e418171d1 Credits João Pedro S Alcântara Kinorth Required...

WordPress Graphina Plugin <= 1.8.10 is vulnerable to Cross Site Scripting (XSS)

Software Graphina Type Plugin Vulnerable versions = 1.8.10 Fixed in 2.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43124 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 730b126f8b88 Credits Khalid Yusuf Required privilege Contributor...

WordPress Event Manager for WooCommerce Plugin <= 4.2.1 is vulnerable to Local File Inclusion

Software Event Manager for WooCommerce Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-43138 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 721149c5cd33 Credits João Pedro S...

WordPress WPSection Plugin <= 1.3.8 is vulnerable to Local File Inclusion

Software WPSection Type Plugin Vulnerable versions = 1.3.8 Fixed in 1.3.9 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-43165 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cd0a6805dc6f Credits João Pedro S Alcântara Kinorth Required privileg...