PT-2024-37725

Name of the Vulnerable Software and Affected Versions Campaign Monitor for WordPress plugin for WordPress versions up to, and including, 2.8.15 Description The issue is due to the plugin not properly restricting direct access to "/forms/views/admin/create.php" and display errors being enabled. Th...

WordPress All-in-One Video Gallery Plugin <= 3.7.1 is vulnerable to Cross Site Scripting (XSS)

Software All-in-One Video Gallery Type Plugin Vulnerable versions = 3.7.1 Fixed in 3.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6629 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 570fc0403d8c Credits Webbernaut...

WordPress PowerPack Pro for Elementor Plugin <= 2.10.14 is vulnerable to Privilege Escalation

Software PowerPack Pro for Elementor Type Plugin Vulnerable versions = 2.10.14 Fixed in 2.10.15 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-39634 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID...

WordPress Contest Gallery Plugin <= 23.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Contest Gallery Type Plugin Vulnerable versions = 23.1.2 Fixed in 23.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39631 Patch priority Medium CVSS severity Medium 7.1 Developer Wasiliy Strecker PSID e98eae916e49 Credits CatFather Required privilege...

WordPress WP ULike Plugin < 4.7.1 is vulnerable to Cross Site Scripting (XSS)

Software WP ULike Type Plugin Vulnerable versions 4.7.1 Fixed in 4.7.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6094 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2b5286cbd123 Credits Dmitrii Ignatyev Required privile...

WordPress Social Auto Poster Plugin <= 5.3.14 is vulnerable to Broken Access Control

Software Social Auto Poster Type Plugin Vulnerable versions = 5.3.14 Fixed in 5.3.15 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6750 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID e7a22665ac54 Credits István Márton Required...

WordPress PowerPack for Beaver Builder Plugin <= 2.33.0 is vulnerable to Privilege Escalation

Software PowerPack for Beaver Builder Type Plugin Vulnerable versions = 2.33.0 Fixed in 2.33.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-39633 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID...

WordPress Royal Elementor Addons Plugin <= 1.3.980 is vulnerable to Cross Site Scripting (XSS)

Software Royal Elementor Addons Type Plugin Vulnerable versions = 1.3.980 Fixed in 1.3.981 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5818 Patch priority Low CVSS severity Low 6.5 Developer WProyal PSID 21750c8b6654 Credits Webbernaut Required...

WordPress Social Auto Poster Plugin <= 5.3.14 is vulnerable to Broken Access Control

Software Social Auto Poster Type Plugin Vulnerable versions = 5.3.14 Fixed in 5.3.15 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6754 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2f0896427413 Credits István Márton Required...

WordPress Social Auto Poster Plugin <= 5.3.14 is vulnerable to Arbitrary File Upload

Software Social Auto Poster Type Plugin Vulnerable versions = 5.3.14 Fixed in 5.3.15 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6756 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 10970b4a81a6 Credits István Márton Required privileg...

PT-2024-27059 · Contour · Contour

Name of the Vulnerable Software and Affected Versions: contour version 1.28.3 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For contour version 1.28.3, update the...

WordPress Request a Quote Plugin < 2.4.1 is vulnerable to Cross Site Scripting (XSS)

Software Request a Quote Type Plugin Vulnerable versions 2.4.1 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6231 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f268c6d3e880 Credits Bob Matyas Required...

WordPress Language Translate Widget for WordPress – ConveyThis Plugin <= 234 is vulnerable to Broken Access Control

Software Language Translate Widget for WordPress – ConveyThis Type Plugin Vulnerable versions = 234 Fixed in 235 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-38792 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b86aa3788718...

WordPress Pretty Simple Popup Builder Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Pretty Simple Popup Builder Type Plugin Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39626 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 08a58ded2e7c Credits Anugrah Gilang Ramadhan...

PT-2024-27438 · Unknown · Nextscripts

Name of the Vulnerable Software and Affected Versions: NextScripts versions through 4.4.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For versions through...

WordPress Custom Query Blocks Plugin <= 5.2.0 is vulnerable to Broken Access Control

Software Custom Query Blocks Type Plugin Vulnerable versions = 5.2.0 Fixed in 5.3.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-38794 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c14273e201ef Credits Joshua Chan Required...

PT-2024-10279 · Ibm · Ibm Sterling Secure Proxy

Name of the Vulnerable Software and Affected Versions: IBM Sterling Secure Proxy versions 6.0.0.0 through 6.2.0.0 Description: The issue is related to improper validation of a specified type of input, which can allow a privileged user to inject commands into the underlying operating system. This...

WordPress MasterStudy LMS Plugin < 3.3.24 is vulnerable to Privilege Escalation

Software MasterStudy LMS Type Plugin Vulnerable versions 3.3.24 Fixed in 3.3.24 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-5973 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 2f024467e854 Credits Jaime F...

WordPress WP QuickLaTeX Plugin < 3.8.8 is vulnerable to Cross Site Scripting (XSS)

Software WP QuickLaTeX Type Plugin Vulnerable versions 3.8.8 Fixed in 3.8.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5529 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f0666acc2d5f Credits Bob Matyas Required privileg...

WordPress Easy Testimonials Plugin <= 3.9.5 is vulnerable to Cross Site Scripting (XSS)

Software Easy Testimonials Type Plugin Vulnerable versions = 3.9.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2337 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b71aceb02810 Credits Krzysztof Zając Required...