WordPress Products, Order & Customers Export for WooCommerce Plugin <= 2.0.8 is vulnerable to Broken Access Control

Software Products, Order & Customers Export for WooCommerce Type Plugin Vulnerable versions = 2.0.8 Fixed in 2.0.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31276 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 34e66eca8be4...

WordPress App Builder Plugin <= 3.8.7 is vulnerable to Open Redirection

Software App Builder Type Plugin Vulnerable versions = 3.8.7 Fixed in 3.8.8 OWASP Top 10 A4: Insecure Design Classification Open Redirection CVE CVE-2024-31282 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID d4752ee01a2d Credits Yudistira Arya Required privilege...

WordPress Relevanssi Premium Plugin <= 2.25.1 is vulnerable to CSV Injection

Software Relevanssi Premium Type Plugin Vulnerable versions = 2.25.1 Fixed in 2.25.2 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2024-3214 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID c945697bfd2b Credits Thura Moe Myint mgthuramoemyint Required...

WordPress EmbedPress Plugin <= 3.9.8 is vulnerable to Broken Access Control

Software EmbedPress Type Plugin Vulnerable versions = 3.9.8 Fixed in 3.9.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31284 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0f53658201e5 Credits Majed Refaea Required...

WordPress ConvertKit Plugin <= 2.4.5 is vulnerable to Sensitive Data Exposure

Software ConvertKit Type Plugin Vulnerable versions = 2.4.5 Fixed in 2.4.6 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-31245 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7d064ae8f23f Credits Joshua Chan...

WordPress ShopLentor Plugin <= 2.8.4 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.4 Fixed in 2.8.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2946 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 95e2e2bf1701 Credits Phuoc Pham p3tl0v3r Required...

WordPress Premium Addons for Elementor Plugin <= 4.10.22 is vulnerable to Sensitive Data Exposure

Software Premium Addons for Elementor Type Plugin Vulnerable versions = 4.10.22 Fixed in 4.10.23 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-31278 Patch priority Low CVSS severity Low 4.3 Developer LeapWorx PSID e07cd20a1a96 Credits Khalid Yusuf...

WordPress Gutenberg Blocks by Kadence Blocks Plugin < 3.2.26 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions 3.2.26 Fixed in 3.2.26 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2509 Patch priority Low CVSS severity Low 6.5 Developer KadenceWP PSID 59ef6d666275 Credits Dmitrii...

WordPress Classified Listing Plugin <= 3.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Classified Listing Type Plugin Vulnerable versions = 3.0.4 Fixed in 3.0.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1315 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 27f9fddfe733 Credits Francesco Carlucc...

AZL-39238 CVE-2023-45288 affecting package vitess for versions less than 16.0.2-8

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

WordPress Spectra Plugin <= 2.10.3 is vulnerable to Cross Site Scripting (XSS)

Software Spectra Type Plugin Vulnerable versions = 2.10.3 Fixed in 2.10.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6486 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2ec9e8bd69ac Credits Akbar Kustirama Required...

WordPress Easy Digital Downloads Plugin <= 3.2.9 is vulnerable to Sensitive Data Exposure

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.9 Fixed in 3.2.10 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2302 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4b720db13b09 Credits Colin Xu Required...

WordPress ShopLentor Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.3 Fixed in 2.8.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2868 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1cdf46cdcf3 Credits wesley wcraft Required...

WordPress TaxoPress Plugin <= 3.12.0 is vulnerable to Cross Site Scripting (XSS)

Software TaxoPress Type Plugin Vulnerable versions = 3.12.0 Fixed in 3.20.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2830 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 812b03b02ecc Credits stealthcopter Required...

WordPress WooCommerce Cart Abandonment Recovery Plugin < 1.2.27 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Cart Abandonment Recovery Type Plugin Vulnerable versions 1.2.27 Fixed in 1.2.27 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2322 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 266dfc803e4a Credit...

PT-2024-24216 · Totolink · Totolink Ex200

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX200 version 4.0.3c.7646 B20201211 Description: A remote code execution RCE issue was discovered, which can be exploited via the webWlanIdx parameter in the setWebWlanIdx function. Recommendations: For TOTOLINK EX200 version...

WOOCS – WooCommerce Currency Switcher < 1.4.1.8 - Cross-Site Request Forgery

Description The WOOCS – WooCommerce Currency Switcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.1.7. This is due to missing or incorrect nonce validation on the saveetalon function.. This makes it possible for unauthenticated attackers ...

WordPress Oxygen Builder Plugin <= 4.9 is vulnerable to Remote Code Execution (RCE)

Software Oxygen Builder Type Plugin Vulnerable versions = 4.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-31380 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 4b3933c6a6e8 Credits Snicco Required privilege Contributo...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.17 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.17 Fixed in 3.2.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0598 Patch priority Low CVSS severity Low 5.9 Developer KadenceWP PSID def3561720ef Credits Akbar...

PT-2024-23726 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: emlog version Pro 2.3 Description: The issue allows remote attackers to execute arbitrary code via a crafted payload to the bottom of the homepage in the footer info parameter. This is a Cross Site Scripting XSS issue. Recommendations: For...