WordPress HT Mega Plugin <= 2.4.6 is vulnerable to Directory Traversal

Software HT Mega Type Plugin Vulnerable versions = 2.4.6 Fixed in 2.4.7 OWASP Top 10 A5: Broken Access Control Classification Directory Traversal CVE CVE-2024-1974 Patch priority Low CVSS severity Low 7.7 Developer HTMega PSID 6d7e2f2731f2 Credits Webbernaut Required privilege Contributor Publish...

WordPress Livemesh Addons for Elementor Plugin <= 8.3.5 is vulnerable to Cross Site Scripting (XSS)

Software Livemesh Addons for Elementor Type Plugin Vulnerable versions = 8.3.5 Fixed in 8.3.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27986 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 26fae225fb32 Credits Khalid Yusuf Required...

WordPress Link Library Plugin <= 7.6.6 is vulnerable to Cross Site Scripting (XSS)

Software Link Library Type Plugin Vulnerable versions = 7.6.6 Fixed in 7.6.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2325 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6ac3bb374efb Credits Krzysztof Zając...

WordPress UsersWP Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)

Software UsersWP Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2423 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cb46d3529c97 Credits Krzysztof Zając Required privile...

WordPress Categorify Plugin <= 1.0.7.4 is vulnerable to Broken Access Control

Software Categorify Type Plugin Vulnerable versions = 1.0.7.4 Fixed in 1.0.7.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1649 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ae42a7532dc2 Credits Francesco Carlucci Required...

WordPress Automatic Plugin <= 3.92.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Automatic Type Plugin Vulnerable versions = 3.92.0 Fixed in 3.92.1 OWASP Top 10 A8: Cross Site Request Forgery CSRF Classification Cross Site Request Forgery CSRF CVE CVE-2024-27955 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID cf1662afb1ce Credits Rafie Muhamma...

WordPress Contact Form 7 Plugin <= 5.9 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 Type Plugin Vulnerable versions = 5.9 Fixed in 5.9.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2242 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5d34f7907f9a Credits Asaf Mozes Required...

WordPress Crisp Plugin <= 0.44 is vulnerable to Cross Site Scripting (XSS)

Software Crisp Type Plugin Vulnerable versions = 0.44 Fixed in 0.45 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27963 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d24f23d72736 Credits stealthcopter Required privilege Subscriber...

Prime Slider – Addons For Elementor < 3.13.3 - Contributor+ Stored Cross-Site Scripting via Rubix Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the 'titletags' attribute of the Rubix widget in all versions up to, and including, 3.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

WordPress Prime Slider – Addons For Elementor Plugin <= 3.13.2 is vulnerable to Cross Site Scripting (XSS)

Software Prime Slider – Addons For Elementor Type Plugin Vulnerable versions = 3.13.2 Fixed in 3.13.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1508 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1f2721cd17ac Credits...

WordPress Hustle Plugin <= 7.8.3 is vulnerable to Sensitive Data Exposure

Software Hustle Type Plugin Vulnerable versions = 7.8.3 Fixed in 7.8.4 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-0368 Patch priority Low CVSS severity Low 8.6 Developer WPMU DEV PSID 27afdc4a9565 Credits Sean Murphy Required privilege...

WordPress AntiSpam for Contact Form 7 Plugin <= 0.6.0 is vulnerable to Cross Site Scripting (XSS)

Software AntiSpam for Contact Form 7 Type Plugin Vulnerable versions = 0.6.0 Fixed in 0.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27961 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID f9498b94e6d4 Credits stealthcopter Required...

WordPress Visualizer Plugin <= 3.10.5 is vulnerable to Cross Site Scripting (XSS)

Software Visualizer Type Plugin Vulnerable versions = 3.10.5 Fixed in 3.10.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27958 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID c3450277a0c7 Credits stealthcopter Required privilege...

WordPress Web Application Firewall – website security Plugin <= 2.1.1 is vulnerable to Privilege Escalation

Software Web Application Firewall – website security Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-2172 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 079a85617a7b Credits...

WordPress Bit Form – Contact Form Plugin Plugin <= 2.10.1 is vulnerable to Insecure Direct Object References (IDOR)

Software Bit Form – Contact Form Plugin Type Plugin Vulnerable versions = 2.10.1 Fixed in 2.10.2 OWASP Top 10 A4: Insecure Design Classification Insecure Direct Object References IDOR CVE CVE-2024-1640 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 608867152d52 Credits...

WordPress Related Posts for WordPress Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Related Posts for WordPress Type Plugin Vulnerable versions = 2.2.1 Fixed in 2.2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0592 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 89e5ec281512 Credits Krzyszto...

WordPress PropertyHive Plugin <= 2.0.9 is vulnerable to PHP Object Injection

Software PropertyHive Type Plugin Vulnerable versions = 2.0.9 Fixed in 2.0.10 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-27985 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 245763d3996e Credits CatFather Required privilege Subscribe...

WordPress MPG Plugin <= 3.4.0 is vulnerable to Remote Code Execution (RCE)

Software MPG Type Plugin Vulnerable versions = 3.4.0 Fixed in 3.4.1 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-27951 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID e11792cbc705 Credits Majed Refaea Required privilege Editor...

WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.6.8 is vulnerable to Broken Access Control

Software Cryptocurrency Widgets – Price Ticker & Coins List Type Plugin Vulnerable versions = 2.6.8 Fixed in 2.6.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-27953 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 036319de798f...

WordPress EventPrime Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)

Software EventPrime Type Plugin Vulnerable versions = 3.4.3 Fixed in 3.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1320 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0caa29a440c8 Credits Lucio Sá Required...