WordPress User Activity Tracking and Log Plugin < 4.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software User Activity Tracking and Log Type Plugin Vulnerable versions 4.0.9 Fixed in 4.0.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-4150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8eda0dc496af Credits Erwan L...

WordPress Paid Memberships Pro Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Paid Memberships Pro Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 77be0838d452 Credits WordFence Required privilege...

WordPress Header Footer Code Manager Plugin <= 1.1.34 is vulnerable to Cross Site Request Forgery (CSRF)

Software Header Footer Code Manager Type Plugin Vulnerable versions = 1.1.34 Fixed in 1.1.35 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-39989 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5536fb0cce4a Credits Rafie...

WordPress Biometric Login for WooCommerce Plugin < 1.0.4 is vulnerable to Privilege Escalation

Software Biometric Login for WooCommerce Type Plugin Vulnerable versions 1.0.4 Fixed in 1.0.4 OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE N/A Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 23f90f576a47 Credits Alexander Concha Required...

WordPress wSecure Lite Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Software wSecure Lite Type Plugin Vulnerable versions = 2.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-39987 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 68d4c9f35275 Credits Rio Darmawan Required privileg...

WordPress Themesflat Addons For Elementor Plugin <= 2.0.0 is vulnerable to PHP Object Injection

Software Themesflat Addons For Elementor Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.0.1 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-37390 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 27be6a2ff8c6 Credits Robert R Required...

PT-2023-27986 · Omeka · Omeka-S

Name of the Vulnerable Software and Affected Versions: omeka/omeka-s versions prior to 4.0.3 Description: The issue concerns an unrestricted upload of a file with a dangerous type. Recommendations: For versions prior to 4.0.3, update to version 4.0.3 or later to resolve the issue...

PT-2023-26720 · Jeesite · Jeesite

Name of the Vulnerable Software and Affected Versions: jeesite version 1.2.6 Description: An issue in the delete function in the ActModelController class allows authenticated attackers to arbitrarily delete models created by the Administrator. Recommendations: For jeesite version 1.2.6, consider...

WordPress JetElements For Elementor Plugin <= 2.6.10 is vulnerable to Remote Code Execution (RCE)

Software JetElements For Elementor Type Plugin Vulnerable versions = 2.6.10 Fixed in 2.6.11 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2023-39157 Patch priority High CVSS severity High 9 Developer Crocoblock PSID d71d233fe4f0 Credits Rafie Muhammad Patchstack...

WordPress Simple Blog Card Plugin < 1.32 is vulnerable to Sensitive Data Exposure

Software Simple Blog Card Type Plugin Vulnerable versions 1.32 Fixed in 1.32 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e0b1d4664953 Credits N/A Required privilege Subscriber...

WordPress Stripe Payment Gateway for WooCommerce Plugin <= 3.7.7 is vulnerable to Privilege Escalation

Software Stripe Payment Gateway for WooCommerce Type Plugin Vulnerable versions = 3.7.7 Fixed in 3.7.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-3162 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID...

WordPress Upload Media By URL Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Upload Media By URL Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3720 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5ff81e594ed5 Credits Dmitriy Cleantal...

PT-2023-4109 · Google +3 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 115.0.5790.170 Description: The issue is related to a Type Confusion in V8, allowing a remote attacker to perform arbitrary read/write via a crafted HTML page. This can potentially lead to code execution. The...

CVE-2023-33493

An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer ajaxmanager module for PrestaShop through 2.3.0, allows remote attackers to upload dangerous files without restrictions...

WordPress Shop as a Customer for WooCommerce Plugin < 1.2.4 is vulnerable to Privilege Escalation

Software Shop as a Customer for WooCommerce Type Plugin Vulnerable versions 1.2.4 Fixed in 1.2.4 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE N/A Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 10934473fa31 Credi...

WordPress Social Share Icons & Social Share Buttons Plugin <= 3.5.7 is vulnerable to Broken Access Control

Software Social Share Icons & Social Share Buttons Type Plugin Vulnerable versions = 3.5.7 Fixed in 3.5.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 70d3b475ed6b Credits...

WordPress Clone Plugin <= 2.3.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Clone Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3977 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 96ed031b1483 Credits Wordfence Required privilege...

WordPress Ultimate Posts Widget Plugin <= 2.2.4 is vulnerable to Broken Access Control

Software Ultimate Posts Widget Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.2.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 65c113fe970b Credits WordFence Required...

WordPress Ultimate Posts Widget Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Ultimate Posts Widget Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.2.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3977 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ecda45839866 Credits WordFence...

WordPress Redirect Redirection Plugin <= 1.1.3 is vulnerable to Broken Access Control

Software Redirect Redirection Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-0958 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 805c41b36a96 Credits WordFence Required...