PT-2023-24481 · Emedia Consulting · Simpleredak

Name of the Vulnerable Software and Affected Versions: eMedia Consulting simpleRedak versions up to 2.47.23.05 Description: A stored cross-site scripting XSS issue was found in the component "/de/casting/show/detail/". Recommendations: For versions up to 2.47.23.05, consider restricting access to...

WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin

On May 20, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a Privilege Escalation vulnerability in WPDeveloper’s ReviewX plugin, which is actively installed on more than 10,000 WordPress websites. This vulnerability makes it possible for an...

WordPress Donation Platform for WooCommerce: Fundraising & Donation Management Plugin < 1.2.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Donation Platform for WooCommerce: Fundraising & Donation Management Type Plugin Vulnerable versions 1.2.10 Fixed in 1.2.10 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSI...

WordPress Draw Attention Plugin <= 2.0.11 is vulnerable to Broken Access Control

Software Draw Attention Type Plugin Vulnerable versions = 2.0.11 Fixed in 2.0.12 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2764 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 38c9e02b7556 Credits Alex Thomas Required...

WordPress CRM Perks Forms Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2836 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 82373127ce0e Credits Unknown Required privile...

PT-2023-24461 · Microworld Technologies · Escan

Name of the Vulnerable Software and Affected Versions: Microworld Technologies eScan management console version 14.0.1400.2281 Description: The issue allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval in the New Policy form. This...

WordPress Wordapp Plugin <= 1.5.0 is vulnerable to Broken Access Control

Software Wordapp Type Plugin Vulnerable versions = 1.5.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2987 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 04adbd084262 Credits Lana Codes Required privilege...

Exploit for Cross-site Scripting in Escanav Escan_Management_Console

eScan Management Console 14.0.1400.2281 - Reflected Cross Sit...

WordPress Headless CMS Plugin <= 2.0.3 is vulnerable to Broken Authentication

Software Headless CMS Type Plugin Vulnerable versions = 2.0.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Authentication CVE CVE-2023-34186 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 6f4f9877ae87 Credits Yuki Haruma Required privile...

PT-2023-22385 · Unknown · Edjing Mix

Name of the Vulnerable Software and Affected Versions: edjing Mix version 7.09.01 Description: The issue allows unauthorized apps to cause escalation of privilege attacks by manipulating the database. Recommendations: For edjing Mix version 7.09.01, at the moment, there is no information about a...

WordPress Google Fonts For WordPress Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Google Fonts For WordPress Type Plugin Vulnerable versions = 3.0.0 Fixed in 3.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34180 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4fe4a8a6f7d0 Credits Le Ngo...

WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Download Monitor Type Plugin Vulnerable versions = 4.8.1 Fixed in 4.8.2 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2023-31219 Patch priority Low CVSS severity Low 4.1 Developer WPChill PSID fb7b8d305714 Credits Mika Required privilege Administrator...

WordPress Jetpack Plugin <= 12.1 is vulnerable to Broken Access Control

Software Jetpack Type Plugin Vulnerable versions = 12.1 Fixed in 12.1.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority High CVSS severity High 9 Developer Claim ownership PSID e45930af254c Credits Jetpack Required privilege Author Published 30...

WordPress LH Password Changer Plugin <= 1.55 is vulnerable to Cross Site Request Forgery (CSRF)

Software LH Password Changer Type Plugin Vulnerable versions = 1.55 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-34182 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 19a12f4b7744 Credits Mika Required...

PT-2023-22380 · Unknown · Call Blocker

Name of the Vulnerable Software and Affected Versions: Call Blocker application version 6.6.3 Description: The issue allows attackers to tamper with feature-related data, resulting in a severe elevation of privilege attack. Recommendations: For version 6.6.3, update to a newer version that contai...

Wekan 6.74 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Stored XSS vulnerability in rename functionality product: Wekan Open-Source kanban vulnerable version: =6.74 fixed version: 6.75 or higher CVE number: CVE-2023-28485...

WordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Dynamic QR Code Generator Type Plugin Vulnerable versions = 0.0.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34022 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 663371fa0bd1 Credits thiennv...

WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to SQL Injection

Software WP Report Post Type Plugin Vulnerable versions = 2.1.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-34168 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 8b1f55478a8c Credits Mika Required privilege Editor Published 30 May, 202...

WordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object Injection

Software Gravity Forms Type Plugin Vulnerable versions = 2.7.3 Fixed in 2.7.4 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-28782 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 97930c86f0b1 Credits Rafie Muhammad Patchstack Required privile...

PT-2023-24330 · Skycaiji · Skycaiji

Name of the Vulnerable Software and Affected Versions: skycaiji version 2.5.4 Description: The issue allows attackers to achieve backend Cross Site Scripting XSS by deploying malicious JSON data. This enables potential exploitation of the system. Recommendations: For skycaiji version 2.5.4,...