WordPress Resize at Upload Plus Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Resize at Upload Plus Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25467 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID cded0be39625 Credits Mika Required...

WordPress Elegant Custom Fonts Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Elegant Custom Fonts Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27436 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID e6a5548377b4 Credits Rio Darmawan...

WordPress WooSupply – Suppliers, Supply Orders and Stock Management Plugin <= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF)

Software WooSupply – Suppliers, Supply Orders and Stock Management Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID f4ff6d9dbad...

WordPress WooVIP – Membership plugin for WordPress and WooCommerce Plugin <= 1.4.4 is vulnerable to Server Side Request Forgery (SSRF)

Software WooVIP – Membership plugin for WordPress and WooCommerce Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID f21710078bd7...

WordPress Admin CSS MU Plugin <= 2.6 is vulnerable to Server Side Request Forgery (SSRF)

Software Admin CSS MU Type Plugin Vulnerable versions = 2.6 Fixed in 2.7 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID f8576e8732f6 Credits Dave Jong Patchstack Required privile...

WordPress UpQode Google Maps Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software UpQode Google Maps Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0094 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 983dbcd3ed03 Credits Lana Codes Requir...

WordPress Resume Builder Plugin <= 3.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Resume Builder Type Plugin Vulnerable versions = 3.1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0078 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 20cd873c2df4 Credits Lana Codes Required...

WordPress Blog Floating Button Plugin <= 1.4.12 is vulnerable to Cross Site Request Forgery (CSRF)

Software Blog Floating Button Type Plugin Vulnerable versions = 1.4.12 Fixed in 1.4.13 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27445 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 7093cf42235a Credits Rio Darmawan...

WordPress Total Poll Lite Plugin <= 4.8.6 is vulnerable to Broken Access Control

Software Total Poll Lite Type Plugin Vulnerable versions = 4.8.6 Fixed in 4.8.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-27449 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 02f4127c29b8 Credits Mika Required privilege...

WordPress WP SMS Plugin < 5.4.13 is vulnerable to Cross Site Scripting (XSS)

Software WP SMS Type Plugin Vulnerable versions 5.4.13 Fixed in 5.4.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2021-24561 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 935be5382779 Credits Muhammad Daffa Required privileg...

WordPress Button Generator – easily Button Builder Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Button Generator – easily Button Builder Type Plugin Vulnerable versions = 2.3.3 Fixed in 2.3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27452 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5f62ad483358 Credit...

WordPress Saan World Clock Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software Saan World Clock Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0145 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID cb720ac68691 Credits Lana Codes Required...

WordPress React Webcam Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

Software React Webcam Type Plugin Vulnerable versions = 1.2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0365 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID cf5bf1433f54 Credits Lana Codes Required...

WordPress Instant Images Plugin <= 5.1.0.2 is vulnerable to Server Side Request Forgery (SSRF)

Software Instant Images Type Plugin Vulnerable versions = 5.1.0.2 Fixed in 5.2.0 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2023-27451 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 7950e8634dee Credits Universe Required...

WordPress DeepL Pro API translation Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software DeepL Pro API translation Type Plugin Vulnerable versions = 2.1.4 Fixed in 2.1.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27446 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6431a2bd8a82 Credits Mika...

ThingsBoard 安全漏洞

Thingsboard is a Java-based platform for IOT devices for monitoring, management, and data collection from the Thingsboard team. A security vulnerability exists in ThingsBoard version 3.4.1 that stems from allowing a low-privileged attacker to gain privilege escalation and become an administrator ...

Jensen of Scandinavia Eagle 1200AC 缓冲区错误漏洞

Jensen of Scandinavia Eagle 1200AC is a router from Jensen. A security vulnerability exists in the Jensen of Scandinavia Eagle 1200AC version V15.03.06.33en, which stems from a heap-based buffer overflow discovered in the wepkey2 parameter of the /goform/WifiBasicSet page...

Devolutions Server SQL注入漏洞

Devolutions Server is an application from Devolutions Canada. provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2022.3.12 and prior versions, which stems from insufficient cleanup of inputs in the document...

CVE-2023-1022

The WP Meta SEO plugin for WordPress is vulnerable to unauthorized options update due to a missing capability check on the wpmsGGSaveInformation function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to update google...

WordPress Advanced Text Widget Plugin <= 2.1.2 is vulnerable to Broken Access Control

Software Advanced Text Widget Type Plugin Vulnerable versions = 2.1.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-26520 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 82b356c5aaa7 Credits Rio Darmawan Required...