WordPress reCAPTCHA Jetpack plugin <= 0.2.2 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin reCAPTCHA Jetpack versions = 0.2.2...

WordPress Ungallery plugin <= 2.2.4 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin UnGallery versions = 2.2.4...

WordPress MF Gig Calendar plugin <= 1.2.1 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin MF Gig Calendar versions = 1.2.1...

WordPress Fancy Product Designer plugin < 6.1.81 - Admin+ Cross Site Scripting vulnerability

Admin+ Cross Site Scripting vulnerability discovered by Bob Matyas in WordPress Plugin Fancy Product Designer versions 6.1.81...

WordPress Herd Effects plugin < 5.2.7 - Effect Deletion via CSRF vulnerability

Effect Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Herd Effects versions 5.2.7...

WordPress Sticky Buttons plugin < 3.2.4 - Button Deletion via CSRF vulnerability

Button Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Sticky Buttons versions 3.2.4...

WordPress Sticky Buttons Plugin < 3.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Sticky Buttons Type Plugin Vulnerable versions 3.2.4 Fixed in 3.2.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3475 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID c9f456e279d5 Credits Bob Matyas Required...

WordPress Smart Forms plugin < 2.6.96 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Smart Forms versions 2.6.96...

WordPress ENL Newsletter plugin <= 1.0.1 - Campaign Deletion via CSRF vulnerability

Campaign Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin ENL Newsletter versions = 1.0.1...

WordPress ENL Newsletter plugin <= 1.0.1 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin ENL Newsletter versions = 1.0.1...

WordPress Fancy Product Designer plugin < 6.1.8 - Reflected Cross Site Scripting vulnerability

Reflected Cross Site Scripting vulnerability discovered by Bob Matyas in WordPress Plugin Fancy Product Designer versions 6.1.8...

WordPress Advance Search plugin <= 1.1.6 - Shortcode Deletion via CSRF vulnerability

Shortcode Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Advanced Search versions = 1.1.6...

WordPress NPS computy plugin < 2.7.6 - Results Deletion via CSRF vulnerability

Results Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin NPS computy versions 2.7.6...

WordPress Fancy Product Designer plugin < 6.1.81 - Admin+ Cross Site Scripting via Product Title vulnerability

Admin+ Cross Site Scripting via Product Title vulnerability discovered by Bob Matyas in WordPress Plugin Fancy Product Designer versions 6.1.81...

WordPress WPB Show Core plugin < 2.7 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Bob Matyas in WordPress Plugin WPB Show Core versions 2.7...

WordPress Font Farsi plugin <= 1.6.6 - Admin+ Stored XSS in Settings vulnerability

Admin+ Stored XSS in Settings vulnerability discovered by Bob Matyas in WordPress Plugin Font Farsi versions = 1.6.6...

WordPress Bannerlid plugin <= 1.1.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Bob Matyas in WordPress Plugin Bannerlid versions = 1.1.0...

WordPress MM-email2image plugin <= 0.2.5 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin MM-email2image versions = 0.2.5...

WordPress illi Link Party! Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software illi Link Party! Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-7229 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 45a400104ef2 Credits Bob Matyas Required...

WordPress WP Child Theme Generator Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload

Software WP Child Theme Generator Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE CVE-2023-47873 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID e915ca3d162f Credits Dateoljo of BoB 12th...