WordPress WooCommerce Tools Plugin <= 1.2.9 is vulnerable to Broken Access Control

Software WooCommerce Tools Type Plugin Vulnerable versions = 1.2.9 Fixed in 1.2.10 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1689 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dd5e30ec3dbb Credits Lucio Sá Required privilege...

WordPress Dashboard To-Do List Plugin <= 1.2.0 is vulnerable to Broken Access Control

Software Dashboard To-Do List Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.3.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35723 Patch priority Low CVSS severity Low 4.3 Developer Andrew Rapps PSID e4b3c03fafe1 Credits CatFather Required privileg...

WordPress Bloglo Theme <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

Software Bloglo Type Theme Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35715 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 469488b623d7 Credits stealthcopter Required privilege Contributor...

WordPress EmbedPress Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

Software EmbedPress Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5571 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 09e449af3af2 Credits wesley wcraft Required...

WordPress Login/Signup Popup Plugin <= 2.7.2 is vulnerable to Broken Access Control

Software Login/Signup Popup Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5324 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 8315f4731f19 Credits 1337Wannabe - home Requir...

WordPress Recurring PayPal Donations Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)

Software Recurring PayPal Donations Type Plugin Vulnerable versions = 1.7 Fixed in 1.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35676 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a5da0b5233ca Credits LVT-tholv2k Required privilege...

WordPress Brizy Plugin <= 2.4.43 is vulnerable to Cross Site Scripting (XSS)

Software Brizy Type Plugin Vulnerable versions = 2.4.43 Fixed in 2.4.44 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3667 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cff58ae2952e Credits Webbernaut Required privilege...

WordPress MegaMenu Plugin <= 2.3.12 is vulnerable to Local File Inclusion

Software MegaMenu Type Plugin Vulnerable versions = 2.3.12 Fixed in 2.3.13 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-35677 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 866b59909ea3 Credits Rafie Muhammad Patchstack Required privilege...

WordPress Five Star Restaurant Menu Plugin <= 2.4.16 is vulnerable to Broken Access Control

Software Five Star Restaurant Menu Type Plugin Vulnerable versions = 2.4.16 Fixed in 2.4.17 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5459 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d3ee7a9da89d Credits Lucio Sá Required...

WordPress Admin Notices Manager Plugin <= 1.4.0 is vulnerable to Broken Access Control

Software Admin Notices Manager Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.5.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1717 Patch priority Low CVSS severity Low 4.3 Developer Melapress PSID 95224798df4d Credits Lucio Sá Required privilege...

WordPress Essential Real Estate Plugin <= 4.4.4 is vulnerable to Insecure Direct Object References (IDOR)

Software Essential Real Estate Type Plugin Vulnerable versions = 4.4.4 Fixed in 4.4.5 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-4274 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ccac1e739e5c Credits Lucio S...

WordPress Newsletter Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Newsletter Type Plugin Vulnerable versions = 8.3.4 Fixed in 8.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5317 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a76e0f4cc75c Credits Arkadiusz Hydzik Requir...

WordPress Social Link Pages Plugin <= 1.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Social Link Pages Type Plugin Vulnerable versions = 1.6.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3555 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0d1f020a1aca Credits Lucio Sá Required...

Malicious code in developer-integrity2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87499b0a5443852246ee964cc3d558e39a3f77a688484835c1e33524e1c6fce1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1514 Malicious code in developer-integrity2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87499b0a5443852246ee964cc3d558e39a3f77a688484835c1e33524e1c6fce1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in developer-integrity1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24aecacebeaf253088760161715d22f5ff77c66ecae6b73d9d1a9b984bbf8de0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1513 Malicious code in developer-integrity1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24aecacebeaf253088760161715d22f5ff77c66ecae6b73d9d1a9b984bbf8de0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1512 Malicious code in developer-integrity-avishek (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5cb52fb483ad0e308286bf5982001d04d48d1f0a2f9e6f5123dbe6933680fa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Researchers Uncover RAT-Dropping npm Package Targeting Gulp Users

Cybersecurity researchers have uncovered a new suspicious package uploaded to the npm package registry that's designed to drop a remote access trojan RAT on compromised systems. The package in question is glup-debugger-log, which targets users of the gulp toolkit by masquerading as a "logger for...

Andariel Hackers Target South Korean Institutes with New Dora RAT Malware

The North Korea-linked threat actor known as Andariel has been observed using a new Golang-based backdoor called Dora RAT in its attacks targeting educational institutes, manufacturing firms, and construction businesses in South Korea. "Keylogger, Infostealer, and proxy tools on top of the backdo...