WordPress Tainacan Plugin <= 0.21.3 is vulnerable to Cross Site Scripting (XSS)

Software Tainacan Type Plugin Vulnerable versions = 0.21.3 Fixed in 0.21.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34794 Patch priority Medium CVSS severity Medium 7.1 Developer Tainacan Community PSID de6ca39cfb12 Credits LVT-tholv2k Required privilege...

WordPress Essential Blocks for Gutenberg Plugin <= 4.5.12 is vulnerable to Cross Site Scripting (XSS)

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions = 4.5.12 Fixed in 4.5.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4891 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d396af2a43d0 Credits João...

WordPress WPB Elementor Addons Plugin <=1.0.9 is vulnerable to Cross Site Scripting (XSS)

Software WPB Elementor Addons Type Plugin Vulnerable versions =1.0.9 Fixed in 1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34791 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7a29099f0d83 Credits Ray Wilson Required privilege...

WordPress ShopLentor Plugin <= 2.8.7 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34767 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 98f1de88eaf5 Credits Ngô Thiên An ancorn from VNPT-VCI Required...

WordPress Fastly Plugin <= 1.2.25 is vulnerable to Broken Access Control

Software Fastly Type Plugin Vulnerable versions = 1.2.25 Fixed in 1.2.26 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-34768 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 070f59834046 Credits Joshua Chan Required privilege...

WordPress Swift Framework Page Builder Plugin < 2024.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Swift Framework Page Builder Type Plugin Vulnerable versions 2024.0.0 Fixed in 2024.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2697 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 571298b5f634 Credits Bob...

WordPress Tutor LMS Plugin <= 2.7.0 is vulnerable to Broken Access Control

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4223 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 86348e33f1ae Credits villu164 Required privilege...

WordPress Tutor LMS Plugin <= 2.7.0 is vulnerable to Insecure Direct Object References (IDOR)

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-4279 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID b3b3270c166a Credits Thanh Nam Tran...

Simple Online Bidding System SQL Injection Vulnerability

Simple Online Bidding System is an online bidding system by oretnom23 individual developer. A SQL injection vulnerability exists in Simple Online Bidding System version 1.0, which stems from an incorrect manipulation of the parameter id that can lead to sql injection...

WordPress Tutor LMS Pro Plugin <= 2.7.0 is vulnerable to Privilege Escalation

Software Tutor LMS Pro Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-4351 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID fc3d215c9303 Credits villu164...

WordPress Elementor – Header, Footer & Blocks Template Plugin <= 1.6.28 is vulnerable to Cross Site Scripting (XSS)

Software Elementor – Header, Footer & Blocks Template Type Plugin Vulnerable versions = 1.6.28 Fixed in 1.6.29 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4634 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1fd6719b0992...

WordPress Tutor LMS Pro Plugin <= 2.7.0 is vulnerable to Broken Access Control

Software Tutor LMS Pro Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-4352 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 7694afbc9e58 Credits villu164 Required privilege...

WordPress Tutor LMS Pro Plugin <= 2.7.0 is vulnerable to Broken Access Control

Software Tutor LMS Pro Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4222 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 2853424c7113 Credits villu164 Required privilege...

WordPress month name translation benaceur Plugin < 2.3.8 is vulnerable to Cross Site Scripting (XSS)

Software month name translation benaceur Type Plugin Vulnerable versions 2.3.8 Fixed in 2.3.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3634 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 56fcc55ec64a Credits Bob Matyas...

WordPress VikBooking Hotel Booking Engine & PMS Plugin < 1.6.8 is vulnerable to Insecure Direct Object References (IDOR)

Software VikBooking Hotel Booking Engine & PMS Type Plugin Vulnerable versions 1.6.8 Fixed in 1.6.8 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-2441 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 7959a03a58d4...

WordPress SP Project & Document Manager Plugin <= 4.71 is vulnerable to Insecure Direct Object References (IDOR)

Software SP Project & Document Manager Type Plugin Vulnerable versions = 4.71 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-3748 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 1c7d92437a35 Credits...

WordPress Advanced Custom Fields PRO Plugin < 6.2.10 is vulnerable to Local File Inclusion

Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 6.2.10 Fixed in 6.2.10 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-34762 Patch priority Low CVSS severity Low 9.9 Developer Claim ownership PSID c63a5562f29a Credits Security audit Required privile...

WordPress All-in-One Video Gallery Plugin <= 3.6.5 is vulnerable to Local File Inclusion

Software All-in-One Video Gallery Type Plugin Vulnerable versions = 3.6.5 Fixed in 3.7.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-4670 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 402ad478bb5f Credits Ngô Thiên An ancorn Required...

WordPress Sydney Toolbox Plugin <= 1.31 is vulnerable to Cross Site Scripting (XSS)

Software Sydney Toolbox Type Plugin Vulnerable versions = 1.31 Fixed in 1.32 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4473 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1fd3834832c Credits Ngô Thiên An ancorn Require...

WordPress Download Alt Text AI Plugin <= 1.4.9 is vulnerable to SQL Injection

Software Download Alt Text AI Type Plugin Vulnerable versions = 1.4.9 Fixed in 1.5.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-4847 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 156a5d33530e Credits Lucio Sá Required privilege Subscriber...