WordPress OceanWP Theme <= 3.5.4 is vulnerable to Local File Inclusion

Software OceanWP Type Theme Vulnerable versions = 3.5.4 Fixed in 3.5.5 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-2476 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 32c5ee7f6e9f Credits Webbernaut Required privilege Subscriber Published 2...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.25 is vulnerable to Server Side Request Forgery (SSRF)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.25 Fixed in 3.2.26 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-24888 Patch priority Low CVSS severity Low 6.4 Developer KadenceWP PSID ca4cec35c250...

WordPress WP ERP Plugin <= 1.12.9 is vulnerable to SQL Injection

Software WP ERP Type Plugin Vulnerable versions = 1.12.9 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0608 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 0daaedf913ab Credits Krzysztof Zając Required privilege Subscriber Published 29...

WordPress Woocommerce Social Media Share Buttons Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Woocommerce Social Media Share Buttons Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31109 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2941fe56e84a Credits Dimas Maula...

WordPress Media Library Assistant Plugin <= 3.13 is vulnerable to Cross Site Scripting (XSS)

Software Media Library Assistant Type Plugin Vulnerable versions = 3.13 Fixed in 3.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2475 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 37f010ff5d22 Credits stealthcopter...

WordPress Calendarista Basic Edition Plugin <= 3.0.5 is vulnerable to Broken Access Control

Software Calendarista Basic Edition Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30534 Patch priority Medium CVSS severity Medium 6.5 Developer Typps PSID 013b5129fc7c Credits Mochamad Sofyan Requir...

WordPress AdsPlace'r – Ad Manager, Inserter, AdSense Ads Plugin <= 1.1.5 is vulnerable to Cross Site Scripting (XSS)

Software AdsPlace'r – Ad Manager, Inserter, AdSense Ads Type Plugin Vulnerable versions = 1.1.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31088 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID f29b9c4efc4a Credits Dim...

WordPress Spiffy Calendar Plugin <= 4.9.10 is vulnerable to Broken Access Control

Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.10 Fixed in 4.9.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30528 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dc2e3924b720 Credits Steven Julian Required...

WordPress Hacklog Down As PDF Plugin <= 2.3.6 is vulnerable to Cross Site Scripting (XSS)

Software Hacklog Down As PDF Type Plugin Vulnerable versions = 2.3.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31090 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 688ae2dee281 Credits Dimas Maulana Required privile...

WordPress Button Plugin <= 1.1.27 is vulnerable to PHP Object Injection

Software Button Type Plugin Vulnerable versions = 1.1.27 Fixed in 1.1.28 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-1872 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID d7ad40b2deb7 Credits Francesco Carlucci Required privilege...

WordPress Yoo Slider Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Yoo Slider Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31106 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7632355b4c8e Credits Dimas Maulana Required privilege...

WordPress DD Rating Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)

Software DD Rating Type Plugin Vulnerable versions = 1.7.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30554 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 84c2a6915ce6 Credits Cronus Required privilege Author Published 29...

WordPress GS Testimonial Slider Plugin <= 3.1.4 is vulnerable to Cross Site Scripting (XSS)

Software GS Testimonial Slider Type Plugin Vulnerable versions = 3.1.4 Fixed in 3.1.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30443 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1861dbb8a0e2 Credits LVT-tholv2k Required privilege...

WordPress PageLayer Plugin <= 1.8.1 is vulnerable to Broken Access Control

Software PageLayer Type Plugin Vulnerable versions = 1.8.1 Fixed in 1.8.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30465 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bc48f4fa9379 Credits Rafie Muhammad Patchstack Required...

WordPress Church Admin Plugin <= 4.1.18 is vulnerable to Broken Access Control

Software Church Admin Type Plugin Vulnerable versions = 4.1.18 Fixed in 4.1.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30505 Patch priority Medium CVSS severity Medium 5.4 Developer Andy Moyle PSID 4be0d3ba3cb9 Credits CatFather Required privilege...

WordPress Post Grid and Gutenberg Blocks Plugin <= 2.2.74 is vulnerable to Cross Site Scripting (XSS)

Software Post Grid and Gutenberg Blocks Type Plugin Vulnerable versions = 2.2.74 Fixed in 2.2.76 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30441 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4841a04f2615 Credits Rafie Muhammad...

WordPress WP Cost Estimation & Payment Forms Builder Plugin <= 10.1.75 is vulnerable to SQL Injection

Software WP Cost Estimation & Payment Forms Builder Type Plugin Vulnerable versions = 10.1.75 Fixed in 10.1.76 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30489 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID b42e5deb44b6 Credits Rafie Muhammad...

WordPress Finale Lite Plugin <= 2.18.0 is vulnerable to Remote Code Execution (RCE)

Software Finale Lite Type Plugin Vulnerable versions = 2.18.0 Fixed in 2.18.1 OWASP Top 10 A1: Broken Access Control Classification Remote Code Execution RCE CVE CVE-2024-30485 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 351260d95e05 Credits Yudistira Arya Required...

WordPress Booking Activities Plugin <= 1.15.19 is vulnerable to Cross Site Scripting (XSS)

Software Booking Activities Type Plugin Vulnerable versions = 1.15.19 Fixed in 1.15.20 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30449 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 43939ea4135f Credits Jean Tirstan T Required...

WordPress Sponsors Plugin <= 3.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Sponsors Type Plugin Vulnerable versions = 3.5.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30483 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fb48b8770a30 Credits Ray Wilson Required privilege Contributor...