WordPress Bonus for Woo Plugin <= 5.8.2 is vulnerable to Cross Site Scripting (XSS)

Software Bonus for Woo Type Plugin Vulnerable versions = 5.8.2 Fixed in 5.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5140 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bebc071bb4a6 Credits Enrico Marcolini...

WordPress Article analytics Plugin <= 1.0 is vulnerable to SQL Injection

Software Article analytics Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5640 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 78430de01615 Credits Nicolas Surribas Required privilege Unauthenticate...

Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object Injection

Description The plugin unserializes user input via an AJAX action available to unauthenticated users, allowing them to perform PHP Object Injection when a suitable gadget is present on the blog. Run the below command in the developer console of the web browser while being on the blog...

WordPress TK Google Fonts GDPR Compliant Plugin <= 2.2.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software TK Google Fonts GDPR Compliant Type Plugin Vulnerable versions = 2.2.11 Fixed in 2.2.12 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-5823 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 766d6e0e24c8 Credits Mik...

WordPress Post Meta Data Manager Plugin <= 1.2.0 is vulnerable to Broken Access Control

Software Post Meta Data Manager Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5425 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 1def5cff52bd Credits Francesco Carlucci...

WordPress ICS Calendar Plugin <= 10.12.0.3 is vulnerable to Arbitrary File Download

Software ICS Calendar Type Plugin Vulnerable versions = 10.12.0.3 Fixed in 10.12.0.4 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2023-46784 Patch priority Medium CVSS severity Medium 8.2 Developer Claim ownership PSID 662755066f6f Credits Muhammad Daffa Require...

WordPress Fathom Analytics Plugin < 3.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Fathom Analytics Type Plugin Vulnerable versions 3.1.0 Fixed in 3.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 30f046c6503f Credits WordFence Required privilege...

WordPress MomentoPress for Momento360 Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software MomentoPress for Momento360 Type Plugin Vulnerable versions = 1.0.1 Fixed in 1.0.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-46782 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID f1a1dbc78af1 Credits Ngô Thiên An ancorn...

WordPress Thumbnail Slider With Lightbox Plugin <= 1.0 is vulnerable to Arbitrary File Upload

Software Thumbnail Slider With Lightbox Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-5820 Patch priority Low CVSS severity Low 10 Developer Claim ownership PSID 5ea4464f8b32 Credits Ala Arfaoui Required privilege...

WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post Deletion

Description The plugin does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts Run the below command in the developer console of the web browser while being ...

Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affect Rational Business Developer.

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 8 and IBM® Runtime Environment Java™ Version 8 used by Rational Business Developer. Rational Business Developer has provided a fix for the applicable CVE. This issue was disclosed as part of the IBM Java SDK and Runtim...

WordPress Download CloudNet360 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Download CloudNet360 Type Plugin Vulnerable versions = 3.2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46643 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0ee6eb33e2e8 Credits Nithissh S...

WordPress VK Filter Search Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)

Software VK Filter Search Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5705 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8f96b4818f13 Credits István Márton Required...

WordPress Autolinks Manager Plugin <= 1.10.04 is vulnerable to Cross Site Request Forgery (CSRF)

Software Autolinks Manager Type Plugin Vulnerable versions = 1.10.04 Fixed in 1.10.05 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46625 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d40ccdf98f29 Credits Skalucy...

WordPress Glossary Plugin <= 3.1.2 is vulnerable to Broken Access Control

Software Glossary Type Plugin Vulnerable versions = 3.1.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46633 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 27c2b348236a Credits Nguyen Xuan Chien Required privilege...

WordPress WP Word Count Plugin <= 3.2.4 is vulnerable to Broken Access Control

Software WP Word Count Type Plugin Vulnerable versions = 3.2.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46628 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID becf99c528fe Credits Abdi Pranata Required privilege...

JVN#39139884: Movable Type vulnerable to cross-site scripting

Movable Type provided by Six Apart Ltd. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on a logged-in user's web browser. Solution Update the Software Apply the appropriate update according to the information provided by the developer. The develop...

WordPress User Avatar Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS)

Software User Avatar Type Plugin Vulnerable versions = 1.4.11 Fixed in 1.4.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46621 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 37217b2c34b6 Credits Nguyen Xuan Chien...

WordPress WordPress CTA Plugin <= 1.5.8 is vulnerable to Broken Access Control

Software WordPress CTA Type Plugin Vulnerable versions = 1.5.8 Fixed in 1.5.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46644 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 45791c76e335 Credits Abdi Pranata Required...

WordPress Mediabay Plugin <= 1.6 is vulnerable to Broken Access Control

Software Mediabay Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46612 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 01f288807115 Credits emad Required privilege Subscriber...