WordPress Shortcodes and extra features for Phlox theme Plugin <= 2.15.7 is vulnerable to Broken Access Control

Software Shortcodes and extra features for Phlox theme Type Plugin Vulnerable versions = 2.15.7 Fixed in 2.15.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31099 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID 6820fd10e35f...

WordPress Spiffy Calendar Plugin <= 4.9.10 is vulnerable to Broken Access Control

Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.10 Fixed in 4.9.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30528 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dc2e3924b720 Credits Steven Julian Required...

WordPress Easy Appointments Plugin <= 3.11.18 is vulnerable to Broken Access Control

Software Easy Appointments Type Plugin Vulnerable versions = 3.11.18 Fixed in 3.11.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-2844 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d5cb3e5ca959 Credits Krzysztof Zając Required...

WordPress Xpro Elementor Addons Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Xpro Elementor Addons Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2250 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7f86252c86a0 Credits Francesco Carlucci...

WordPress Yoo Slider Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Yoo Slider Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31106 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7632355b4c8e Credits Dimas Maulana Required privilege...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.25 is vulnerable to Server Side Request Forgery (SSRF)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.25 Fixed in 3.2.26 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-24888 Patch priority Low CVSS severity Low 6.4 Developer KadenceWP PSID ca4cec35c250...

WordPress Tumult Hype Animations Plugin <= 1.9.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software Tumult Hype Animations Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-30460 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c704327afb62 Credits Majed Refaea...

WordPress WP Cost Estimation & Payment Forms Builder Plugin <= 10.1.75 is vulnerable to SQL Injection

Software WP Cost Estimation & Payment Forms Builder Type Plugin Vulnerable versions = 10.1.75 Fixed in 10.1.76 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30489 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID b42e5deb44b6 Credits Rafie Muhammad...

WordPress Tumult Hype Animations Plugin <= 1.9.11 is vulnerable to Cross Site Scripting (XSS)

Software Tumult Hype Animations Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-30461 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 98402ce486d0 Credits Majed...

WordPress Paid Memberships Pro – Payfast Gateway Add On Plugin <= 1.4.1 is vulnerable to Sensitive Data Exposure

Software Paid Memberships Pro – Payfast Gateway Add On Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.4.2 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-30514 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID...

WordPress Booking Activities Plugin <= 1.15.19 is vulnerable to Cross Site Scripting (XSS)

Software Booking Activities Type Plugin Vulnerable versions = 1.15.19 Fixed in 1.15.20 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30449 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 43939ea4135f Credits Jean Tirstan T Required...

WordPress YITH WooCommerce Account Funds Premium Plugin <= 1.33.0 is vulnerable to Broken Access Control

Software YITH WooCommerce Account Funds Premium Type Plugin Vulnerable versions = 1.33.0 Fixed in 1.34.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30470 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c87cc5ed5cea Credit...

WordPress GS Testimonial Slider Plugin <= 3.1.4 is vulnerable to Cross Site Scripting (XSS)

Software GS Testimonial Slider Type Plugin Vulnerable versions = 3.1.4 Fixed in 3.1.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30443 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1861dbb8a0e2 Credits LVT-tholv2k Required privilege...

WordPress Themify Event Post Plugin <= 1.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Themify Event Post Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30440 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9d185b777884 Credits Dhabaleshwar Das Required privilege...

WordPress Church Admin Plugin <= 4.1.18 is vulnerable to Broken Access Control

Software Church Admin Type Plugin Vulnerable versions = 4.1.18 Fixed in 4.1.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30505 Patch priority Medium CVSS severity Medium 5.4 Developer Andy Moyle PSID 4be0d3ba3cb9 Credits CatFather Required privilege...

WordPress JCH Optimize Plugin <= 4.0.0 is vulnerable to Broken Access Control

Software JCH Optimize Type Plugin Vulnerable versions = 4.0.0 Fixed in 4.0.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30481 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 290d3805d22d Credits Abdi Pranata Required privileg...

WordPress Elementor Addon Elements Plugin <= 1.13.1 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.13.1 Fixed in 1.13.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30422 Patch priority Low CVSS severity Low 6.5 Developer WPVibes PSID 6bbfb63942b1 Credits Khalid Yusuf Required privilege...

WordPress Element Pack Elementor Addons Plugin <= 5.5.3 is vulnerable to SQL Injection

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.5.3 Fixed in 5.5.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30496 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 3d0133376896 Credits Rafie Muhammad Patchstack Required...

WordPress Events Manager Plugin <= 6.4.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Events Manager Type Plugin Vulnerable versions = 6.4.7.1 Fixed in 6.4.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2111 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b5294cf8d915 Credits Tim Coen Required...

WordPress GamiPress Plugin <= 6.8.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software GamiPress Type Plugin Vulnerable versions = 6.8.5 Fixed in 6.8.6 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-30455 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7284ec56cbcf Credits Ananda Dhakal Patchstack Requir...