WordPress Ninja Forms Google Sheet Connector Plugin < 1.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms Google Sheet Connector Type Plugin Vulnerable versions 1.2.7 Fixed in 1.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2333 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 3ac3c4160a9a Credits Erwan...

WordPress WP Activity Log Plugin < 4.5.2 is vulnerable to Sensitive Data Exposure

Software WP Activity Log Type Plugin Vulnerable versions 4.5.2 Fixed in 4.5.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-2261 Patch priority Medium CVSS severity Medium 4.3 Developer Melapress PSID 40c85e58b056 Credits Marco Wotschka Required...

WordPress Custom 404 Pro Plugin < 3.8.1 is vulnerable to SQL Injection

Software Custom 404 Pro Type Plugin Vulnerable versions 3.8.1 Fixed in 3.8.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2032 Patch priority Low CVSS severity Low 7.6 Developer Kunal Nagar PSID a690a7cf2a89 Credits Alex Sanford Required privilege Administrator Published 2...

WordPress Protect WP Admin Plugin < 4.0 is vulnerable to Bypass Vulnerability

Software Protect WP Admin Type Plugin Vulnerable versions 4.0 Fixed in 4.0 OWASP Top 10 A5: Broken Access Control Classification Bypass Vulnerability CVE CVE-2023-3139 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 4511e654606c Credits Daniel Ruf Required privilege...

WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)

Software Booking Calendar Contact Form Type Plugin Vulnerable versions = 1.2.40 Fixed in 1.2.41 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36384 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5ffa418dea78 Credits B...

WordPress ReDi Restaurant Reservation Plugin <= 23.0211 is vulnerable to Broken Access Control

Software ReDi Restaurant Reservation Type Plugin Vulnerable versions = 23.0211 Fixed in 23.0212 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36510 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 27489b229824 Credits Abdi Pranat...

WordPress Contact Form Email Plugin < 1.3.38 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form Email Type Plugin Vulnerable versions 1.3.38 Fixed in 1.3.38 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2718 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 3c1617231fe6 Credits Andreas Damen...

WordPress Icegram Plugin < 3.1.12 is vulnerable to Cross Site Scripting (XSS)

Software Icegram Type Plugin Vulnerable versions 3.1.12 Fixed in 3.1.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2398 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 94f0d322a79a Credits Erwan LR WPScan Required...

WordPress Float menu Plugin < 5.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Float menu Type Plugin Vulnerable versions 5.0.3 Fixed in 5.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3225 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 59d256b130ab Credits Dipak Panchal th3.d1pak Require...

WordPress Tutor LMS Plugin < 2.2.1 is vulnerable to Broken Access Control

Software Tutor LMS Type Plugin Vulnerable versions 2.2.1 Fixed in 2.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-3133 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 46e68bdc901b Credits A. S. M. Muhiminul Hasan Required...

WordPress KiviCare Plugin < 3.2.1 is vulnerable to Broken Access Control

Software KiviCare Type Plugin Vulnerable versions 3.2.1 Fixed in 3.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2627 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 5c0ff19791d9 Credits Erwan LR WPScan Required privileg...

WordPress Go Pricing Plugin <= 3.3.19 is vulnerable to Broken Access Control

Software Go Pricing Type Plugin Vulnerable versions = 3.3.19 Fixed in 3.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2494 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 71975662f90e Credits Lana Codes Required privilege...

WordPress WPForms Google Sheet Connector Plugin < 3.4.6 is vulnerable to Cross Site Scripting (XSS)

Software WPForms Google Sheet Connector Type Plugin Vulnerable versions 3.4.6 Fixed in 3.4.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2321 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID a08a279b1265 Credits Erwan LR...

WordPress Greeklish-permalink Plugin <= 3.3 is vulnerable to Privilege Escalation

Software Greeklish-permalink Type Plugin Vulnerable versions = 3.3 Fixed in N/A OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE CVE-2023-2495 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID fc7e9236dbd8 Credits Jonas Höbenreich Required...

WordPress Mailtree Log Mail Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Mailtree Log Mail Type Plugin Vulnerable versions = 1.0.0 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3135 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID e74e0d24830e Credits Alex Thomas Required...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (IDOR)

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-23679 Patch priority Low CVSS severity Low 4.6 Developer Claim ownership PSID...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.65 is vulnerable to Arbitrary File Upload

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.65 Fixed in 1.5.66 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-31231 Patch priority High CVSS severity High 9.9 Developer Unlimited Elements PSID...

WordPress WP Custom Cursors Plugin < 3.2 is vulnerable to SQL Injection

Software WP Custom Cursors Type Plugin Vulnerable versions 3.2 Fixed in 3.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2221 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 57dc3e3d3d93 Credits Chien Vuong Required privilege Administrator Published...

WordPress SupportCandy Plugin < 3.1.7 is vulnerable to SQL Injection

Software SupportCandy Type Plugin Vulnerable versions 3.1.7 Fixed in 3.1.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2719 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID c15c7e980643 Credits dc11 Required privilege Subscriber Published 19 June,...

WordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Scripting (XSS)

Software Extra User Details Type Plugin Vulnerable versions = 0.5 Fixed in 0.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-35878 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 612ec2149d25 Credits LEE SE HYOUNG...