WordPress FormCraft Plugin <= 1.2.10 is vulnerable to Broken Access Control

Software FormCraft Type Plugin Vulnerable versions = 1.2.10 Fixed in 1.2.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43157 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1cdc8206182d Credits Manab Jyoti Dowarah Required...

WordPress WPSection Plugin <= 1.3.8 is vulnerable to Local File Inclusion

Software WPSection Type Plugin Vulnerable versions = 1.3.8 Fixed in 1.3.9 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-43165 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cd0a6805dc6f Credits João Pedro S Alcântara Kinorth Required privileg...

WordPress CM Tooltip Glossary Plugin <= 4.3.7 is vulnerable to Cross Site Scripting (XSS)

Software CM Tooltip Glossary Type Plugin Vulnerable versions = 4.3.7 Fixed in 4.3.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43149 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 17450d5816aa Credits LVT-tholv2k Required privilege...

WordPress Cost Calculator Builder Plugin <= 3.2.15 is vulnerable to SQL Injection

Software Cost Calculator Builder Type Plugin Vulnerable versions = 3.2.15 Fixed in 3.2.16 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43144 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID fbb21d9d89fe Credits Trương Hữu Phúc truonghuuphuc Require...

WordPress Ultimate Bootstrap Elements for Elementor Plugin <= 1.4.4 is vulnerable to Local File Inclusion

Software Ultimate Bootstrap Elements for Elementor Type Plugin Vulnerable versions = 1.4.4 Fixed in 1.4.5 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-43140 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 5eacd8a2c878 Credits...

PayPal, Credit Card, and Debit Card Payment: SQL Injection Vulnerabilities

PayPal,Credit Card and Debit Card Payment is a PayPal, Credit Card and Debit Card Payment software by janobe individual developer. A SQL injection vulnerability exists in PayPal,Credit Card and Debit Card Payment version 1.0. An attacker can use this vulnerability to send a specially crafted quer...

WordPress WPBakery Page Builder Plugin <= 7.7 is vulnerable to Local File Inclusion

Software WPBakery Page Builder Type Plugin Vulnerable versions = 7.7 Fixed in 7.8 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-5709 Patch priority Low CVSS severity Low 6.6 Developer WPBakery PSID 1374f7b043bd Credits João Pedro Soares de Alcântara Required privileg...

WordPress Horizontal scrolling announcements Plugin <= 2.4 is vulnerable to SQL Injection

Software Horizontal scrolling announcements Type Plugin Vulnerable versions = 2.4 Fixed in 2.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5000 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID a1ff35c414c3 Credits István Márton Required privilege...

WordPress File Manager Pro Plugin <= 1.8.2 is vulnerable to Settings Change

Software File Manager Pro Type Plugin Vulnerable versions = 1.8.2 Fixed in 1.8.3 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-7031 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID dd2b25032f95 Credits bart Required privilege Subscriber...

WordPress UsersWP Plugin < 1.2.12 is vulnerable to Sensitive Data Exposure

Software UsersWP Type Plugin Vulnerable versions 1.2.12 Fixed in 1.2.12 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6477 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 23cb0cdd0abd Credits Majdeddine Ben Hadj Brahim Require...

WordPress collectchat Plugin < 2.4.4 is vulnerable to Cross Site Scripting (XSS)

Software collectchat Type Plugin Vulnerable versions 2.4.4 Fixed in 2.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6498 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0dd324fc130c Credits Fourcade Required privilege...

Hackers Distributing Malicious Python Packages via Popular Developer Q&A Platform

In yet another sign that threat actors are always looking out for new ways to trick users into downloading malware, it has come to light that the question-and-answer Q&A platform known as Stack Exchange has been abused to direct unsuspecting developers to bogus Python packages capable of draining...

WordPress Sign-up Sheets Plugin <= 2.2.12 is vulnerable to Broken Access Control

Software Sign-up Sheets Type Plugin Vulnerable versions = 2.2.12 Fixed in 2.2.13 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-39654 Patch priority Low CVSS severity Low 5.3 Developer Fetch Designs PSID bf5384db048d Credits Joshua Chan Required privilege...

WordPress Ultimate Classified Listings Plugin < 1.4 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Classified Listings Type Plugin Vulnerable versions 1.4 Fixed in 1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6529 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1fa83322914e Credits Erwan LR...

WordPress Message Filter for Contact Form 7 Plugin <= 1.6.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Message Filter for Contact Form 7 Type Plugin Vulnerable versions = 1.6.1.1 Fixed in 1.6.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39647 Patch priority Medium CVSS severity Medium 7.1 Developer Kofi Mokome PSID 433c6253b9cb Credits Dimas Maulana...

WordPress Essential Addons for Elementor Plugin <= 5.9.26 is vulnerable to Cross Site Scripting (XSS)

Software Essential Addons for Elementor Type Plugin Vulnerable versions = 5.9.26 Fixed in 5.9.27 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39649 Patch priority Low CVSS severity Low 6.5 Developer WPDeveloper PSID a786e5c76954 Credits wcraft Required privilege...

WordPress VikRentCar Plugin <= 1.4.0 is vulnerable to SQL Injection

Software VikRentCar Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.4.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-39653 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 3c514657eb13 Credits justakazh Required privilege Unauthenticated Publish...

WordPress LiquidPoll – Advanced Polls for Creators and Brands Plugin <= 3.3.77 is vulnerable to Cross Site Scripting (XSS)

Software LiquidPoll – Advanced Polls for Creators and Brands Type Plugin Vulnerable versions = 3.3.77 Fixed in 3.3.78 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39655 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID a190a4c0c44f...

WordPress Filter & Grids Plugin <= 2.8.33 is vulnerable to Broken Authentication

Software Filter & Grids Type Plugin Vulnerable versions = 2.8.33 Fixed in 2.8.34 OWASP Top 10 A1: Broken Access Control Classification Broken Authentication CVE CVE-2024-39664 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID bac0e0da8bce Credits RE-ALTER Required privileg...

WordPress Filter & Grids Plugin <= 2.9.2 is vulnerable to Cross Site Scripting (XSS)

Software Filter & Grids Type Plugin Vulnerable versions = 2.9.2 Fixed in 2.9.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39665 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4cff851eecee Credits RE-ALTER Required privilege Contributor...