WordPress Locatoraid Store Locator Plugin <= 3.9.18 is vulnerable to Cross Site Scripting (XSS)

Software Locatoraid Store Locator Type Plugin Vulnerable versions = 3.9.18 Fixed in 3.9.19 OWASP Top 10 A5: Broken Access Control Classification Cross Site Scripting XSS CVE CVE-2023-32576 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 48ffad270d6d Credits Abdi...

WordPress Loginizer Plugin <= 1.7.8 is vulnerable to Cross Site Scripting (XSS)

Software Loginizer Type Plugin Vulnerable versions = 1.7.8 Fixed in 1.7.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2296 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 867402dd8b92 Credits Erwan LR WPScan Required...

WordPress Woodmart Core Plugin <= 1.0.36 is vulnerable to Privilege Escalation

Software Woodmart Core Type Plugin Vulnerable versions = 1.0.36 Fixed in 1.0.37 OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE CVE-2023-32244 Patch priority High CVSS severity High 9.8 Developer Xtemos PSID a0b94835d329 Credits Dave Jong Patchstack Required privile...

WordPress Forget About Shortcode Buttons Plugin <= 2.1.2 is vulnerable to Broken Access Control

Software Forget About Shortcode Buttons Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32579 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 97c2cfa92f61 Credits István Márton...

WordPress Portfolio Gallery – Responsive Image Gallery Plugin <= 1.4.6 is vulnerable to Broken Access Control

Software Portfolio Gallery – Responsive Image Gallery Type Plugin Vulnerable versions = 1.4.6 Fixed in 1.4.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32585 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 46edb5a7cfb0 Credit...

WordPress Slimstat Analytics Plugin <= 5.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Slimstat Analytics Type Plugin Vulnerable versions = 5.0.4 Fixed in 5.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-45366 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7183b75ec323 Credits Rafie Muhammad...

WordPress WoodMart Theme <= 7.2.1 is vulnerable to Cross Site Scripting (XSS)

Software WoodMart Type Theme Vulnerable versions = 7.2.1 Fixed in 7.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32239 Patch priority Medium CVSS severity Medium 5.4 Developer Xtemos PSID 157d641b350c Credits Dave Jong Patchstack Required...

WordPress Dyslexiefont Free Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Dyslexiefont Free Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-32589 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fb7c8442b1dc Credits Yash Kanchhal...

WordPress WoodMart Theme <= 7.2.1 is vulnerable to Broken Access Control

Software WoodMart Type Theme Vulnerable versions = 7.2.1 Fixed in 7.2.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32240 Patch priority Medium CVSS severity Medium 5.4 Developer Xtemos PSID b409a147912c Credits Dave Jong Patchstack Required privilege...

WordPress Custom Base Terms Plugin <= 1.0.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Custom Base Terms Type Plugin Vulnerable versions = 1.0.2.3 Fixed in 1.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2600 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1a97ca0c054e Credits Aymane Mazguiti...

WordPress Custom 404 Pro Plugin < 3.7.3 is vulnerable to Cross Site Scripting (XSS)

Software Custom 404 Pro Type Plugin Vulnerable versions 3.7.3 Fixed in 3.7.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2023 Patch priority High CVSS severity High 7.1 Developer Kunal Nagar PSID f5c6964d03e8 Credits Chien Vuong Required privileg...

WordPress Injection Guard Plugin <= 1.2.1 is vulnerable to Broken Access Control

Software Injection Guard Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32574 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1c70e6bd7c94 Credits Abdi Pranata Required privile...

WordPress Bookly Plugin <= 21.7.1 is vulnerable to Arbitrary File Deletion

Software Bookly Type Plugin Vulnerable versions = 21.7.1 Fixed in 21.8 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-26526 Patch priority Medium CVSS severity Medium 7.7 Developer Claim ownership PSID a06cfd6ac407 Credits Rafie Muhammad Patchstack...

WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure

Software Download Monitor Type Plugin Vulnerable versions = 4.7.60 Fixed in 4.7.70 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2022-45354 Patch priority Low CVSS severity Low 5.3 Developer WPChill PSID 4dbbcebe007d Credits Rafie Muhammad Patchstack...

WordPress Custom Field Suite Plugin <= 2.6.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom Field Suite Type Plugin Vulnerable versions = 2.6.2.1 Fixed in 2.6.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32515 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7c463fb33b0b Credits Taihei Shimamine...

WordPress YITH WooCommerce Gift Cards Premium Plugin <= 3.23.1 is vulnerable to Broken Access Control

Software YITH WooCommerce Gift Cards Premium Type Plugin Vulnerable versions = 3.23.1 Fixed in 3.24.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-44633 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9a5270f7dbc9 Credits...

WordPress Link Whisper Free Plugin <= 0.6.3 is vulnerable to Broken Access Control

Software Link Whisper Free Type Plugin Vulnerable versions = 0.6.3 Fixed in 0.6.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32506 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID aa6cd8128a6f Credits Nguyen Anh Tien...

WordPress Woo Custom Emails Plugin <= 2.2 is vulnerable to Broken Access Control

Software Woo Custom Emails Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32507 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID d401968a61b0 Credits minhtuanact Required privileg...

JVN#59341308: WordPress Plugin "Newsletter" vulnerable to cross-site scripting

WordPress Plugin "Newsletter" provided by Stefano Lissa & The Newsletter Team contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is logging in to the WordPress using the plugin. Solution Update the plugin Update the...

WordPress GiveWP Plugin <= 2.25.3 is vulnerable to PHP Object Injection

Software GiveWP Type Plugin Vulnerable versions = 2.25.3 Fixed in 2.26.0 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-32513 Patch priority High CVSS severity High 7.5 Developer Liquid Web / StellarWP PSID 8e6fd83cfd05 Credits Rafie Muhammad Patchstack Required...