WordPress Table of Contents Plus Plugin <= 2302 is vulnerable to Cross Site Request Forgery (CSRF)

Software Table of Contents Plus Type Plugin Vulnerable versions = 2302 Fixed in 2309 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-44473 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9767a2935241 Credits Muhammad Daffa...

WordPress Onclick Show Popup Plugin <= 8.2 is vulnerable to Cross Site Scripting (XSS)

Software Onclick Show Popup Type Plugin Vulnerable versions = 8.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-44228 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ee7368d7eff0 Credits yuyudhn Required privile...

WordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)

Software Popup contact form Type Plugin Vulnerable versions = 7.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-44265 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 317df4ae4595 Credits Rio Darmawan Required...

WordPress Blocks Plugin <= 1.6.42 is vulnerable to Cross Site Scripting (XSS)

Software Blocks Type Plugin Vulnerable versions = 1.6.42 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-44262 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 02f792d40bcd Credits Rio Darmawan Required privilege...

JVN#17434995: Shihonkanri Plus vulnerable to relative path traversal

Shihonkanri Plus provided by EKAKIN contains a relative path traversal vulnerability CWE-23. Impact An attacker may execute arbitrary code by having a legitimate user import a specially crafted backup file of the product. Solution Update the software Update the software to the latest version...

WordPress WP Job Openings Plugin <= 3.4.2 is vulnerable to Sensitive Data Exposure

Software WP Job Openings Type Plugin Vulnerable versions = 3.4.2 Fixed in 3.4.3 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-4933 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 654671e3575f Credits Dmitrii Ignatyev Require...

WordPress Schema App Structured Data Plugin <= 1.23.1 is vulnerable to Broken Access Control

Software Schema App Structured Data Type Plugin Vulnerable versions = 1.23.1 Fixed in 1.23.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-44258 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 9ad22840c42c Credits Rio Darmawan...

WordPress ActivityPub Plugin < 1.0.0 is vulnerable to Sensitive Data Exposure

Software ActivityPub Type Plugin Vulnerable versions 1.0.0 Fixed in 1.0.0 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-3706 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e5fb73f459f7 Credits Erwan LR WPScan Required privilege...

WordPress ActivityPub Plugin < 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software ActivityPub Type Plugin Vulnerable versions 1.0.0 Fixed in 1.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5057 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7a16cc70d522 Credits Ben Bidner Required privilege...

WordPress ActivityPub Plugin < 1.0.0 is vulnerable to Sensitive Data Exposure

Software ActivityPub Type Plugin Vulnerable versions 1.0.0 Fixed in 1.0.0 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-3707 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1da6b07d6d66 Credits Erwan LR WPScan Required privilege...

WordPress Checkfront Online Booking System Plugin <= 3.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Checkfront Online Booking System Type Plugin Vulnerable versions = 3.6 Fixed in 3.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-44146 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4851b589bde2 Credits BuShiY...

WordPress Simple Posts Ticker Plugin < 1.1.6 is vulnerable to Cross Site Scripting (XSS)

Software Simple Posts Ticker Type Plugin Vulnerable versions 1.1.6 Fixed in 1.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4646 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 90737b96b35d Credits Dmitrii Ignatyev...

WordPress iFrame Plugin <= 4.6 is vulnerable to Cross Site Scripting (XSS)

Software iFrame Type Plugin Vulnerable versions = 4.6 Fixed in 4.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4919 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2abd6971550b Credits Lana Codes & Alex Thomas - Wordfence...

WordPress User Activity Log Pro Plugin < 2.3.4 is vulnerable to Cross Site Scripting (XSS)

Software User Activity Log Pro Type Plugin Vulnerable versions 2.3.4 Fixed in 2.3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5167 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 89ef9c440ecf Credits Bartlomiej Mar...

WordPress Popup Builder Plugin < 4.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Popup Builder Type Plugin Vulnerable versions 4.2.2 Fixed in 4.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3226 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3861c79d8ad1 Credits Dipak Panchal th3.d1pak...

WordPress ActivityPub Plugin < 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software ActivityPub Type Plugin Vulnerable versions 1.0.1 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3746 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4e185588c9f2 Credits Ben Bidner Required privilege...

WordPress User Avatar - Reloaded Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software User Avatar - Reloaded Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4798 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a4fd94410ec4 Credits Dmitrii Ignatyev...

WordPress DoLogin Security Plugin < 3.7 is vulnerable to Cross Site Scripting (XSS)

Software DoLogin Security Type Plugin Vulnerable versions 3.7 Fixed in 3.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4549 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ea7d8ad59ce2 Credits Bartlomiej Marek and...

WordPress Ditty Plugin < 3.1.25 is vulnerable to Cross Site Scripting (XSS)

Software Ditty Type Plugin Vulnerable versions 3.1.25 Fixed in 3.1.25 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4148 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c4ba1ff51af7 Credits Animesh Gaurav Required...

ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure

Description The plugin does not ensure that post titles to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the title of arbitrary post such as draft and private via an IDOR vector Run the below command in the developer console of t...