WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Cross Site Scripting (XSS)

Software RSVPMarker Type Plugin Vulnerable versions = 10.6.6 Fixed in 10.6.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27616 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c71696c6cb5c Credits Muhammad Arsalan...

WordPress Blog2Social Plugin <= 7.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Blog2Social Type Plugin Vulnerable versions = 7.2.0 Fixed in 7.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-40554 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bf0b6787bf84 Credits Phd Required privileg...

WordPress Album and Image Gallery plus Lightbox Plugin <= 1.7 is vulnerable to Broken Access Control

Software Album and Image Gallery plus Lightbox Type Plugin Vulnerable versions = 1.7 Fixed in 1.7.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40200 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 0921c0a66b1c Credits Abdi...

WordPress WP Remote Users Sync Plugin <= 1.2.11 is vulnerable to Broken Access Control

Software WP Remote Users Sync Type Plugin Vulnerable versions = 1.2.11 Fixed in 1.2.12 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-4374 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 367f50681d32 Credits Lana Codes Required...

WordPress Products Quick View for WooCommerce Plugin < 2.3.0 is vulnerable to Broken Access Control

Software Products Quick View for WooCommerce Type Plugin Vulnerable versions 2.3.0 Fixed in 2.3.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID aad335fc32f5 Credits Unknown Required...

CVE-2023-21234

In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...

CVE-2023-21234

In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...

CVE-2023-21234

In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...

WordPress WebLibrarian Plugin <= 3.5.8.4 is vulnerable to Cross Site Scripting (XSS)

Software WebLibrarian Type Plugin Vulnerable versions = 3.5.8.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-29441 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e45d424e6b8c Credits LEE SE HYOUNG...

WordPress Premium Packages Plugin <= 5.7.4 is vulnerable to Privilege Escalation

Software Premium Packages Type Plugin Vulnerable versions = 5.7.4 Fixed in 5.7.5 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-4293 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID fc8d08d3355c Credits Lana...

WordPress Make Paths Relative Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Make Paths Relative Type Plugin Vulnerable versions = 1.3.0 Fixed in 2.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27433 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 624b43fd206b Credits Mika Required...

CVE-2023-21234: Missing Authorization

In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...

Google Wear OS Security Vulnerability

Google Wear OS is a Google-developed operating system from Google, Inc. designed for use in smartwatches, smart bands, and other wearable devices. Google Wear OS suffers from a security vulnerability that stems from a lack of permission checking in the launchConfirmationActivity module of...

PT-2023-18020 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a missing permission check in the launchConfirmationActivity of ChooseLockSettingsHelper.java. This could allow enabling developer options without the lockscreen PIN...

WordPress Password Reset with Code for WordPress REST API Plugin <= 0.0.15 is vulnerable to Broken Authentication

Software Password Reset with Code for WordPress REST API Type Plugin Vulnerable versions = 0.0.15 Fixed in 0.0.16 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-35039 Patch priority Low CVSS severity Low 9.8 Developer Be Devious Web Development PSID...

WordPress LINE Notify Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software LINE Notify Type Plugin Vulnerable versions = 1.4.4 Fixed in 1.4.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30497 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 329899cef564 Credits Ivy TOOR, LISA Requir...

2023 OWASP Top-10 Series: API3:2023 Broken Object Property Level Authorization

Welcome to the 4th post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API3:2023 Broken Object Property Level Authorization. In this series we are taking an in-depth look at each category – the detail...

WordPress Portfolio and Projects Plugin <= 1.3.7 is vulnerable to Broken Access Control

Software Portfolio and Projects Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-39995 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 632ef93c7f63 Credits Cat Required privilege...

WordPress MailChimp Forms by MailMunch Plugin <= 3.1.4 is vulnerable to Broken Access Control

Software MailChimp Forms by MailMunch Type Plugin Vulnerable versions = 3.1.4 Fixed in 3.1.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-40203 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1430c7736a5b Credits István Márton...

WordPress ImageRecycle pdf & image compression Plugin <= 3.1.11 is vulnerable to Cross Site Scripting (XSS)

Software ImageRecycle pdf & image compression Type Plugin Vulnerable versions = 3.1.11 Fixed in 3.1.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-40196 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3a5e55d72b53...