WordPress Ultimate Bootstrap Elements for Elementor Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Bootstrap Elements for Elementor Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2132 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID dc6fc1769629 Credit...

WordPress Feather Login Page Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Feather Login Page Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31923 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5a2ea7b8b70e Credits Steven Julian...

PT-2024-2773 · Microsoft · Azure Identity Library For .Net

Name of the Vulnerable Software and Affected Versions: Azure Identity Library for .NET versions prior to the fixed version Description: The vulnerability in the Azure Identity Library for .NET is related to insufficient protection of registration data, which can allow an attacker to gain...

WordPress Soledad Theme <= 8.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Soledad Type Theme Vulnerable versions = 8.4.5 Fixed in 8.4.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31369 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID ccaa49033795 Credits Rafie Muhammad Patchstack...

WordPress Slider Revolution Plugin <= 6.6.20 is vulnerable to Cross Site Scripting (XSS)

Software Slider Revolution Type Plugin Vulnerable versions = 6.6.20 Fixed in 6.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2306 Patch priority Low CVSS severity Low 5.9 Developer ThemePunch PSID 25a221b7c033 Credits wesley wcraft Nikolas - md...

WordPress Soledad Theme <= 8.4.5 is vulnerable to Broken Access Control

Software Soledad Type Theme Vulnerable versions = 8.4.5 Fixed in 8.4.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31367 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e4cc84a70d34 Credits Rafie Muhammad Patchstack Required...

CVE-2024-30269 DataEase has database configuration information exposure vulnerability

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the /de2api/engine/getEngine;.js path via a browser reveals that the platform's database configuration is returned. The vulnerability has...

WordPress Premmerce Product Filter for WooCommerce Plugin <= 3.7.2 is vulnerable to Broken Access Control

Software Premmerce Product Filter for WooCommerce Type Plugin Vulnerable versions = 3.7.2 Fixed in 3.7.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31359 Patch priority Low CVSS severity Low 4.3 Developer Premmerce PSID 053807f2d4c0 Credits Dhabaleshw...

WordPress Email Subscribers & Newsletters Plugin <= 5.7.15 is vulnerable to Cross Site Scripting (XSS)

Software Email Subscribers & Newsletters Type Plugin Vulnerable versions = 5.7.15 Fixed in 5.7.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2656 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a734d5d11361 Credits Peter1...

WordPress Powerkit Plugin <= 2.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Powerkit Type Plugin Vulnerable versions = 2.9.1 Fixed in 2.9.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2458 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5e0fc29651eb Credits Francesco Carlucci Required...

WordPress 5 Stars Rating Funnel Plugin <= 1.2.67 is vulnerable to Arbitrary Content Deletion

Software 5 Stars Rating Funnel Type Plugin Vulnerable versions = 1.2.67 Fixed in 1.3.02 OWASP Top 10 A1: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2024-31358 Patch priority Medium CVSS severity Medium 7.5 Developer Tobias PSID bd96c1e147ac Credits Emili Castells...

WordPress LifterLMS Plugin <= 7.5.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software LifterLMS Type Plugin Vulnerable versions = 7.5.0 Fixed in 7.5.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31363 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 07170935e600 Credits Dhabaleshwar Das Required...

WordPress User Activity Log Plugin <= 1.9 is vulnerable to SQL Injection

Software User Activity Log Type Plugin Vulnerable versions = 1.9 Fixed in 2.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-31356 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 35f222cae91f Credits Muhammad Daffa Required privilege Administrator...

PT-2024-23987 · WordPress · Easy Login Styler

Name of the Vulnerable Software and Affected Versions: Easy Login Styler – White Label Admin Login Page for WordPress versions 1.0.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows for...

SUSE CVE-2024-28182

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK...

WordPress OAuth Server Plugin <= 4.3.3 is vulnerable to Open Redirection

Software OAuth Server Type Plugin Vulnerable versions = 4.3.3 Fixed in 4.4.0 OWASP Top 10 A5: Security Misconfiguration Classification Open Redirection CVE CVE-2024-31253 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 0b209ddaec61 Credits Le Ngoc Anh Required privilege...

WordPress Advanced Local Pickup for WooCommerce Plugin <= 1.6.2 is vulnerable to Broken Access Control

Software Advanced Local Pickup for WooCommerce Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31283 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 66c7c49037fc Credits Majed...

WordPress MPG Plugin <= 3.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software MPG Type Plugin Vulnerable versions = 3.4.0 Fixed in 3.4.1 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-31301 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 018dc38017d4 Credits Majed Refaea Required privilege...

WordPress Media Library Folders Plugin <= 8.1.8 is vulnerable to Directory Traversal

Software Media Library Folders Type Plugin Vulnerable versions = 8.1.8 Fixed in 8.1.9 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-31287 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ba4e95251ee0 Credits Majed Refaea Required privilege Autho...

WordPress Responsive Lightbox Plugin <= 2.4.6 is vulnerable to Broken Access Control

Software Responsive Lightbox Type Plugin Vulnerable versions = 2.4.6 Fixed in 2.4.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31252 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 83c90f09f240 Credits emad Required privilege...