WordPress BookingPress Plugin <= 1.0.81 is vulnerable to Insecure Direct Object References (IDOR)

Software BookingPress Type Plugin Vulnerable versions = 1.0.81 Fixed in 1.0.82 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-31296 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1ca5ae451b3c Credits Steven Julian...

WordPress Relevanssi Plugin <= 4.22.1 is vulnerable to Broken Access Control

Software Relevanssi Type Plugin Vulnerable versions = 4.22.1 Fixed in 4.22.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3213 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8c3f0b93ac8a Credits Thura Moe Myint mgthuramoemyint...

WordPress MasterStudy LMS Plugin <= 3.3.3 is vulnerable to Local File Inclusion

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.3 Fixed in 3.3.4 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3136 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 0e613f9f337e Credits Hiroho Shimada Required privilege...

WordPress WP Photo Album Plus Plugin < 8.6.03.005 is vulnerable to Arbitrary File Upload

Software WP Photo Album Plus Type Plugin Vulnerable versions 8.6.03.005 Fixed in 8.6.03.005 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-31286 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID b5fb22d21826 Credits stealthcopter Required...

WordPress Gutenberg Blocks by Kadence Blocks Plugin < 3.2.26 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions 3.2.26 Fixed in 3.2.26 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2509 Patch priority Low CVSS severity Low 6.5 Developer KadenceWP PSID 59ef6d666275 Credits Dmitrii...

WordPress MailMunch – Grow your Email List Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)

Software MailMunch – Grow your Email List Type Plugin Vulnerable versions = 3.1.6 Fixed in 3.1.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31349 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7297ea028cbf Credits Ray Wilson Required...

WordPress Easy Digital Downloads Plugin <= 3.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.6 Fixed in 3.2.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31293 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 89807a8f40a1 Credits Dhabaleshwar...

WordPress ConvertKit Plugin <= 2.4.5 is vulnerable to Sensitive Data Exposure

Software ConvertKit Type Plugin Vulnerable versions = 2.4.5 Fixed in 2.4.6 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-31245 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7d064ae8f23f Credits Joshua Chan...

CVE-2024-31211

WordPress is an open publishing platform for the Web. Unserialization of instances of the WPHTMLToken class allows for code execution via its destruct magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected...

CVE-2024-31211 Remote Code Execution in `WP_HTML_Token`

WordPress is an open publishing platform for the Web. Unserialization of instances of the WPHTMLToken class allows for code execution via its destruct magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected...

DEBIAN-CVE-2024-30266

wasmtime is a runtime for WebAssembly. The 19.0.0 release of Wasmtime contains a regression introduced during its development which can lead to a guest WebAssembly module causing a panic in the host runtime. A valid WebAssembly module, when executed at runtime, may cause this panic. This...

WordPress Spectra Plugin <= 2.10.3 is vulnerable to Cross Site Scripting (XSS)

Software Spectra Type Plugin Vulnerable versions = 2.10.3 Fixed in 2.10.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6486 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2ec9e8bd69ac Credits Akbar Kustirama Required...

WordPress ShopLentor Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.3 Fixed in 2.8.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2868 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1cdf46cdcf3 Credits wesley wcraft Required...

WordPress TaxoPress Plugin <= 3.12.0 is vulnerable to Cross Site Scripting (XSS)

Software TaxoPress Type Plugin Vulnerable versions = 3.12.0 Fixed in 3.20.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2830 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 812b03b02ecc Credits stealthcopter Required...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.17 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.17 Fixed in 3.2.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0598 Patch priority Low CVSS severity Low 5.9 Developer KadenceWP PSID def3561720ef Credits Akbar...

WordPress LayerSlider Plugin 7.9.11 - 7.10.0 is vulnerable to SQL Injection

Software LayerSlider Type Plugin Vulnerable versions 7.9.11 - 7.10.0 Fixed in 7.10.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-2879 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID f3cdf1aebfe3 Credits AmrAwad Required privilege Unauthenticated...

WordPress SecuPress Free Plugin <= 2.2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software SecuPress Free Type Plugin Vulnerable versions = 2.2.5.1 Fixed in 2.2.5.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1504 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e3f0f4ee5647 Credits Lucio Sá Required...

WordPress Elements kit Elementor addons Plugin <= 3.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.0.6 Fixed in 3.0.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1238 Patch priority Low CVSS severity Low 6.5 Developer Wpmet PSID 8734102af007 Credits wesley wcraft Requir...

WordPress MasterStudy LMS Plugin <= 3.3.0 is vulnerable to Local File Inclusion

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-2411 Patch priority High CVSS severity High 9 Developer Claim ownership PSID c509d4c43d0b Credits Hiroho Shimada Required privilege...

WordPress WP Chat App Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Chat App Type Plugin Vulnerable versions = 3.6.2 Fixed in 3.6.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2513 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3da0694e8a8a Credits Ngô Thiên An ancorn Required...