WordPress Forminator Plugin <= 1.29.0 is vulnerable to Cross Site Scripting (XSS)

Software Forminator Type Plugin Vulnerable versions = 1.29.0 Fixed in 1.29.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1794 Patch priority Medium CVSS severity Medium 7.1 Developer WPMU DEV PSID adc117fb9f27 Credits wesley wcraft Required...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code in the form of malicious .m4 files in the tarball distributions which have since been taken down. These malicious build files contain build instructions not present in the upstream repository...

CVE-2024-28867 Swift Prometheus un-sanitized metric name or labels can be used to take over exported metrics

Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies un-sanitized string values into metric names or labels, an attacker could make use of this and send a ?lang query parameter containing newlines, or similar...

WordPress Contact Forms by Cimatti Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Contact Forms by Cimatti Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.9.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30549 Patch priority Low CVSS severity Low 5.9 Developer Cimatti Consulting PSID 4e21af5dfa9c Credits Joel Indra Required...

PT-2024-23442 · Unknown · Paid Memberships Pro – Payfast Gateway Add On

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro – Payfast Gateway Add On versions n/a through 1.4.1 Description: The issue is related to the insertion of sensitive information into log files. This could potentially expose sensitive data. Recommendations: For Paid...

WordPress VS Contact Form Plugin <= 14.7 is vulnerable to Bypass Vulnerability

Software VS Contact Form Type Plugin Vulnerable versions = 14.7 Fixed in 14.8 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-30540 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 88383ccd18bb Credits Kyle Sanchez Required privilege...

WordPress Easy Appointments Plugin <= 3.11.18 is vulnerable to Broken Access Control

Software Easy Appointments Type Plugin Vulnerable versions = 3.11.18 Fixed in 3.11.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-2844 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d5cb3e5ca959 Credits Krzysztof Zając Required...

PT-2024-23433 · Vsourz Digital · Vsourz Digital All In One Redirection

Name of the Vulnerable Software and Affected Versions: Vsourz Digital All In One Redirection versions 2.2.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker c...

WordPress OceanWP Theme <= 3.5.4 is vulnerable to Local File Inclusion

Software OceanWP Type Theme Vulnerable versions = 3.5.4 Fixed in 3.5.5 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-2476 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 32c5ee7f6e9f Credits Webbernaut Required privilege Subscriber Published 2...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.25 is vulnerable to Server Side Request Forgery (SSRF)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.25 Fixed in 3.2.26 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-24888 Patch priority Low CVSS severity Low 6.4 Developer KadenceWP PSID ca4cec35c250...

WordPress WP ERP Plugin <= 1.12.9 is vulnerable to SQL Injection

Software WP ERP Type Plugin Vulnerable versions = 1.12.9 Fixed in 1.30.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0952 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 116fb228aac5 Credits Edwin Siebel edwinsiebel Required privilege Administrator...

WordPress Calendarista Basic Edition Plugin <= 3.0.5 is vulnerable to Broken Access Control

Software Calendarista Basic Edition Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30534 Patch priority Medium CVSS severity Medium 6.5 Developer Typps PSID 013b5129fc7c Credits Mochamad Sofyan Requir...

WordPress Media Library Assistant Plugin <= 3.13 is vulnerable to Cross Site Scripting (XSS)

Software Media Library Assistant Type Plugin Vulnerable versions = 3.13 Fixed in 3.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2475 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 37f010ff5d22 Credits stealthcopter...

PT-2024-23381 · Unknown · Pluginops Landing Page Builder

Name of the Vulnerable Software and Affected Versions: PluginOps Landing Page Builder versions 1.5.1.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

WordPress Builderall Builder for WordPress Plugin <= 2.0.1 is vulnerable to Server Side Request Forgery (SSRF)

Software Builderall Builder for WordPress Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-30532 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 22729fc307...

CVE-2024-29882

CVE-2024-29882 affects SRS (simple, high-efficiency real-time video server). The vulnerability lies in the /api/v1/vhosts/vid-?callback= endpoint, where the callback name was not filtered, enabling injection of malicious JavaScript and XSS. Multiple connected sources corroborate that the issue ma...

CVE-2024-29200 API returns timesheet entries a user should not be authorized to view

Kimai is a web-based multi-user time-tracking application. The permission viewothertimesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the viewothertimesheet permission to true, on the frontend, users can only see timesheet...

WordPress PageLayer Plugin <= 1.8.1 is vulnerable to Broken Access Control

Software PageLayer Type Plugin Vulnerable versions = 1.8.1 Fixed in 1.8.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30465 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bc48f4fa9379 Credits Rafie Muhammad Patchstack Required...

WordPress Church Admin Plugin <= 4.1.18 is vulnerable to Broken Access Control

Software Church Admin Type Plugin Vulnerable versions = 4.1.18 Fixed in 4.1.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30505 Patch priority Medium CVSS severity Medium 5.4 Developer Andy Moyle PSID 4be0d3ba3cb9 Credits CatFather Required privilege...

WordPress GamiPress Plugin <= 6.9.0 is vulnerable to Cross Site Scripting (XSS)

Software GamiPress Type Plugin Vulnerable versions = 6.9.0 Fixed in 6.9.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2783 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8fbfaab2d300 Credits Krzysztof Zając Required...