WordPress Elementor Addon Elements Plugin <= 1.13.2 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.13.2 Fixed in 1.13.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2792 Patch priority Low CVSS severity Low 6.5 Developer WPVibes PSID ba0e36a92b8e Credits wesley wcraft Require...

WordPress Molongui Plugin <= 4.7.7 is vulnerable to Insecure Direct Object References (IDOR)

Software Molongui Type Plugin Vulnerable versions = 4.7.7 Fixed in 4.7.8 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-30507 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID c7f745bc9de4 Credits CatFather Required...

WordPress Pz-LinkCard Plugin < 2.5.3 is vulnerable to Server Side Request Forgery (SSRF)

Software Pz-LinkCard Type Plugin Vulnerable versions 2.5.3 Fixed in 2.5.3 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-0677 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID f4404e8dcdac Credits Dmitrii Ignatyev Required privilege...

WordPress Fluent CRM Plugin <= 2.8.44 is vulnerable to Cross Site Scripting (XSS)

Software Fluent CRM Type Plugin Vulnerable versions = 2.8.44 Fixed in 2.8.45 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30430 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a52c9396d7a9 Credits Ananda Dhakal Patchstack Required privile...

WordPress WP Travel Engine Plugin <= 5.7.9 is vulnerable to SQL Injection

Software WP Travel Engine Type Plugin Vulnerable versions = 5.7.9 Fixed in 5.8.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30504 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 80130919606b Credits Yudistira Arya Required privilege Administrator...

WordPress Falang multilanguage Plugin <= 1.3.47 is vulnerable to SQL Injection

Software Falang multilanguage Type Plugin Vulnerable versions = 1.3.47 Fixed in 1.3.48 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30495 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 420627fa8863 Credits Jean Tirstan T Required privilege...

WordPress Tumult Hype Animations Plugin <= 1.9.11 is vulnerable to Cross Site Scripting (XSS)

Software Tumult Hype Animations Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-30461 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 98402ce486d0 Credits Majed...

WordPress Events Manager Plugin <= 6.4.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Events Manager Type Plugin Vulnerable versions = 6.4.7.1 Fixed in 6.4.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2111 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b5294cf8d915 Credits Tim Coen Required...

WordPress wp-forecast Plugin <= 9.2 is vulnerable to Cross Site Scripting (XSS)

Software wp-forecast Type Plugin Vulnerable versions = 9.2 Fixed in 9.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30429 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c540200e2b91 Credits LVT-tholv2k Required privilege Contributor...

WordPress Sliced Invoices Plugin <= 3.9.2 is vulnerable to Broken Access Control

Software Sliced Invoices Type Plugin Vulnerable versions = 3.9.2 Fixed in 3.9.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30517 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f6c77e858dd8 Credits Lucio Sá Required privilege...

WordPress OSS Aliyun Plugin <= 1.4.10 is vulnerable to SQL Injection

Software OSS Aliyun Type Plugin Vulnerable versions = 1.4.10 Fixed in 1.4.11 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30494 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID f4acc3b1af32 Credits Majed Refaea Required privilege Administrator...

WordPress Church Admin Plugin <= 4.1.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Church Admin Type Plugin Vulnerable versions = 4.1.7 Fixed in 4.1.8 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-30493 Patch priority Low CVSS severity Low 4.3 Developer Andy Moyle PSID 730279774aaf Credits Peng Zhou Required privileg...

WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom WooCommerce Checkout Fields Editor Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-30518 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1753adeaf82a...

WordPress Geo Controller Plugin <= 8.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Geo Controller Type Plugin Vulnerable versions = 8.6.4 Fixed in 8.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30451 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e663f7c5a611 Credits LVT-tholv2k Required privilege...

WordPress Beaver Builder Plugin <= 2.7.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Beaver Builder Type Plugin Vulnerable versions = 2.7.4.4 Fixed in 2.7.4.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-30425 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c615d50619b7 Credits Khalid Yusuf Require...

CVE-2024-29886

CVE-2024-29886 affects Serverpod; root cause is an outdated password hash algorithm vulnerable to rainbow attacks if the database is compromised. The issue is mitigated by upgrading to Serverpod 1.2.6, which switches to the Argon2id password hash algorithm for the email authentication module. Not...

CVE-2024-28852

Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means that all forms in the Ampache that use rule as a variable are not secure. For example, when querying a song, when querying a podcast, we need to use $rule...

PT-2024-23288 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.7.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting...

CVE-2023-41972 Revert password check incorrect type validation

In some rare cases, there is a password type validation missing in Revert Password check and for some features it could be disabled. Fixed Version: Win ZApp 4.3.0.121 and later...

WordPress Cornerstone Plugin <= 0.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Cornerstone Type Plugin Vulnerable versions = 0.8.0 Fixed in 0.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-28002 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e17127f05be4 Credits Rafie Muhammad Patchstack Required...