WordPress Easy Social Photos Gallery – MIF Plugin <= 3.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Easy Social Photos Gallery – MIF Type Plugin Vulnerable versions = 3.1.1 Fixed in 3.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 98fee6271dba Credits Rafie Muhammad...

WordPress WP-Cron Status Checker Plugin < 1.2.5 is vulnerable to Cross Site Scripting (XSS)

Software WP-Cron Status Checker Type Plugin Vulnerable versions 1.2.5 Fixed in 1.2.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e78f192bc072 Credits Rafie Muhammad Patchstack...

WordPress EazyDocs Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)

Software EazyDocs Type Plugin Vulnerable versions = 2.2.0 Fixed in 2.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c6b527c9fb24 Credits Rafie Muhammad Patchstack Required...

WordPress Mojito Shipping Plugin < 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Mojito Shipping Type Plugin Vulnerable versions 1.4.3 Fixed in 1.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 836e46da79bb Credits Rafie Muhammad Patchstack Required...

WordPress WP Travel Engine Plugin < 5.7.5 is vulnerable to Cross Site Scripting (XSS)

Software WP Travel Engine Type Plugin Vulnerable versions 5.7.5 Fixed in 5.7.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 801294ac323a Credits Rafie Muhammad Patchstack Require...

WordPress GA4WP: Google Analytics for WordPress Plugin < 2.2.0 is vulnerable to Cross Site Scripting (XSS)

Software GA4WP: Google Analytics for WordPress Type Plugin Vulnerable versions 2.2.0 Fixed in 2.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID afc97efd69b5 Credits Rafie Muhamm...

WordPress Rank Math SEO Plugin <= 1.0.119 is vulnerable to Cross Site Scripting (XSS)

Software Rank Math SEO Type Plugin Vulnerable versions = 1.0.119 Fixed in 1.0.119.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32600 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fbe17eef0220 Credits Rafie Muhammad...

WordPress Contact Form Generator Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form Generator Type Plugin Vulnerable versions = 2.5.5 Fixed in 2.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-37988 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4da7e4864bf8 Credits Arvandy...

WordPress WPBulky Plugin < 1.0.10 is vulnerable to Cross Site Scripting (XSS)

Software WPBulky Type Plugin Vulnerable versions 1.0.10 Fixed in 1.0.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30482 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f12e0267c313 Credits Abde Ouabala Required privilege...

WordPress Quiz And Survey Master Plugin <= 8.1.10 is vulnerable to Broken Access Control

Software Quiz And Survey Master Type Plugin Vulnerable versions = 8.1.10 Fixed in 8.1.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-37984 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 046309de9fe7 Credits qilin99 Required...

CVE-2023-32759

An issue in Archer Platform before v.6.13 and fixed in 6.12.0.6 and 6.13.0 allows an authenticated attacker to obtain sensitive information via a crafted URL...

PT-2023-17641 · WordPress · Buy Me A Coffee – Button/Widget Plugin

Name of the Vulnerable Software and Affected Versions: Buy Me a Coffee – Button and Widget Plugin versions up to, and including, 3.6 Description: The issue arises from insufficient sanitization and escaping on the text value set via the bmc post reception action, allowing authenticated attackers...

CVE-2023-32761

Cross Site Request Forgery CSRF vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to execute arbitrary code via a crafted request...

PT-2023-25125

Name of the Vulnerable Software and Affected Versions Bullwark versions before BLW-2016E-960H Description The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability allows Path Traversal in Bullwark...

WordPress WooCommerce Product Stock Alert Plugin <= 2.0.1 is vulnerable to Sensitive Data Exposure

Software WooCommerce Product Stock Alert Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A5: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-37972 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 90d3154cbc8c Credits Mika Requir...

WordPress All In One WP Security & Firewall Plugin 5.1.9 is vulnerable to Sensitive Data Exposure

Software All In One WP Security & Firewall Type Plugin Vulnerable versions 5.1.9 Fixed in 5.2.0 OWASP Top 10 A4: Insecure Design Classification Sensitive Data Exposure CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 68fc84a40ab7 Credits Unknown Required privilege...

WordPress Post SMTP Plugin <= 2.5.7 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.5.7 Fixed in 2.5.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3082 Patch priority Low CVSS severity Low 7.1 Developer WPExperts PSID c8d98d03e5dd Credits Alex Thomas Required privilege...

WordPress DirectoryPress Plugin <= 3.6.2 is vulnerable to Broken Access Control

Software DirectoryPress Type Plugin Vulnerable versions = 3.6.2 Fixed in 3.6.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-37967 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID f4392bc7ad6f Credits Abdi Pranata Required...

WordPress Mail Control Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Mail Control Type Plugin Vulnerable versions = 0.3.1 Fixed in 0.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3158 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 0eca928a8cff Credits Alex Thomas Required...

WordPress WPFunnels Plugin <= 2.7.15 is vulnerable to Insecure Direct Object References (IDOR)

Software WPFunnels Type Plugin Vulnerable versions = 2.7.15 Fixed in 2.7.16 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE N/A Patch priority Low CVSS severity Low 5.4 Developer WPFunnels Team PSID fefed9db57ed Credits Unknown Required privilege...