WordPress is vulnerable to Cross Site Scripting (XSS)

Software WordPress Type WordPress Core Vulnerable versions = 6.2 Fixed in 6.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3d96c6d7db81 Credits Jakub Zoczek Securitum Required...

WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Brands Type Plugin Vulnerable versions = 1.6.45 Fixed in 1.6.46 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32746 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0ef0c0a8b9a1 Credits Rafie Muhammad...

WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software AutomateWoo Type Plugin Vulnerable versions = 5.7.1 Fixed in 5.7.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-32745 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2ce50834e16e Credits Rafie Muhammad Patchsta...

WordPress Essential Addons for Elementor Pro Plugin <= 5.4.8 is vulnerable to Server Side Request Forgery (SSRF)

Software Essential Addons for Elementor Pro Type Plugin Vulnerable versions = 5.4.8 Fixed in 5.4.9 OWASP Top 10 A5: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-32245 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6f79f41d4291 Credits...

WordPress Active Directory Integration / LDAP Integration Plugin <= 4.1.4 is vulnerable to SQL Injection

Software Active Directory Integration / LDAP Integration Type Plugin Vulnerable versions = 4.1.4 Fixed in 4.1.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2599 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID adebea5f18df Credits Marco Wotschka...

New Flaw in WordPress Plugin Used by Over a Million Sites Under Active Exploitation

A security vulnerability has been disclosed in the popular WordPress plugin Essential Addons for Elementor that could be potentially exploited to achieve elevated privileges on affected sites. The issue, tracked as CVE-2023-32243, has been addressed by the plugin maintainers in version 5.7.2 that...

WordPress Community by PeepSo Plugin <= 6.0.9.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Community by PeepSo Type Plugin Vulnerable versions = 6.0.9.0 Fixed in 6.1.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-32092 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b99f695dac2f Credits Skalucy...

WordPress AnyWhere Elementor Plugin < 1.2.8 is vulnerable to Sensitive Data Exposure

Software AnyWhere Elementor Type Plugin Vulnerable versions 1.2.8 Fixed in 1.2.8 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-0443 Patch priority Low CVSS severity Low 5 Developer WPVibes PSID 5959639f04b8 Credits Sanjay Das Required privilege...

WordPress Portfolio Gallery – Responsive Image Gallery Plugin <= 1.4.6 is vulnerable to Broken Access Control

Software Portfolio Gallery – Responsive Image Gallery Type Plugin Vulnerable versions = 1.4.6 Fixed in 1.4.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32585 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 46edb5a7cfb0 Credit...

WordPress WoodMart Theme <= 7.2.1 is vulnerable to Broken Access Control

Software WoodMart Type Theme Vulnerable versions = 7.2.1 Fixed in 7.2.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32240 Patch priority Medium CVSS severity Medium 5.4 Developer Xtemos PSID b409a147912c Credits Dave Jong Patchstack Required privilege...

WordPress Injection Guard Plugin <= 1.2.1 is vulnerable to Broken Access Control

Software Injection Guard Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32574 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1c70e6bd7c94 Credits Abdi Pranata Required privile...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via the function expandmmacparams at /nasm/nasm-pp.c. Remediation There is no fixed version for yasm. References - GitHub Issue Credit: randomssr...

WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure

Software Download Monitor Type Plugin Vulnerable versions = 4.7.60 Fixed in 4.7.70 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2022-45354 Patch priority Low CVSS severity Low 5.3 Developer WPChill PSID 4dbbcebe007d Credits Rafie Muhammad Patchstack...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via the error function at /nasm/nasm-pp.c. Remediation There is no fixed version for yasm. References - GitHub Issue - PoC Credit: randomssr...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via the ppgetline function at /nasm/nasm-pp.c. Remediation There is no fixed version for yasm. References - GitHub Issue - PoC Credit: randomssr...

WordPress Yoast SEO: Local Plugin <= 14.8 is vulnerable to Cross Site Scripting (XSS)

Software Yoast SEO: Local Type Plugin Vulnerable versions = 14.8 Fixed in 14.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32300 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 28e5acd1438d Credits Rafie Muhammad...

WordPress Wise Chat Plugin <= 3.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Wise Chat Type Plugin Vulnerable versions = 3.1.3 Fixed in 3.1.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-32504 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 14930cd15ca4 Credits Justiice Required privile...

WordPress Brands for WooCommerce Plugin <= 3.7.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Brands for WooCommerce Type Plugin Vulnerable versions = 3.7.0.6 Fixed in 3.8.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23667 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4a9e535646db Credits István Márton...

WordPress wordpress vertical image slider plugin Plugin <= 1.2.16 is vulnerable to Cross Site Scripting (XSS)

Software wordpress vertical image slider plugin Type Plugin Vulnerable versions = 1.2.16 Fixed in 1.2.17 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24413 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID da3e59a78609...

WordPress Snow Monkey Forms Plugin <= 5.0.6 is vulnerable to Directory Traversal

Software Snow Monkey Forms Type Plugin Vulnerable versions = 5.0.6 Fixed in 5.0.7 OWASP Top 10 A5: Broken Access Control Classification Directory Traversal CVE N/A Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID dc1f9c2285d8 Credits Unknown Required privilege...