PT-2024-24387 · Unknown · Kp4Coder Sync Post With Other Site

Name of the Vulnerable Software and Affected Versions: kp4coder Sync Post With Other Site versions n/a through 1.5.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross-Site Scripting XSS in kp4coder Sync Post With Other Site. Recommendations: For versions...

WordPress Multi Currency For WooCommerce Plugin <= 1.5.5 is vulnerable to Broken Access Control

Software Multi Currency For WooCommerce Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32516 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5c91ef8d2e42 Credits Abdi Pranata...

WordPress Everest Backup Plugin < 2.2.5 is vulnerable to Arbitrary File Upload

Software Everest Backup Type Plugin Vulnerable versions 2.2.5 Fixed in 2.2.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-7201 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID e4434e41add7 Credits Emad Required privilege Administrator Publish...

PT-2024-24443 · Ghozylab · Ghozylab Easy Contact Form Lite

Name of the Vulnerable Software and Affected Versions: GhozyLab Easy Contact Form Lite versions 1.1.23 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Stored XSS in the GhozyLab Eas...

Infinite loop

Overview BouncyCastle is a C implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Infinite loop in ED25519 verification in the ScalarUtil class. An attacker can send a malicious signature and public key to trigger denial of service. Remediation There is ...

WordPress Download Manager Plugin <= 3.2.82 is vulnerable to Bypass Vulnerability

Software Download Manager Type Plugin Vulnerable versions = 3.2.82 Fixed in 3.2.83 OWASP Top 10 A1: Broken Access Control Classification Bypass Vulnerability CVE CVE-2024-32131 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d970a3e505ee Credits Liu Shaohong Required...

WordPress Import Users from CSV Plugin <= 1.2 is vulnerable to PHP Object Injection

Software Import Users from CSV Type Plugin Vulnerable versions = 1.2 Fixed in 1.3 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-32431 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID e3f19c84ef38 Credits Trình Vũ Sonicrrrr from VNPT-VCI Require...

WordPress BWL Advanced FAQ Manager Plugin <= 2.0.3 is vulnerable to SQL Injection

Software BWL Advanced FAQ Manager Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-32136 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 3156ca152b4d Credits Ivan Spiridonov Required privilege...

WordPress Podlove Podcast Publisher Plugin <= 4.0.12 is vulnerable to SQL Injection

Software Podlove Podcast Publisher Type Plugin Vulnerable versions = 4.0.12 Fixed in 4.0.14 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-32139 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID d7f41e298937 Credits Peng Zhou Required privilege...

WordPress ActiveCampaign Plugin <= 8.1.14 is vulnerable to Server Side Request Forgery (SSRF)

Software ActiveCampaign Type Plugin Vulnerable versions = 8.1.14 Fixed in 8.1.15 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-32430 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 8ad18b5a9350 Credits Yuche...

WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Order Delivery Date for WooCommerce Type Plugin Vulnerable versions = 3.20.2 Fixed in 3.21.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32434 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 18c901690cac Credi...

WordPress Easy Contact Form Lite Plugin <= 1.1.23 is vulnerable to Cross Site Scripting (XSS)

Software Easy Contact Form Lite Type Plugin Vulnerable versions = 1.1.23 Fixed in 1.1.25 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32147 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1074c1b0d54 Credits Abdi Pranata Required privile...

WordPress AffiEasy Plugin <= 1.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software AffiEasy Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32435 Patch priority Low CVSS severity Low 4.3 Developer AffiEasy PSID 0bbb7a2d55c1 Credits Dhabaleshwar Das Required privile...

WordPress BA Book Everything Plugin <= 1.6.4 is vulnerable to SQL Injection

Software BA Book Everything Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.6.5 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-32125 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID d47407126364 Credits Thanh Nam Tran Required privilege Contributor...

WordPress Remove Footer Credit Plugin <= 1.0.13 is vulnerable to Cross Site Scripting (XSS)

Software Remove Footer Credit Type Plugin Vulnerable versions = 1.0.13 Fixed in 1.0.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32429 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 27a2181f0b9d Credits savphill Required privilege...

WordPress InstaWP Connect Plugin <= 0.1.0.22 is vulnerable to Arbitrary File Upload

Software InstaWP Connect Type Plugin Vulnerable versions = 0.1.0.22 Fixed in 0.1.0.23 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-2667 Patch priority High CVSS severity High 10 Developer InstaWP PSID 6dfa02024fd7 Credits AtaTurk1925 Required privilege...

WordPress bizcalendar-web Plugin <= 1.1.0.25 is vulnerable to Cross Site Scripting (XSS)

Software bizcalendar-web Type Plugin Vulnerable versions = 1.1.0.25 Fixed in 1.1.0.26 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1780 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 262671a35eab Credits WordFence...

WordPress Novelist Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Novelist Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32093 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID a2c840335cd8 Credits Dhabaleshwar Das Required...

WordPress Event Manager for WooCommerce Plugin <= 4.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Event Manager for WooCommerce Type Plugin Vulnerable versions = 4.1.2 Fixed in 4.1.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32110 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d7bf2c59ce4e Credits...

WordPress Sheets To WP Table Live Sync Plugin <= 3.5.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Sheets To WP Table Live Sync Type Plugin Vulnerable versions = 3.5.0 Fixed in 3.5.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32110 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d93f2ef6de2e Credits...