WordPress Easy Social Icons Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Easy Social Icons Type Plugin Vulnerable versions = 3.2.4 Fixed in 3.2.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-48336 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bfc487ed2abb Credits Ngô Thiên An ancorn from VNPT-VCI...

WordPress Widgets for Google Reviews Plugin <= 11.0.2 is vulnerable to Arbitrary File Upload

Software Widgets for Google Reviews Type Plugin Vulnerable versions = 11.0.2 Fixed in 11.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-48275 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID 5e436d044590 Credits Rafie Muhammad Patchstack...

WordPress Userpro Plugin <= 5.1.1 is vulnerable to Broken Access Control

Software Userpro Type Plugin Vulnerable versions = 5.1.1 Fixed in 5.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6007 Patch priority Low CVSS severity Low 7.3 Developer Claim ownership PSID e8ac26fc5935 Credits István Márton Required privilege...

WordPress PayTR Taksit Tablosu Plugin <= 1.3.1 is vulnerable to Broken Access Control

Software PayTR Taksit Tablosu Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47847 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 9835cf00a16a Credits Abdi Pranata Required...

WordPress Theme Editor Plugin <= 2.7.1 is vulnerable to Arbitrary File Upload

Software Theme Editor Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.8 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE CVE-2023-6091 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID e6961ec7faba Credits Dateoljo of BoB 12th Required privilege...

WordPress WP Child Theme Generator Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload

Software WP Child Theme Generator Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE CVE-2023-47873 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID e915ca3d162f Credits Dateoljo of BoB 12th...

CVE-2023-38314

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated that can be triggered with a crafted GET HTTP request with a missing redirect query string parameter. Triggering this issue results in crashing OpenNDS a Denial-of-Servic...

DEBIAN-CVE-2023-38314

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated that can be triggered with a crafted GET HTTP request with a missing redirect query string parameter. Triggering this issue results in crashing OpenNDS a Denial-of-Servic...

GHSA-6CXR-8Q3M-JWRR Ray Missing Authorization vulnerability

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here:...

CVE-2023-6019

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

WordPress Legal Pages Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Legal Pages Type Plugin Vulnerable versions = 1.3.8 Fixed in 1.3.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-47824 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID b92eaa57c24a Credits Brandon Roldan Required...

WordPress Restaurant & Cafe Addon for Elementor Plugin <= 1.5.3 is vulnerable to Broken Access Control

Software Restaurant & Cafe Addon for Elementor Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47826 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b97882725329 Credits...

WordPress WP EXtra Plugin <= 6.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP EXtra Type Plugin Vulnerable versions = 6.4 Fixed in 6.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-47825 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 19cbe9873db2 Credits Huynh Tien Si Required privile...

WordPress Events Addon for Elementor Plugin <= 2.1.3 is vulnerable to Broken Access Control

Software Events Addon for Elementor Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47827 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 5dbac8531308 Credits Abdi Pranata...

WordPress Forminator Plugin <= 1.27.0 is vulnerable to Arbitrary File Upload

Software Forminator Type Plugin Vulnerable versions = 1.27.0 Fixed in 1.28.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6133 Patch priority Low CVSS severity Low 6.6 Developer WPMU DEV PSID e543496c8db2 Credits István Márton Required privilege Administrator...

WordPress Elementor Addon Elements Plugin <= 1.12.7 is vulnerable to Broken Access Control

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.12.7 Fixed in 1.12.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4723 Patch priority Low CVSS severity Low 5.3 Developer WPVibes PSID e7f9c7b2043a Credits WordFence Required privileg...

WordPress Jetpack Plugin < 12.7 is vulnerable to Clickjacking

Software Jetpack Type Plugin Vulnerable versions 12.7 Fixed in 12.7 OWASP Top 10 A3: Injection Classification Clickjacking CVE CVE-2023-47774 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 18fefcc21cac Credits Rafie Muhammad Patchstack Required privilege Contributor...

WordPress Betheme Theme <= 27.1.1 is vulnerable to Broken Access Control

Software Betheme Type Theme Vulnerable versions = 27.1.1 Fixed in 27.1.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47770 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID f61160742341 Credits Rafie Muhammad Patchstack Required...

WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Scripting (XSS)

Software LayerSlider Type Plugin Vulnerable versions = 7.7.9 Fixed in 7.7.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47786 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID bc229172c2ce Credits Rafie Muhammad Patchstack Required...

WordPress WP Rocket 2.10.3 Local File Inclusion Exploit

Paulos Yibelo discovered and reported this Local File Inclusion vulnerability in WordPress WP Rocket Plugin. This could allow a malicious actor to include local files of the target website and show its output onto the screen. Files which store credentials, such as database credentials, could...