WordPress TrueBooker Plugin <= 1.0.2 is vulnerable to SQL Injection

Software TrueBooker Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-6924 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID bf0618e9b2e8 Credits Project Black Required privilege Unauthenticated...

WordPress WHMpress Plugin <= 6.2-revision-5 is vulnerable to Settings Change

Software WHMpress Type Plugin Vulnerable versions = 6.2-revision-5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43247 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 704c9a1f6dad Credits Dave Jong Patchstack Required...

WordPress Bit Form Pro Plugin <= 2.6.4 is vulnerable to Arbitrary File Deletion

Software Bit Form Pro Type Plugin Vulnerable versions = 2.6.4 Fixed in 2.8.0 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-43248 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID fe35e84633f6 Credits Dave Jong Patchstack Require...

WordPress Ultimate Membership Pro Plugin <= 12.7 is vulnerable to PHP Object Injection

Software Ultimate Membership Pro Type Plugin Vulnerable versions = 12.7 Fixed in 12.8 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-43242 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 4d478cf8c35d Credits Rafie Muhammad Patchstack Required...

WordPress GeoDirectory Plugin <= 2.3.61 is vulnerable to SQL Injection

Software GeoDirectory Type Plugin Vulnerable versions = 2.3.61 Fixed in 2.3.62 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43145 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 15d790cb62ca Credits Trương Hữu Phúc truonghuuphuc Required privilege...

WordPress VikRentCar Plugin <= 1.4.0 is vulnerable to SQL Injection

Software VikRentCar Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.4.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-39653 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 3c514657eb13 Credits justakazh Required privilege Unauthenticated Publish...

WordPress Tainacan Plugin <= 0.21.7 is vulnerable to Arbitrary File Download

Software Tainacan Type Plugin Vulnerable versions = 0.21.7 Fixed in 0.21.8 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-7135 Patch priority High CVSS severity High 6.5 Developer Tainacan Community PSID 93c06fdd2c5c Credits 1337Wannabe Required privile...

WordPress Mercado Pago payments for WooCommerce Plugin 7.3.0 - 7.6.1 is vulnerable to Arbitrary File Download

Software Mercado Pago payments for WooCommerce Type Plugin Vulnerable versions 7.3.0 - 7.6.1 Fixed in 7.6.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Arbitrary File Download CVE CVE-2024-3934 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID e624a5a01127...

WordPress CTX Feed Plugin <= 6.5.6 is vulnerable to Privilege Escalation

Software CTX Feed Type Plugin Vulnerable versions = 6.5.6 Fixed in 6.5.7 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-38775 Patch priority High CVSS severity High 7.2 Developer Claim ownership PSID cbdae09cf674 Credits stealthcopter Required privilege Sh...

WordPress HUSKY Plugin <= 1.3.6 is vulnerable to SQL Injection

Software HUSKY Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.6.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-6457 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 98840dcb4c01 Credits Arkadiusz Hydzik Required privilege Unauthenticated...

WordPress Bug Library Plugin < 2.1.1 is vulnerable to Remote Code Execution (RCE)

Software Bug Library Type Plugin Vulnerable versions 2.1.1 Fixed in 2.1.1 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2024-5450 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 5f64af27fea2 Credits Bob Matyas Required privilege Unauthenticat...

WordPress Form Vibes – Database Manager for Forms Plugin <= 1.4.10 is vulnerable to SQL Injection

Software Form Vibes – Database Manager for Forms Type Plugin Vulnerable versions = 1.4.10 Fixed in 1.4.11 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-5325 Patch priority High CVSS severity High 8.5 Developer WPVibes PSID ede7aa3d2234 Credits Peter Thaleikis Required...

WordPress Woocommerce OpenPos Plugin <= 6.4.4 is vulnerable to Arbitrary File Deletion

Software Woocommerce OpenPos Type Plugin Vulnerable versions = 6.4.4 Fixed in 7.0.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-37932 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 80d70b64099f Credits Dave Jong Patchstack...

WordPress WordPress Form Builder Plugin – Gutenberg Forms Plugin <= 2.2.9 is vulnerable to Arbitrary File Upload

Software WordPress Form Builder Plugin – Gutenberg Forms Type Plugin Vulnerable versions = 2.2.9 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6313 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 6945098cfe6d Credits István Márt...

WordPress IQ Testimonials Plugin <= 2.2.7 is vulnerable to Arbitrary File Upload

Software IQ Testimonials Type Plugin Vulnerable versions = 2.2.7 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6314 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 8b1a4c014222 Credits István Márton Required privilege...

WordPress Modern Events Calendar Plugin <= 7.11.0 is vulnerable to Arbitrary File Upload

Software Modern Events Calendar Type Plugin Vulnerable versions = 7.11.0 Fixed in 7.12.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-5441 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID ef52f2e3acfd Credits Foxyyy Required privilege...

WordPress Paid Memberships Pro Plugin <= 3.0.4 is vulnerable to Insecure Direct Object References (IDOR)

Software Paid Memberships Pro Type Plugin Vulnerable versions = 3.0.4 Fixed in 3.0.5 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-37277 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID dc85580f8dca Credits Rafie...

WordPress Email Subscribers & Newsletters Plugin <= 5.7.25 is vulnerable to SQL Injection

Software Email Subscribers & Newsletters Type Plugin Vulnerable versions = 5.7.25 Fixed in 5.7.26 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-37252 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 3780ace67cce Credits shaman0x01 Required privilege...

WordPress Salon booking system Plugin <= 9.9 is vulnerable to Arbitrary File Deletion

Software Salon booking system Type Plugin Vulnerable versions = 9.9 Fixed in 10.0 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-37231 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 096d4dd72ddd Credits LVT-tholv2k Required...

WordPress WishList Member X Plugin < 3.26.7 is vulnerable to SQL Injection

Software WishList Member X Type Plugin Vulnerable versions 3.26.7 Fixed in 3.26.7 OWASP Top 10 A1: Broken Access Control Classification SQL Injection CVE CVE-2024-37112 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 61954a7187be Credits Dave Jong Patchstack Required...