WordPress Predictive Search Plugin <= 1.2.2 is vulnerable to Broken Access Control

Software Predictive Search Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 94b9c33947a8 Credits Unknown Required privilege...

WordPress WP Replicate Post Plugin <= 4.0.2 is vulnerable to SQL Injection

Software WP Replicate Post Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2237 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 93caeb59c55f Credits Marco Wotschka Required privilege Contributor...

WordPress Newsletter Popup Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Newsletter Popup Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0733 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 3312adcb21e4 Credits Lana Codes Required...

WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation

Software Essential Addons for Elementor Type Plugin Vulnerable versions 5.4.0-5.7.1 Fixed in 5.7.2 OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE CVE-2023-32243 Patch priority High CVSS severity High 9.8 Developer WPDeveloper PSID 9f77d447be67 Credits Rafie Muhamma...

WordPress Team Circle Image Slider With Lightbox Plugin <= 1.0.17 is vulnerable to Cross Site Scripting (XSS)

Software Team Circle Image Slider With Lightbox Type Plugin Vulnerable versions = 1.0.17 Fixed in 1.0.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2604 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 4f6a23b77029 Credi...

WordPress Woo Custom Emails Plugin <= 2.2 is vulnerable to Broken Access Control

Software Woo Custom Emails Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32507 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID d401968a61b0 Credits minhtuanact Required privileg...

WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

Software Ultimate Addons for Contact Form 7 Type Plugin Vulnerable versions = 3.1.23 Fixed in 3.1.24 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47586 Patch priority High CVSS severity High 8.2 Developer Themefic PSID 7a22cfa758d5 Credits minhtuanact Required privilege...

WordPress Contact Form 7 extension for Google Map fields Plugin <= 1.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 extension for Google Map fields Type Plugin Vulnerable versions = 1.8.3 Fixed in 1.8.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 3a7978727c74 Credits...

WordPress WP EasyPay Plugin < 4.1 is vulnerable to Cross Site Scripting (XSS)

Software WP EasyPay Type Plugin Vulnerable versions 4.1 Fixed in 4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1465 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 2b3a789b9109 Credits Pablo Sanchez Required privilege...

WordPress Photo Gallery Slideshow & Masonry Tiled Gallery Plugin <= 1.0.13 is vulnerable to Cross Site Scripting (XSS)

Software Photo Gallery Slideshow & Masonry Tiled Gallery Type Plugin Vulnerable versions = 1.0.13 Fixed in 1.0.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2402 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID...

WordPress Custom 404 Pro Plugin <= 3.7.2 is vulnerable to SQL Injection

Software Custom 404 Pro Type Plugin Vulnerable versions = 3.7.2 Fixed in 3.7.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE N/A Patch priority High CVSS severity High 9.8 Developer Kunal Nagar PSID dfc722040ecc Credits N/A Required privilege Unauthenticated Published 25 April, 2023...

WordPress miniOrange's Google Authenticator Plugin <= 5.6.5 is vulnerable to Broken Access Control

Software miniOrange's Google Authenticator Type Plugin Vulnerable versions = 5.6.5 Fixed in 5.6.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-4943 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 1f8ee97c6af1 Credits Ramuel Gal...

WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to SQL Injection

Software Email posts to subscribers Type Plugin Vulnerable versions = 6.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-46818 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID ac023e13840e Credits Le Ngoc Anh Required privilege...

WordPress Thumbnail carousel slider Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

Software Thumbnail carousel slider Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.1.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2120 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID b8405ab8f136 Credits Marco...

WordPress Cloud Manager Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Cloud Manager Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0421 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e0814c8cc2bc Credits Shreya Pohekar Required...

WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt Plugin <= 1.8.5 is vulnerable to Cross Site Scripting (XSS)

Software AdFoxly – Ad Manager, AdSense Ads & Ads.txt Type Plugin Vulnerable versions = 1.8.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30754 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 18d5dd5b8583...

WordPress Pricing Tables For WPBakery Page Builder Plugin < 3.0 is vulnerable to Local File Inclusion

Software Pricing Tables For WPBakery Page Builder Type Plugin Vulnerable versions 3.0 Fixed in 3.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-1274 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID d6cfa024a462 Credits Lana Codes Required...

WordPress Random Text Plugin <= 0.3.0 is vulnerable to SQL Injection

Software Random Text Type Plugin Vulnerable versions = 0.3.0 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0388 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID a97bfdc5fe90 Credits Lana Codes Required privilege Subscriber Published 12...

WordPress Steveas WP Live Chat Shoutbox Plugin <= 1.4.2 is vulnerable to SQL Injection

Software Steveas WP Live Chat Shoutbox Type Plugin Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-1020 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 176c8169feb6 Credits Simone Onofri Donato Onofri Required...

WordPress Steveas WP Live Chat Shoutbox Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Steveas WP Live Chat Shoutbox Type Plugin Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0899 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 96c9d942cc37 Credits Simone...