WordPress Resize at Upload Plus Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Resize at Upload Plus Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25467 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID cded0be39625 Credits Mika Required...

WordPress Metform Elementor Contact Form Builder Plugin <= 3.2.1 is vulnerable to Bypass Vulnerability

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.2.1 Fixed in 3.2.2 OWASP Top 10 A5: Broken Access Control Classification Bypass Vulnerability CVE CVE-2023-0085 Patch priority Low CVSS severity Low 5.3 Developer Wpmet PSID 9ebffbb7ebd5 Credits Mohammed El Amin...

WordPress WP Plugin Manager Plugin < 1.1.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Plugin Manager Type Plugin Vulnerable versions 1.1.8 Fixed in 1.1.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-1088 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d16b9d1e38fc Credits WPScan Required...

WordPress Button Generator – easily Button Builder Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Button Generator – easily Button Builder Type Plugin Vulnerable versions = 2.3.3 Fixed in 2.3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27452 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5f62ad483358 Credit...

WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection

Software Dokan Type Plugin Vulnerable versions = 3.7.12 Fixed in 3.7.13 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-26525 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 3c9e33e0d441 Credits Rafie Muhammad Patchstack Required privilege Vendor...

WordPress Quiz And Survey Master Plugin <= 8.0.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Quiz And Survey Master Type Plugin Vulnerable versions = 8.0.10 Fixed in 8.1.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-26524 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c4b1a4af0da2 Credits Rio Darmawa...

WordPress Correos Oficial Plugin <= 1.3.0.0 is vulnerable to Arbitrary File Download

Software Correos Oficial Type Plugin Vulnerable versions = 1.3.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-0331 Patch priority Low CVSS severity Low 8.6 Developer Claim ownership PSID 8d6ba27c44e0 Credits Andrea Iodice Required...

WordPress Drag and Drop Multiple File Upload – Contact Form 7 Plugin <= 1.3.6.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Drag and Drop Multiple File Upload – Contact Form 7 Type Plugin Vulnerable versions = 1.3.6.5 Fixed in 1.3.6.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-45364 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID...

WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion

Software All In One Favicon Type Plugin Vulnerable versions = 4.7 Fixed in 4.8 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-24416 Patch priority Low CVSS severity Low 6.8 Developer Claim ownership PSID b9929b1d7eae Credits Mika Required privilege...

WordPress Client Portal – Private user pages and login Plugin <= 1.1.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Client Portal – Private user pages and login Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.1.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25968 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 41903f8c3f9...

WordPress Media Library Assistant Plugin < 3.06 is vulnerable to SQL Injection

Software Media Library Assistant Type Plugin Vulnerable versions 3.06 Fixed in 3.06 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0279 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID a816641d579e Credits Daniel Krohmer Fraunhofer IESE Kunal Sharma...

WordPress PayGreen Plugin <= 4.10.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software PayGreen Type Plugin Vulnerable versions = 4.10.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25986 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6c9947e1536c Credits Lokesh Dachepalli Required...

WordPress CSS JS Manager Plugin <= 2.4.49 is vulnerable to Cross Site Request Forgery (CSRF)

Software CSS JS Manager Type Plugin Vulnerable versions = 2.4.49 Fixed in 2.4.49.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47154 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d901e9767d13 Credits rezaduty Require...

WordPress Clio Grow Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Clio Grow Type Plugin Vulnerable versions = 1.0.0 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22683 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5da0567f175d Credits Rio Darmawan Required privile...

WordPress Ditty Plugin <= 3.0.32 is vulnerable to Cross Site Scripting (XSS)

Software Ditty Type Plugin Vulnerable versions = 3.0.32 Fixed in 3.0.33 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23874 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 158d4ac409d4 Credits Rafshanzani Suhada Required...

WordPress JSON Content Importer Plugin <= 1.3.15 is vulnerable to Cross Site Scripting (XSS)

Software JSON Content Importer Type Plugin Vulnerable versions = 1.3.15 Fixed in 1.3.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25485 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8e9e1b4a066a Credits Rio Darmawan...

WordPress Archivist – Custom Archive Templates Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)

Software Archivist – Custom Archive Templates Type Plugin Vulnerable versions = 1.7.4 Fixed in 1.7.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25490 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 476e9981867e Credits...

WordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Link Juice Keeper Type Plugin Vulnerable versions = 2.0.2 Fixed in 2.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25793 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e876a8c5d0a6 Credits Abdi Pranata Required...

WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Social Login and Register Discord, Google, Twitter, LinkedIn Type Plugin Vulnerable versions = 7.5.14 Fixed in 7.6.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23710 Patch priority Low CVSS severity Low 5.9 Developer Claim...

WordPress Cart All In One For WooCommerce Plugin <= 1.1.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Cart All In One For WooCommerce Type Plugin Vulnerable versions = 1.1.10 Fixed in 1.1.11 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46806 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4f842f506d26 Credits C...