WordPress Login with YourMembership - YM SSO Login plugin <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes' vulnerability

WordPress Login with YourMembership - YM SSO Login plugin = 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moymdisplaytestattributes' vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin YourMembership Single Sign On versions = 1.1.7...

WordPress Dhivehi Text plugin <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin Dhivehi Text versions = 0.1...

WordPress URLYar plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin URLYar URL Shortner versions = 1.1.0...

WordPress Theme Importer plugin <= 1.0 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Nabil Irawan in WordPress Plugin Theme Importer versions = 1.0...

BIT-PYTHON-MIN-2024-5642 Buffer overread when using an empty list with SSLContext.set_npn_protocols()

CPython 3.9 and earlier doesn't disallow configuring an empty list "" for SSLContext.setnpnprotocols which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used see CVE-2024-5535 for OpenSSL. This vulnerability is of low severity due to NPN being...

BIT-PYTHON-2024-5642 Buffer overread when using an empty list with SSLContext.set_npn_protocols()

CPython 3.9 and earlier doesn't disallow configuring an empty list "" for SSLContext.setnpnprotocols which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used see CVE-2024-5535 for OpenSSL. This vulnerability is of low severity due to NPN being...

WordPress WidgetPack Comment System plugin <= 1.6.1 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Claw.k in WordPress Plugin WidgetPack Comment System versions = 1.6.1...

WordPress Web Accessibility By accessiBe plugin <= 2.10 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Moose Love in WordPress Plugin Web Accessibility By accessiBe versions = 2.10...

WordPress WP Scraper plugin <= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery vulnerability

Authenticated Administrator+ Server-Side Request Forgery vulnerability discovered by Valatty in WordPress Plugin TwentyFourth WP Scraper versions = 5.8.1...

WordPress WP Easy Toggles plugin <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin WP Easy Toggles versions = 1.9.0...

WordPress Course Redirects for Learndash Plugin plugin <= 0.4 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Nabil Irawan in WordPress Plugin Course Redirects for Learndash versions = 0.4...

WordPress Error Log Viewer by BestWebSoft plugin <= 1.1.6 - Authenticated (Administrator+) Arbitrary File Read vulnerability

Authenticated Administrator+ Arbitrary File Read vulnerability discovered by Duc Manh in WordPress Plugin Error Log Viewer by BestWebSoft versions = 1.1.6...

WordPress CM Registration – Tailored tool for seamless login and invitation-based registrations plugin <= 2.5.6 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin CM Registration and Invitation Codes versions = 2.5.6...

WordPress Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin <= 27.0.3 - Unauthenticated CSV Injection vulnerability

Unauthenticated CSV Injection vulnerability discovered by Aurélien BOURDOIS Elymaro in WordPress Plugin Contest Gallery versions = 27.0.3...

WordPress WPC Smart Wishlist for WooCommerce plugin <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation vulnerability

Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin WPC Smart Wishlist for WooCommerce versions = 5.0.3...

WordPress Trinity Audio plugin <= 5.21.0 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by Moose Love in WordPress Plugin Trinity Audio versions = 5.21.0...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.1.6 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by dutafi in WordPress Plugin NEX-Forms versions = 9.1.6...

WordPress My Auctions Allegro plugin <= 3.6.31 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by tmrswrr in WordPress Plugin My auctions allegro versions = 3.6.31...

WordPress WP JobHunt plugin <= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs_job_title’ vulnerability

Authenticated Candidate+ Stored Cross-Site Scripting via ‘csjobtitle’ vulnerability discovered by meghnine islem in WordPress Plugin WP JobHunt versions = 7.6...

WordPress Slider Revolution plugin <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary File Read vulnerability discovered by stealthcopter in WordPress Plugin Slider Revolution versions = 6.7.37...