WordPress MainWP Buddy Extension Plugin <= 4.0.1 is vulnerable to Broken Access Control

Software MainWP Buddy Extension Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23747 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 02ced2ec53b5 Credits Dave Jong...

WordPress MainWP WordPress SEO Extension Plugin <= 4.0.1 is vulnerable to Broken Access Control

Software MainWP WordPress SEO Extension Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23746 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID eb8b01abda06 Credits Dave Jon...

WordPress MainWP Maintenance Extension Plugin <= 4.1.1 is vulnerable to Settings Change

Software MainWP Maintenance Extension Type Plugin Vulnerable versions = 4.1.1 Fixed in 4.1.2 OWASP Top 10 A5: Broken Access Control Classification Settings Change CVE CVE-2023-23662 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 8194a64eddf2 Credits Dave Jong...

MainWP Matomo Extension < 4.0.5 - CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

WordPress MainWP Staging Extension Plugin <= 4.0.3 is vulnerable to Broken Access Control

Software MainWP Staging Extension Type Plugin Vulnerable versions = 4.0.3 Fixed in 4.0.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23639 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID bd391a4b93d5 Credits Dave Jong...

WordPress MainWP Matomo Extension Plugin <= 4.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software MainWP Matomo Extension Type Plugin Vulnerable versions = 4.0.4 Fixed in 4.0.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23659 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7f66647065f9 Credits Dave Jong...

WordPress MainWP UpdraftPlus Extension Plugin <= 4.0.6 is vulnerable to Broken Access Control

Software MainWP UpdraftPlus Extension Type Plugin Vulnerable versions = 4.0.6 Fixed in 4.0.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23640 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 075f06640c08 Credits Dave Jong...

WordPress MainWP Google Analytics Extension Plugin <= 4.0.4 is vulnerable to SQL Injection

Software MainWP Google Analytics Extension Type Plugin Vulnerable versions = 4.0.4 Fixed in 4.0.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-23651 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 8c3984a0a5c8 Credits Dave Jong Patchstack Required...

WordPress MainWP Code Snippets Extension Plugin <= 4.0.2 is vulnerable to Arbitrary Code Execution

Software MainWP Code Snippets Extension Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A1: Injection Classification Arbitrary Code Execution CVE CVE-2023-23645 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID bd9b1b1be741 Credits Dave Jong Patchstack...

WordPress MainWP Wordfence Extension Plugin <= 4.0.7 is vulnerable to Broken Access Control

Software MainWP Wordfence Extension Type Plugin Vulnerable versions = 4.0.7 Fixed in 4.0.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-22699 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID aa51573e0a8b Credits Dave Jong...

WordPress MainWP Broken Links Checker Extension Plugin <= 4.0 is vulnerable to SQL Injection

Software MainWP Broken Links Checker Extension Type Plugin Vulnerable versions = 4.0 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-23737 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 1b463b65a14d Credits Dave Jong Patchstack Required...

WordPress MainWP BlogVault Backup Extension Plugin <= 1.3 is vulnerable to Broken Access Control

Software MainWP BlogVault Backup Extension Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23741 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID a23fba51ad99 Credits Dave Jong...

WordPress MainWP Page Speed Extension Plugin <= 4.0.2 is vulnerable to Broken Access Control

Software MainWP Page Speed Extension Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23644 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID c113f0a834c9 Credits Dave Jong...

WordPress MainWP iThemes Security Extension Plugin <= 4.1.1 is vulnerable to Broken Access Control

Software MainWP iThemes Security Extension Type Plugin Vulnerable versions = 4.1.1 Fixed in 4.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23643 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 4ac1fa6eea51 Credits Dave...

WordPress MainWP File Uploader Extension Plugin <= 4.1 is vulnerable to Arbitrary File Deletion

Software MainWP File Uploader Extension Type Plugin Vulnerable versions = 4.1 Fixed in 4.1.1 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-23653 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 7641346095c5 Credits Dave Jong...

WordPress MainWP Post Plus Extension Plugin <= 4.0.3 is vulnerable to Arbitrary Content Deletion

Software MainWP Post Plus Extension Type Plugin Vulnerable versions = 4.0.3 Fixed in 4.1.1 OWASP Top 10 A5: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2023-23666 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 66ca6cd7da00 Credits Dave Jong...

WordPress MainWP Wordfence Extension Plugin <= 4.0.7 is vulnerable to Settings Change

Software MainWP Wordfence Extension Type Plugin Vulnerable versions = 4.0.7 Fixed in 4.0.8 OWASP Top 10 A5: Broken Access Control Classification Settings Change CVE CVE-2023-23669 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID ad99cab21d6e Credits Dave Jong Patchsta...

MAL-2022-410 Malicious code in @mainwp/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5e2d35ce070a98f3a773a2c7d29e92f110054c39e96aa18052308faed35ee9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Activity Log For MainWP plugin <= 1.7.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Activity Log For MainWP plugin versions = 1.7.0. Solution Update the WordPress Activity Log For MainWP plugin to the latest available version at least 1.7.1...

WordPress Activity Log For MainWP plugin <= 1.7.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Activity Log For MainWP plugin versions = 1.7.0. Solution Update the WordPress Activity Log For MainWP plugin to the latest available version at least 1.7.1...