WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Plugin <= 2.24.14 is vulnerable to Settings Change

Software 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Type Plugin Vulnerable versions = 2.24.14 Fixed in 2.24.18 OWASP Top 10 A3: Injection Classification Settings Change CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 75375faf9c46...

WordPress Post Meta Data Manager Plugin <= 1.2.0 is vulnerable to Broken Access Control

Software Post Meta Data Manager Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5426 Patch priority Medium CVSS severity Medium 7.5 Developer Claim ownership PSID a003d34ca1b2 Credits Francesco Carlucc...

WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.2.0 is vulnerable to Broken Access Control

Software YITH WooCommerce Product Add-Ons Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46635 Patch priority Medium CVSS severity Medium 5.3 Developer YITH PSID e6f126f82710 Credits Elliot Required...

Advisory ROSA-SA-2023-2260

software: upx 4.0.2 OS: ROSA-CHROME packageevrstring: upx-4.0.2-1.src.rpm CVE-ID: CVE-2019-20805 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: plxelf.cpp in UPX before version 3.96 has an integer overflow during unpacking via created values in the PTDYNAMIC segment. CVE-STATUS: Fixed CVE-REV: To close...

WordPress EventON Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

Software EventON Type Plugin Vulnerable versions = 2.2.2 Fixed in 2.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-4635 Patch priority Medium CVSS severity Medium 6.1 Developer Claim ownership PSID 2a9d3b757474 Credits Shuning Xu Required privilege...

WordPress Grid Plus Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Grid Plus Type Plugin Vulnerable versions = 1.3.4 Fixed in 1.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46209 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 08eeb73facf3 Credits Le Ngoc Anh Required...

WordPress PageLayer Plugin < 1.7.7 is vulnerable to Cross Site Scripting (XSS)

Software PageLayer Type Plugin Vulnerable versions 1.7.7 Fixed in 1.7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4687 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a2e6d35b385c Credits Marc Montpas Required...

WordPress Booking Calendar Plugin <= 9.7.3 is vulnerable to Cross Site Scripting (XSS)

Software Booking Calendar Type Plugin Vulnerable versions = 9.7.3 Fixed in 9.7.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4620 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d1f5ad35a7a1 Credits Pablo Sanchez...

WordPress Add Shortcodes Actions And Filters Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Add Shortcodes Actions And Filters Type Plugin Vulnerable versions = 2.0.9 Fixed in 2.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46072 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d320af90840c Credits...

WordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS)

Software FreshMail For WordPress Type Plugin Vulnerable versions = 2.3.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46074 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID bc13c89450f9 Credits LEE SE HYOU...

WordPress Ultimate Taxonomy Manager Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Taxonomy Manager Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-45837 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d8bfd5b3d9c5 Credits thiennv...

WordPress Gutenberg Plugin <= 16.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Type Plugin Vulnerable versions = 16.8.0 Fixed in 16.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-38000 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fc1d5fbe52a2 Credits Rafie Muhammad Patchstack Required...

WordPress WP ULike Plugin <= 4.6.8 is vulnerable to Cross Site Scripting (XSS)

Software WP ULike Type Plugin Vulnerable versions = 4.6.8 Fixed in 4.6.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-45640 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fea9db9362c7 Credits Rafshanzani Suhada...

CVE-2023-5487

Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-5487

Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-5474

Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file. Chromium security severity: Medium...

CVE-2023-5475

Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2023-5479

Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-5476

Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-5481

Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. Chromium security severity: Medium...