WordPress Add Categories Post Footer Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Add Categories Post Footer Type Plugin Vulnerable versions = 2.2.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49239 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a0d115d1939f Credits Le Ngoc Anh Required...

WordPress cSlider Plugin <= 2.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software cSlider Type Plugin Vulnerable versions = 2.4.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49221 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fee1f2fb0a1b Credits SOPROBRO Required...

WordPress Ad Inserter Plugin <= 2.7.37 is vulnerable to Cross Site Scripting (XSS)

Software Ad Inserter Type Plugin Vulnerable versions = 2.7.37 Fixed in 2.7.38 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49248 Patch priority Medium CVSS severity Medium 7.1 Developer Igor Funa PSID d47d8c812c52 Credits Rafie Muhammad Patchstack Required...

WordPress Htaccess File Editor Plugin <= 1.0.18 is vulnerable to Broken Access Control

Software Htaccess File Editor Type Plugin Vulnerable versions = 1.0.18 Fixed in 1.0.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-49256 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d6dd94150ebc Credits savphill Require...

WordPress my wooden under construction Theme <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)

Software my wooden under construction Type Theme Vulnerable versions = 2.0.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49269 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6cc0e1da3f3b Credits justakazh Required...

WordPress disconnected Theme <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software disconnected Type Theme Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49268 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8595c00a71d4 Credits justakazh Required privilege...

WordPress CJ Change Howdy Plugin <= 3.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software CJ Change Howdy Type Plugin Vulnerable versions = 3.3.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49223 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d1b937179167 Credits SOPROBRO Requir...

WordPress Easy PayPal Gift Certificate Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Easy PayPal Gift Certificate Type Plugin Vulnerable versions = 1.2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9592 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e85fe46e59dc Credits István...

WordPress FULL Customer Plugin <= 3.1.22 is vulnerable to Cross Site Scripting (XSS)

Software FULL Customer Type Plugin Vulnerable versions = 3.1.22 Fixed in 3.1.23 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9211 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 199342483259 Credits vgo0 Required...

WordPress Linkz.ai Plugin <= 1.1.8 is vulnerable to Broken Access Control

Software Linkz.ai Type Plugin Vulnerable versions = 1.1.8 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9586 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d8f2af1c96f3 Credits István Márton Required privilege...

WordPress PublishPress Revisions Plugin <= 3.5.14 is vulnerable to Cross Site Scripting (XSS)

Software PublishPress Revisions Type Plugin Vulnerable versions = 3.5.14 Fixed in 3.5.15 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9436 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3677d6c152ff Credits vgo0...

WordPress BlockMeister – Block Pattern Builder Plugin <= 3.1.10 is vulnerable to Cross Site Scripting (XSS)

Software BlockMeister – Block Pattern Builder Type Plugin Vulnerable versions = 3.1.10 Fixed in 3.1.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9616 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ebcd0d6a0a49...

WordPress Tainacan Plugin <= 0.21.10 is vulnerable to Cross Site Scripting (XSS)

Software Tainacan Type Plugin Vulnerable versions = 0.21.10 Fixed in 0.21.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9221 Patch priority Medium CVSS severity Medium 7.1 Developer Tainacan Community PSID 3d12acf57920 Credits Colin Xu Required...

WordPress Shortcodes AnyWhere Plugin <= 1.0.1 is vulnerable to Content Injection

Software Shortcodes AnyWhere Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-9581 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 9c5d59c3c6ea Credits Francesco Carlucci Required privilege...

WordPress Maximum Products per User for WooCommerce Plugin <= 4.2.8 is vulnerable to Cross Site Scripting (XSS)

Software Maximum Products per User for WooCommerce Type Plugin Vulnerable versions = 4.2.8 Fixed in 4.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9205 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7a571f465eb2...

WordPress ACF Images Search And Insert Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload

Software ACF Images Search And Insert Type Plugin Vulnerable versions = 1.1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-48035 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID a12f4662ed6d Credits stealthcopter Required...

WordPress Restaurant Reservations Widget Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Restaurant Reservations Widget Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-48023 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f10452fd1d3d Credits Mika Required privile...

WordPress Easy Social Share Buttons Plugin <= 1.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Easy Social Share Buttons Type Plugin Vulnerable versions = 1.4.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8729 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID db873cfad5a2 Credits vgo0...

WordPress Featured Posts with Multiple Custom Groups (FPMCG) Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software Featured Posts with Multiple Custom Groups FPMCG Type Plugin Vulnerable versions = 4.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-48032 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 757e14242f05 Credits Mik...

Upgrade tinyMCE to >= 7.0.0 to mitigate CVE-2024-29881/29203

h3. Issue Summary The current tinyMCE version used on the latest version of Jira is 5.10.9. There are two outstanding CVEs between the delta of 5.10.9 to 7.0.0 that don't seem to be backported yet: CVE-2024-29881 Detail - NVD|https://nvd.nist.gov/vuln/detail/CVE-2024-29881 CVE-2024-29203 Detail -...