PT-2024-39638 · WordPress · Display Medium Posts

Name of the Vulnerable Software and Affected Versions: Display Medium Posts plugin for WordPress versions up to, and including, 5.0.1 Description: The Display Medium Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display medium posts shortcode due to...

WordPress Magazine Blocks Plugin <= 1.3.14 is vulnerable to Cross Site Scripting (XSS)

Software Magazine Blocks Type Plugin Vulnerable versions = 1.3.14 Fixed in 1.3.15 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9218 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d9dae2ee7e0f Credits Colin Xu Require...

WordPress YML for Yandex Market Plugin <= 4.7.2 is vulnerable to Cross Site Scripting (XSS)

Software YML for Yandex Market Type Plugin Vulnerable versions = 4.7.2 Fixed in 4.7.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9378 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0a452bf2f78a Credits Colin Xu...

WordPress MC4WP: Mailchimp Top Bar Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)

Software MC4WP: Mailchimp Top Bar Type Plugin Vulnerable versions = 1.6.0 Fixed in 1.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9210 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c51682c76135 Credits vgo0...

WordPress Broken Link Checker Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

Software Broken Link Checker Type Plugin Vulnerable versions = 2.4.0 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8981 Patch priority Medium CVSS severity Medium 7.1 Developer WPMU DEV PSID 5ef9d4c1245b Credits vgo0 Required privile...

WordPress UltraPress Theme <= 1.2.1 is vulnerable to PHP Object Injection

Software UltraPress Type Theme Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7434 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 4b0bbff9d028 Credits Francesco Carlucci Required privilege...

WordPress Optin Hound Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Optin Hound Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9267 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 08d5a68f0d8b Credits Francesco Carlucci...

WordPress LH Copy Media File Plugin <= 1.08 is vulnerable to Cross Site Scripting (XSS)

Software LH Copy Media File Type Plugin Vulnerable versions = 1.08 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9220 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f98d57ff7d4d Credits Colin Xu Required...

WordPress WP Search Analytics Plugin <= 1.4.10 is vulnerable to Cross Site Scripting (XSS)

Software WP Search Analytics Type Plugin Vulnerable versions = 1.4.10 Fixed in 1.4.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9209 Patch priority Medium CVSS severity Medium 7.1 Developer Cornel Raiu PSID 95b75262f4d2 Credits vgo0 Required...

WordPress WooCommerce – Store Exporter Plugin <= 2.7.2.1 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce – Store Exporter Type Plugin Vulnerable versions = 2.7.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8793 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5baa5a642e95 Credits vgo0...

WordPress PDF Image Generator Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS)

Software PDF Image Generator Type Plugin Vulnerable versions = 1.5.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9241 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 787de1e230e7 Credits vgo0 Required...

WordPress DK PDF Plugin <= 1.9.6 is vulnerable to Cross Site Scripting (XSS)

Software DK PDF Type Plugin Vulnerable versions = 1.9.6 Fixed in 1.9.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8727 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ce80562602cc Credits vgo0 Required privilege...

WordPress Unseen Blog Theme <= 1.0.0 is vulnerable to PHP Object Injection

Software Unseen Blog Type Theme Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7432 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID acc2ad92c272 Credits Francesco Carlucci Required privilege...

WordPress Auto Featured Image from Title Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Auto Featured Image from Title Type Plugin Vulnerable versions = 2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8786 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2889e0c9e9d2 Credits vgo0...

WordPress Custom Banners Plugin <= 3.3 is vulnerable to Cross Site Scripting (XSS)

Software Custom Banners Type Plugin Vulnerable versions = 3.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8799 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID cfcbb86b25ba Credits vgo0 Required privilege...

WordPress Loggedin Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Loggedin Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9228 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ab329401c416 Credits vgo0 Required privilege...

WordPress Author Avatars List/Block Plugin <= 2.1.21 is vulnerable to Cross Site Scripting (XSS)

Software Author Avatars List/Block Type Plugin Vulnerable versions = 2.1.21 Fixed in 2.1.22 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47370 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7fcface20444 Credits Hwang Se-yeon Requir...

WordPress Robokassa payment gateway for Woocommerce Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Robokassa payment gateway for Woocommerce Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47395 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 06b4d95a8c74 Credits Dimas...

WordPress The Ultimate WordPress Toolkit – WP Extended Plugin <= 3.0.8 is vulnerable to Cross Site Scripting (XSS)

Software The Ultimate WordPress Toolkit – WP Extended Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47386 Patch priority Medium CVSS severity Medium 7.1 Developer WP Extended PSID ed865076cee2 Credits Le Ngoc...

WordPress WPCOM Member Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)

Software WPCOM Member Type Plugin Vulnerable versions = 1.5.4 Fixed in 1.5.4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47378 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5f883b482d88 Credits Muhamad Agil Fachrian Required...