WordPress Post Grid and Gutenberg Blocks Plugin <= 2.2.74 is vulnerable to Cross Site Scripting (XSS)

Software Post Grid and Gutenberg Blocks Type Plugin Vulnerable versions = 2.2.74 Fixed in 2.2.76 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30441 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4841a04f2615 Credits Rafie Muhammad...

WordPress WP Hotel Booking Plugin <= 2.0.9.2 is vulnerable to Broken Access Control

Software WP Hotel Booking Type Plugin Vulnerable versions = 2.0.9.2 Fixed in 2.0.9.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30508 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6573390b6a8f Credits Yudistira Arya...

WordPress Booking Activities Plugin <= 1.15.19 is vulnerable to Cross Site Scripting (XSS)

Software Booking Activities Type Plugin Vulnerable versions = 1.15.19 Fixed in 1.15.20 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30449 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 43939ea4135f Credits Jean Tirstan T Required...

WordPress YITH WooCommerce Account Funds Premium Plugin <= 1.33.0 is vulnerable to Broken Access Control

Software YITH WooCommerce Account Funds Premium Type Plugin Vulnerable versions = 1.33.0 Fixed in 1.34.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30470 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c87cc5ed5cea Credit...

WordPress Contest Gallery Plugin <= 24.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Contest Gallery Type Plugin Vulnerable versions = 24.0.3 Fixed in 24.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30428 Patch priority Medium CVSS severity Medium 7.1 Developer Wasiliy Strecker PSID 36b896a600a2 Credits Dimas Maulana Required...

WordPress Events Manager Plugin <= 6.4.6.4 is vulnerable to Broken Access Control

Software Events Manager Type Plugin Vulnerable versions = 6.4.6.4 Fixed in 6.4.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30515 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 72a426cae60c Credits Abdi Pranata Required...

WordPress Mailster Plugin <= 4.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Mailster Type Plugin Vulnerable versions = 4.0.6 Fixed in 4.0.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30503 Patch priority Medium CVSS severity Medium 7.1 Developer EverPress PSID 3aa28982f4b8 Credits Rafie Muhammad Patchstack Required privilege...

WordPress Limit Attempts by BestWebSoft Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Limit Attempts by BestWebSoft Type Plugin Vulnerable versions = 1.2.9 Fixed in 1.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30439 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 80e85a45df10 Credits Dimas Maulana...

WordPress Brave Popup Builder Plugin <= 0.6.5 is vulnerable to Server Side Request Forgery (SSRF)

Software Brave Popup Builder Type Plugin Vulnerable versions = 0.6.5 Fixed in 0.6.6 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-30453 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 8769cfe45747...

WordPress Favicon Rotator Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)

Software Favicon Rotator Type Plugin Vulnerable versions = 1.2.10 Fixed in 1.2.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-28001 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e90080f8961c Credits Rafie Muhammad Patchstack...

WordPress Tumult Hype Animations Plugin <= 1.9.12 is vulnerable to Arbitrary File Upload

Software Tumult Hype Animations Type Plugin Vulnerable versions = 1.9.12 Fixed in 1.9.13 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-2890 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID 406a74eb182d Credits Peng Zhou Required privileg...

nodejs:18 security update

nodejs 1:18.19.1-1 - Rebase to version 18.19.1 - Fixes: CVE-2024-21892 CVE-2024-22019 high - Fixes: CVE-2023-46809 medium nodejs-nodemon nodejs-packaging...

WordPress Simply Schedule Appointments Plugin <= 1.6.6.20 is vulnerable to Cross Site Scripting (XSS)

Software Simply Schedule Appointments Type Plugin Vulnerable versions = 1.6.6.20 Fixed in 1.6.6.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22311 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fb6daf2f8c79 Credits Rafie Muhamma...

WordPress Sunshine Photo Cart Plugin <= 3.1.1 is vulnerable to PHP Object Injection

Software Sunshine Photo Cart Type Plugin Vulnerable versions = 3.1.1 Fixed in 3.1.2 OWASP Top 10 A1: Broken Access Control Classification PHP Object Injection CVE CVE-2024-30221 Patch priority Medium CVSS severity Medium 5.4 Developer WP Sunshine PSID 7b2cd8d53b2f Credits CatFather Required...

nodejs:18 security update

nodejs 1:18.19.1-1 - Rebase to version 18.19.1 - Fixes: CVE-2024-21892 CVE-2024-22019 high - Fixes: CVE-2023-46809 medium nodejs-nodemon nodejs-packaging...

WordPress Preview E-mails for WooCommerce Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Preview E-mails for WooCommerce Type Plugin Vulnerable versions = 2.2.1 Fixed in 2.2.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b64b027ac25b Credits Rafie Muhammad...

WordPress BEAR Plugin <= 1.1.4.2 is vulnerable to Cross Site Scripting (XSS)

Software BEAR Type Plugin Vulnerable versions = 1.1.4.2 Fixed in 1.1.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30200 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2c6d05b2fb54 Credits Rafie Muhammad Patchstack Required...

WordPress ARMember Plugin <= 4.0.26 is vulnerable to PHP Object Injection

Software ARMember Type Plugin Vulnerable versions = 4.0.26 Fixed in 4.0.27 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-30222 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 7cde346aedaf Credits LVT-tholv2k Required privilege Contributo...

WordPress Church Admin Plugin <= 4.0.27 is vulnerable to SQL Injection

Software Church Admin Type Plugin Vulnerable versions = 4.0.27 Fixed in 4.0.28 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30244 Patch priority Medium CVSS severity Medium 8.5 Developer Andy Moyle PSID f10836385922 Credits LVT-tholv2k Required privilege Contributor...

WordPress WholesaleX Plugin <= 1.3.1 is vulnerable to Broken Access Control

Software WholesaleX Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30234 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d5e0c742e615 Credits Emili Castells Required...