WordPress Booking Calendar Contact Form Plugin <= 1.2.34 is vulnerable to Broken Access Control

Software Booking Calendar Contact Form Type Plugin Vulnerable versions = 1.2.34 Fixed in 1.2.35 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25037 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 1c56c1a6fa83 Credits István...

WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Broken Access Control

Software Quick Contact Form Type Plugin Vulnerable versions = 8.0.3.1 Fixed in 8.0.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25035 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4879b77b9e44 Credits yuyudhn Required...

WordPress Ajax Search Lite Plugin <= 4.10.3 is vulnerable to Sensitive Data Exposure

Software Ajax Search Lite Type Plugin Vulnerable versions = 4.10.3 Fixed in 4.11 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2022-38456 Patch priority Medium CVSS severity Medium 4.3 Developer WPdreams PSID 59c3957625b5 Credits István Márton Required...

WordPress Monolit Theme Theme <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Monolit Theme Type Theme Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25041 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 37e734d552d0 Credits RE-ALTER Required...

WordPress WordPress Form Builder Plugin – Gutenberg Forms Plugin <= 2.2.8.3 is vulnerable to Broken Access Control

Software WordPress Form Builder Plugin – Gutenberg Forms Type Plugin Vulnerable versions = 2.2.8.3 Fixed in 2.2.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45803 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4cd389bac6...

Upgraded Q -> 3 from #154 [1675567996775]

Judge has assessed an item in Issue 154 as 3 risk. The relevant finding follows: Erc20Quest.withdrawFee can be called against a quest more than once function withdrawFee public onlyAdminWithdrawAfterEnd IERC20rewardToken.safeTransferprotocolFeeRecipient, protocolFee; The withdrawFee function does...

WordPress Cost Calculator Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software Cost Calculator Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9f3fe5b616f3 Credits Marco Wotschka Required privileg...

WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Responsive Image Gallery, Gallery Album Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-47603 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 679ee9055f30...

WordPress Image Hover Effects - Caption Hover with Carousel Plugin <= 2.8 is vulnerable to Cross Site Scripting (XSS)

Software Image Hover Effects - Caption Hover with Carousel Type Plugin Vulnerable versions = 2.8 Fixed in 3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-45831 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Magazine Edge Theme <= 1.13 is vulnerable to Broken Authentication

Software Magazine Edge Type Theme Vulnerable versions = 1.13 Fixed in N/A OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-25068 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 9064016ee308 Credits Dave Jong Patchstack Required...

K000130496: Overview of F5 vulnerabilities (February 2023)

Security Advisory Description On February 1, 2023, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associate...

WordPress Wufoo Shortcode Plugin < 1.52 is vulnerable to Cross Site Scripting (XSS)

Software Wufoo Shortcode Type Plugin Vulnerable versions 1.52 Fixed in 1.52 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4679 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID bb3df9d73484 Credits István Márton Required...

Upgraded Q -> M from #819 [1675276650768]

Judge has assessed an item in Issue 819 as M risk. The relevant finding follows: If we are going with this specific impact, looks like scenario 2 is valid - but does depend on Rialto making that mistake, so would say that is Medium. This is a duplicate, the primary issue being 723 --- The text wa...

WordPress EmbedStories Plugin < 0.7.5 is vulnerable to Cross Site Scripting (XSS)

Software EmbedStories Type Plugin Vulnerable versions 0.7.5 Fixed in 0.7.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0372 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID f3d2eb858a90 Credits István Márton Required...

WordPress GS Products Slider for WooCommerce Plugin < 1.5.9 is vulnerable to Cross Site Scripting (XSS)

Software GS Products Slider for WooCommerce Type Plugin Vulnerable versions 1.5.9 Fixed in 1.5.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0492 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 912bee63a436 Credits...

WordPress Real Media Library Lite Plugin < 4.18.29 is vulnerable to Cross Site Scripting (XSS)

Software Real Media Library Lite Type Plugin Vulnerable versions 4.18.29 Fixed in 4.18.29 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0285 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 7250628ea15a Credits Bipul...

WordPress EmbedSocial Plugin < 1.1.28 is vulnerable to Cross Site Scripting (XSS)

Software EmbedSocial Type Plugin Vulnerable versions 1.1.28 Fixed in 1.1.28 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0371 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 80b948605bdb Credits István Márton Required...

WordPress GS Filterable Portfolio Plugin < 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software GS Filterable Portfolio Type Plugin Vulnerable versions 1.6.1 Fixed in 1.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0540 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0a94bc0a776f Credits István Márto...

WordPress WP Dark Mode Plugin < 4.0.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Dark Mode Type Plugin Vulnerable versions 4.0.0 Fixed in 4.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4714 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 41e59045340d Credits István Márton Required...

WordPress GS Books Showcase Plugin < 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software GS Books Showcase Type Plugin Vulnerable versions 1.3.1 Fixed in 1.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0541 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 7768af0764d3 Credits István Márton...