WordPress Featured Posts with Multiple Custom Groups (FPMCG) Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software Featured Posts with Multiple Custom Groups FPMCG Type Plugin Vulnerable versions = 4.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-48032 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 757e14242f05 Credits Mik...

WordPress Restaurant Reservations Widget Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Restaurant Reservations Widget Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-48023 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f10452fd1d3d Credits Mika Required privile...

Upgrade tinyMCE to >= 7.0.0 to mitigate CVE-2024-29881/29203

h3. Issue Summary The current tinyMCE version used on the latest version of Jira is 5.10.9. There are two outstanding CVEs between the delta of 5.10.9 to 7.0.0 that don't seem to be backported yet: CVE-2024-29881 Detail - NVD|https://nvd.nist.gov/vuln/detail/CVE-2024-29881 CVE-2024-29203 Detail -...

WordPress ThemeHunk Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software ThemeHunk Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8433 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c1773d3ddeac Credits Lucio Sá Required...

WordPress Limit Login Attempts Plugin <= 5.3 is vulnerable to Bypass Vulnerability

Software Limit Login Attempts Type Plugin Vulnerable versions = 5.3 Fixed in 5.4 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2022-4534 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 03e4ff962fd9 Credits rezaduty Required privilege Publishe...

WordPress Contact Form 7 – PayPal & Stripe Add-on Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 – PayPal & Stripe Add-on Type Plugin Vulnerable versions = 2.3 Fixed in 2.3.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-48021 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0e2541d5dd28 Credits Le Ngoc An...

WordPress WooCommerce Multilingual & Multicurrency Plugin <= 5.3.7 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Multilingual & Multicurrency Type Plugin Vulnerable versions = 5.3.7 Fixed in 5.3.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8629 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 83741990a924...

WordPress Rank Math SEO Plugin <= 1.0.228 is vulnerable to Broken Access Control

Software Rank Math SEO Type Plugin Vulnerable versions = 1.0.228 Fixed in 1.0.229 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9161 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ca30124e345e Credits Leo Required privilege...

CVE-2024-9445

The Display Medium Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's displaymediumposts shortcode in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-9445

CVE-2024-9445 refers to a Stored Cross-Site Scripting flaw in the WordPress plugin Display Medium Posts (versions

CVE-2024-9445 Display Medium Posts <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts Shortcode

The Display Medium Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's displaymediumposts shortcode in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

WordPress Display Medium Posts plugin <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via displaymediumposts Shortcode vulnerability discovered by theviper17y in WordPress Plugin Display Medium Posts versions = 5.0.1...

WordPress Auto Amazon Links Plugin <= 5.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Auto Amazon Links Type Plugin Vulnerable versions = 5.4.2 Fixed in 5.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9349 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 432d964bd7ed Credits vgo0 Required...

WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.66 is vulnerable to Cross Site Scripting (XSS)

Software ShiftController Employee Shift Scheduling Type Plugin Vulnerable versions = 4.9.66 Fixed in 4.9.67 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9435 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a5108d6c15b...

WordPress Fish and Ships Plugin <= 1.5.9 is vulnerable to Cross Site Scripting (XSS)

Software Fish and Ships Type Plugin Vulnerable versions = 1.5.9 Fixed in 1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9237 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7e6c47fc694c Credits vgo0 Required privile...

WordPress Display Medium Posts Plugin <= 5.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Display Medium Posts Type Plugin Vulnerable versions = 5.0.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9445 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 06e0b332337b Credits theviper17y Required...

WordPress Quantity Dynamic Pricing & Bulk Discounts for WooCommerce Plugin <= 3.8.0 is vulnerable to Cross Site Scripting (XSS)

Software Quantity Dynamic Pricing & Bulk Discounts for WooCommerce Type Plugin Vulnerable versions = 3.8.0 Fixed in 3.8.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9384 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PS...

WordPress Captcha Bank Plugin <= 4.0.36 is vulnerable to Cross Site Scripting (XSS)

Software Captcha Bank Type Plugin Vulnerable versions = 4.0.36 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9375 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 514f49188a6e Credits vgo0 Required privileg...

WordPress Checkout Field Editor (Checkout Manager) for WooCommerce Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Checkout Field Editor Checkout Manager for WooCommerce Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8499 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Popularis Extra Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Popularis Extra Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9353 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a36990b7c214 Credits vgo0 Required...