WordPress EnvíaloSimple Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Software EnvíaloSimple Type Plugin Vulnerable versions = 2.2 Fixed in 2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32587 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID ce11fde5722d Credits Yudistira Arya Required privilege...

WordPress Slider by 10Web Plugin <= 1.2.54 is vulnerable to Cross Site Scripting (XSS)

Software Slider by 10Web Type Plugin Vulnerable versions = 1.2.54 Fixed in 1.2.55 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32578 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3808548b6dad Credits Dimas Maulana Required privile...

WordPress WP Simple HTML Sitemap Plugin <= 2.8 is vulnerable to Cross Site Scripting (XSS)

Software WP Simple HTML Sitemap Type Plugin Vulnerable versions = 2.8 Fixed in 2.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Scripting XSS CVE CVE-2024-32574 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a36645ce9cc9 Credits CatFather Require...

WordPress DirectoryPress Plugin <= 3.6.7 is vulnerable to Cross Site Scripting (XSS)

Software DirectoryPress Type Plugin Vulnerable versions = 3.6.7 Fixed in 3.6.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32567 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b3b3b9f83549 Credits Yudistira Arya Required privilege...

Stable Channel Update for Desktop

The Stable channel has been updated to 124.0.6367.60/.61 for Windows and Mac and 124.0.6367.60 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. The Extended Stable channel has been updated to 124.0.6367.60/.61 for Windows and M...

chromium -- multiple security fixes

Chrome Releases reports: This update includes 23 security fixes: 331358160 High CVE-2024-3832: Object corruption in V8. Reported by Man Yue Mo of GitHub Security Lab on 2024-03-27 331383939 High CVE-2024-3833: Object corruption in WebAssembly. Reported by Man Yue Mo of GitHub Security Lab on...

CVE-2024-1306

The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk...

CVE-2024-1306 Smart Forms < 2.6.94 - Edit Entries via CSRF

The Smart Forms WordPress plugin before 2.6.94 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk...

WordPress PeproDev Ultimate Invoice Plugin <= 2.0.0 is vulnerable to Broken Access Control

Software PeproDev Ultimate Invoice Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.0.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32518 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID f03a4beba6e1 Credits Abdi Pranata...

WordPress Canva – Design beautiful blog graphics Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Canva – Design beautiful blog graphics Type Plugin Vulnerable versions = 1.2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32545 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 803f9df04167 Credits Dimas Maula...

WordPress Simple Buttons Creator Plugin <= 1.04 is vulnerable to Cross Site Scripting (XSS)

Software Simple Buttons Creator Type Plugin Vulnerable versions = 1.04 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2857 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f8f6e6e1aab1 Credits Bob Matyas...

WordPress LH Add Media From Url Plugin <= 1.22 is vulnerable to Cross Site Scripting (XSS)

Software LH Add Media From Url Type Plugin Vulnerable versions = 1.22 Fixed in 1.23 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32533 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 41466ce52d41 Credits Majed Refaea Required...

WordPress Tax Rate Upload Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Tax Rate Upload Type Plugin Vulnerable versions = 2.4.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32546 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e0f99a4ecd9c Credits Dimas Maulana Required privilege...

WordPress Access Category Password Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Access Category Password Type Plugin Vulnerable versions = 1.5.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32535 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c844ee6de29c Credits Dimas Maulana Required...

WordPress MJ Update History Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software MJ Update History Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32543 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6f5d10b529f0 Credits Dimas Maulana Required privilege...

WordPress Code Insert Manager (Q2W3 Inc Manager) Plugin <= 2.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Code Insert Manager Q2W3 Inc Manager Type Plugin Vulnerable versions = 2.5.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32547 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID c408b8a3e4fc Credits Dimas Maulana...

WordPress Ultimate Member Plugin <= 2.8.4 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Member Type Plugin Vulnerable versions = 2.8.4 Fixed in 2.8.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2765 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4af1ffb7c063 Credits tiborisaak Require...

WordPress Language Translate Widget for WordPress – ConveyThis Plugin <= 223 is vulnerable to Cross Site Scripting (XSS)

Software Language Translate Widget for WordPress – ConveyThis Type Plugin Vulnerable versions = 223 Fixed in 224 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6811 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress WP Cost Estimation & Payment Forms Builder Plugin <= 10.1.76 is vulnerable to Broken Access Control

Software WP Cost Estimation & Payment Forms Builder Type Plugin Vulnerable versions = 10.1.76 Fixed in 10.1.77 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32509 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4f90762b9976...

WordPress GuCherry Blog Theme <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)

Software GuCherry Blog Type Theme Vulnerable versions = 1.1.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32531 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c448376e7385 Credits stealthcopter Required privilege...