WordPress YellowPencil Visual CSS Style Editor Plugin <= 7.6.4 is vulnerable to Cross Site Scripting (XSS)

Software YellowPencil Visual CSS Style Editor Type Plugin Vulnerable versions = 7.6.4 Fixed in 7.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47348 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e58f30e6b0f0 Credits Dimas Maula...

CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177: Everything you need to know

Detect and mitigate CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, and CVE-2024-47177 vulnerabilities impacting CUPS and IPP packages...

WordPress Multi Step for Contact Form Plugin <= 2.7.7 is vulnerable to SQL Injection

Software Multi Step for Contact Form Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-47331 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID a27c5e08d690 Credits Hakiduck Required privilege...

WordPress Advanced File Manager Plugin <= 5.2.8 is vulnerable to Arbitrary File Upload

Software Advanced File Manager Type Plugin Vulnerable versions = 5.2.8 Fixed in 5.2.9 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-8725 Patch priority High CVSS severity High 6.8 Developer Claim ownership PSID 8ea10462dd56 Credits TANG Cheuk Hei siunam Required...

CVE-2024-47083

Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the clientsecret used in the service principal authentication, may be...

CVE-2024-47083 Power Platform Terraform Provider has Improper Masking of Secrets in Logs

Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the clientsecret used in the service principal authentication, may be...

WordPress WP Timeline – Vertical and Horizontal timeline plugin Plugin <= 3.6.7 is vulnerable to Local File Inclusion

Software WP Timeline – Vertical and Horizontal timeline plugin Type Plugin Vulnerable versions = 3.6.7 Fixed in 3.6.8 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-47323 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 6eddb8cb706e Credits...

WordPress Fluent Support Plugin <= 1.8.0 is vulnerable to SQL Injection

Software Fluent Support Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-47304 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 80896110802b Credits Khalid Yusuf Required privilege Subscriber...

WordPress REST API TO MiniProgram Plugin <= 4.7.1 is vulnerable to Privilege Escalation

Software REST API TO MiniProgram Type Plugin Vulnerable versions = 4.7.1 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Privilege Escalation CVE CVE-2024-8485 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID dc9973040e40 Credits wesley wcraft Required...

WordPress WP Ticket Ultra Help Desk & Support Plugin Plugin <= 1.0.5 is vulnerable to Local File Inclusion

Software WP Ticket Ultra Help Desk & Support Plugin Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44011 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 59aeb18e81e7 Credits tahu.datar...

WordPress WPSPX Plugin <= 1.0.2 is vulnerable to Local File Inclusion

Software WPSPX Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44034 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 14fb489d8c25 Credits tahu.datar Required privilege Unauthenticated...

WordPress SKT Templates – Elementor & Gutenberg templates Plugin <= 6.14 is vulnerable to Cross Site Scripting (XSS)

Software SKT Templates – Elementor & Gutenberg templates Type Plugin Vulnerable versions = 6.14 Fixed in 6.15 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44007 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c6e7fe073020 Credits...

WordPress SliceWP Plugin <= 1.1.20 is vulnerable to Cross Site Scripting (XSS)

Software SliceWP Type Plugin Vulnerable versions = 1.1.20 Fixed in 1.1.21 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8714 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2c6c9e650276 Credits vgo0 Required privilege...

WordPress Memberpress Plugin <= 1.11.29 is vulnerable to Cross Site Scripting (XSS)

Software Memberpress Type Plugin Vulnerable versions = 1.11.29 Fixed in 1.11.30 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5024 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 953c2af8a753 Credits stealthcopter...

WordPress Web Directory Free Plugin < 1.7.3 is vulnerable to Local File Inclusion

Software Web Directory Free Type Plugin Vulnerable versions 1.7.3 Fixed in 1.7.3 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3673 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID d4fbe470a086 Credits Simone Onofri Kim Cerra Andrea De...

WordPress Login As Users Plugin <= 1.4.3 is vulnerable to Broken Access Control

Software Login As Users Type Plugin Vulnerable versions = 1.4.3 Fixed in 1.4.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43982 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 591007b6910c Credits Ananda Dhakal Patchstack...

#StopRansomware: Blacksuit (Royal) Ransomware

Actions for Organizations to Take Today to Mitigate Cyber Threats Related to BlackSuit Ransomware Activity 1. Prioritize remediating known exploited vulnerabilities. 2. Train users to recognize and report phishing attempts. 3. Enable and enforce multifactor authentication...

WordPress Music Request Manager Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

Software Music Request Manager Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6019 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 635b9b6901ac Credits Bob Matyas...

WordPress WP Crowdfunding Plugin <= 2.1.10 is vulnerable to Settings Change

Software WP Crowdfunding Type Plugin Vulnerable versions = 2.1.10 Fixed in 2.1.11 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43937 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID a39d1c35c66c Credits Trương Hữu Phúc truonghuuph...

WordPress Propovoice Pro Plugin <= 1.7.0.3 is vulnerable to SQL Injection

Software Propovoice Pro Type Plugin Vulnerable versions = 1.7.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43941 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 6f9d32f040df Credits Dave Jong Patchstack Required privilege...