WordPress Social Media & Share Icons Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Social Media & Share Icons Type Plugin Vulnerable versions = 2.8.3 Fixed in 2.8.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-41238 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ba7e74f69294 Credits RE-ALTER Required...

WordPress Folders Plugin <= 2.9.2 is vulnerable to Arbitrary File Upload

Software Folders Type Plugin Vulnerable versions = 2.9.2 Fixed in 2.9.3 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-40204 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID c5881308f6ec Credits Rafie Muhammad Patchstack Required privileg...

WordPress URL Shortify Plugin < 1.7.6 is vulnerable to Cross Site Scripting (XSS)

Software URL Shortify Type Plugin Vulnerable versions 1.7.6 Fixed in 1.7.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4294 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 91200df1978f Credits Bartlomiej Marek and...

WordPress Premmerce User Roles Plugin <= 1.0.12 is vulnerable to Broken Access Control

Software Premmerce User Roles Type Plugin Vulnerable versions = 1.0.12 Fixed in 1.0.13 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-41130 Patch priority High CVSS severity High 8.1 Developer Premmerce PSID 8954c8b59cab Credits Nguyen Xuan Chien Required...

WordPress Slimstat Analytics Plugin <= 5.0.5.1 is vulnerable to Broken Access Control

Software Slimstat Analytics Type Plugin Vulnerable versions = 5.0.5.1 Fixed in 5.0.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33994 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d67efaa57590 Credits Rafshanzani Suhada...

WordPress Putler Connector for WooCommerce Plugin <= 2.12.0 is vulnerable to Broken Access Control

Software Putler Connector for WooCommerce Type Plugin Vulnerable versions = 2.12.0 Fixed in 2.13.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40327 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e0681a41f8e1 Credits Davi...

CISA Adds Microsoft .NET Vulnerability to KEV Catalog Due to Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a recently patched security flaw in Microsoft's .NET and Visual Studio products to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. Tracked as CVE-2023-38180 CVSS score: 7.5, the...

WordPress Avartan Slider Lite Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Avartan Slider Lite Type Plugin Vulnerable versions = 1.5.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30485 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID def24ad496c5 Credits OZ1NG TOOR, LIS...

Absence of zero address checks for roles passed to the initialize function.

Lines of code Vulnerability details Impact The initialize function accepts various roles as part of the roles parameter SecurityCouncilManagerRoles. However, it doesn't validate whether any of these role addresses are set to the zero address address0. This omission might result in inadvertently...

WordPress Real Estate Manager Plugin <= 7.2 is vulnerable to Broken Access Control

Software Real Estate Manager Type Plugin Vulnerable versions = 7.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4239 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 9d7a1725ab48 Credits Lana Codes Required privileg...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.1.10 is vulnerable to Arbitrary File Upload

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.1.10 Fixed in 3.1.11 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE N/A Patch priority High CVSS severity High 10 Developer KadenceWP PSID b7b3e1fb316f Credits N/A Required privilege...

WordPress WP Ultimate CSV Importer Plugin <= 7.9.8 is vulnerable to Remote Code Execution (RCE)

Software WP Ultimate CSV Importer Type Plugin Vulnerable versions = 7.9.8 Fixed in 7.9.9 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-4142 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID a395389d1982 Credits István Márton Required...

WordPress Shop as a Customer for WooCommerce Plugin < 1.1.8 is vulnerable to Privilege Escalation

Software Shop as a Customer for WooCommerce Type Plugin Vulnerable versions 1.1.8 Fixed in 1.1.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE N/A Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 05b83bfeee18 Credits...

4 Generative AI Security Benefits

It may be some time before generative AI security can autonomously mitigate cyber threats, but we’re already seeing early examples of how AI models can strengthen enterprise cybersecurity in powerful and transformative ways...

WordPress WPCode Plugin < 2.0.13.1 is vulnerable to Cross Site Scripting (XSS)

Software WPCode Type Plugin Vulnerable versions 2.0.13.1 Fixed in 2.0.13.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3524 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ef32523fa659 Credits Erwan LR WPScan Require...

CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE

Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to including 2.20.10 stable branch and 2.21.17 unstable branch use the component "commons-beanutils", which contains a class that can be used for remote...

WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

Software CodeBard's Patron Button and Widgets for Patreon Type Plugin Vulnerable versions = 2.1.8 Fixed in 2.1.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30491 Patch priority Medium CVSS severity Medium 7.1 Developer Codebard PSID 9bd81d51b303...

WordPress ShortcodeHub - MultiPurpose Shortcode Builder Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software ShortcodeHub - MultiPurpose Shortcode Builder Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.4.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 99ef69b507c6 Credits Rafie...

WordPress Stop WP Emails Going to Spam Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)

Software Stop WP Emails Going to Spam Type Plugin Vulnerable versions = 1.1.6 Fixed in 2.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID fd8327c521e3 Credits Rafie Muhammad Patchsta...

WordPress Remove WP Update Nags Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)

Software Remove WP Update Nags Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.5.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 4c53c2dafb06 Credits Rafie Muhammad Patchstack...