WordPress Uncanny Toolkit for LearnDash Plugin <= 3.6.4.3 is vulnerable to Broken Access Control

Software Uncanny Toolkit for LearnDash Type Plugin Vulnerable versions = 3.6.4.3 Fixed in 3.6.4.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-34019 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 86dfb320b43d Credits Mika...

WordPress Premium Addons PRO Plugin <= 2.8.24 is vulnerable to Cross Site Scripting (XSS)

Software Premium Addons PRO Type Plugin Vulnerable versions = 2.8.24 Fixed in 2.8.25 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34012 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3e100a687a90 Credits Rafie Muhamm...

WordPress Draw Attention Plugin <= 2.0.11 is vulnerable to Broken Access Control

Software Draw Attention Type Plugin Vulnerable versions = 2.0.11 Fixed in 2.0.12 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2764 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 38c9e02b7556 Credits Alex Thomas Required...

WordPress Feather Login Page Plugin 1.0.7-1.1.1 is vulnerable to Broken Access Control

Software Feather Login Page Type Plugin Vulnerable versions 1.0.7-1.1.1 Fixed in 1.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2545 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 109ff0ae5394 Credits Lana Codes Required...

WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection

Software Tutor LMS Type Plugin Vulnerable versions = 2.1.10 Fixed in 2.2.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-25700 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID a985405069a7 Credits Rafie Muhammad Patchstack Required privilege...

WordPress Chilexpress woo oficial Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Chilexpress woo oficial Type Plugin Vulnerable versions = 1.2.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34176 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a1fce822ccdb Credits Le Ngoc Anh...

WordPress Google Map Shortcode Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Google Map Shortcode Type Plugin Vulnerable versions = 3.1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2899 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c83d68b2188f Credits Lana Codes...

Risk assessment of the finalizeETHWithdrawal function in the bridge contract

Lines of code Vulnerability details Summary The finalizeBridgeETH function: function finalizeETHWithdrawal address from, address to, uint256 amount, bytes calldata extraData external payable finalizeBridgeETHfrom, to, amount, extraData; is a public function, which means that anyone can call it...

WordPress This Day In History Plugin <= 3.10.1 is vulnerable to Cross Site Scripting (XSS)

Software This Day In History Type Plugin Vulnerable versions = 3.10.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34026 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID eee4a5e73546 Credits LEE SE HYOUNG...

WordPress WooCommerce Product Categories Selection Widget Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Product Categories Selection Widget Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-33925 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 979c53a7a2...

WordPress Tutor LMS Plugin <= 2.1.8 is vulnerable to Broken Access Control

Software Tutor LMS Type Plugin Vulnerable versions = 2.1.8 Fixed in 2.1.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25799 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID c5a261a00ca9 Credits Rafie Muhammad Patchstack Require...

WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

Software EventPrime Type Plugin Vulnerable versions = 2.8.6 Fixed in 3.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-33326 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 54de00d180dc Credits yuyudhn Required...

If the controller for _data.projectId is not defined, it can lead to incorrect execution of _swap() and theft of funds by the beneficiary.

Lines of code Vulnerability details Impact If the controller is not defined in the swap function, then it becomes impossible to mint and burn tokens, which leads to incorrect execution of the function. IJBController controller = IJBControllerjbxTerminal.directory.controllerOfdata.projectId; Proof...

Exploit for Cleartext Transmission of Sensitive Information in Keepass

KeePass 2.53/cmdline files and store the pid of ones with t...

WordPress Easy Forms for Mailchimp Plugin <= 6.8.8 is vulnerable to Cross Site Scripting (XSS)

Software Easy Forms for Mailchimp Type Plugin Vulnerable versions = 6.8.8 Fixed in 6.8.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23900 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID d4b18f8ce4ea Credits Rafie...

WordPress Waiting: One-click countdowns Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS)

Software Waiting: One-click countdowns Type Plugin Vulnerable versions = 0.6.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2757 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 5e454859cceb Credits István...

WordPress Kathmag Theme <= 1.0.6 is vulnerable to Broken Access Control

Software Kathmag Type Theme Vulnerable versions = 1.0.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32959 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID b2f08ba32120 Credits Dave Jong Patchstack Required...

WordPress SpiderMag Theme <= 1.1.7 is vulnerable to Broken Access Control

Software SpiderMag Type Theme Vulnerable versions = 1.1.7 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32959 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID ebe1f256ec21 Credits Dave Jong Patchstack Required...

WordPress Online eStore Theme <= 1.0.9 is vulnerable to Broken Access Control

Software Online eStore Type Theme Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32959 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 729988cdbce6 Credits Dave Jong Patchstack Require...

WordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Composite Products Type Plugin Vulnerable versions = 8.7.5 Fixed in 8.7.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32801 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9a496bb5bf9a Credits...