WordPress Meta News Theme <= 1.1.7 is vulnerable to Local File Inclusion

Software Meta News Type Theme Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-50435 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID d90fa015825d Credits tahu.datar Required privilege Unauthenticated...

WordPress Beaver Builder Plugin <= 2.8.3.7 is vulnerable to Cross Site Scripting (XSS)

Software Beaver Builder Type Plugin Vulnerable versions = 2.8.3.7 Fixed in 2.8.3.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50430 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0af9c27e34dd Credits João Pedro S Alcântara Kinorth...

WordPress CodePen Embedded Pens Shortcode Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software CodePen Embedded Pens Shortcode Type Plugin Vulnerable versions = 1.0.2 Fixed in 1.0.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50440 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ea887c573a3b Credits theviper17 Required...

WordPress WooCommerce UPS Shipping – Live Rates and Access Points Plugin <= 2.3.11 is vulnerable to Broken Access Control

Software WooCommerce UPS Shipping – Live Rates and Access Points Type Plugin Vulnerable versions = 2.3.11 Fixed in 3.0.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9109 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID b3cccbff59...

WordPress Clean Retina Theme <= 3.0.6 is vulnerable to Local File Inclusion

Software Clean Retina Type Theme Vulnerable versions = 3.0.6 Fixed in 3.0.7 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-50436 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID e56d05b5bd53 Credits tahu.datar Required privilege Unauthenticate...

WordPress App Builder Plugin <= 5.3.7 is vulnerable to Broken Authentication

Software App Builder Type Plugin Vulnerable versions = 5.3.7 Fixed in 5.3.8 OWASP Top 10 A3: Injection Classification Broken Authentication CVE CVE-2024-9302 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 82e5ff2f8d20 Credits wesley wcraft Required privilege...

WordPress Breeze Plugin <= 2.1.14 is vulnerable to Cross Site Scripting (XSS)

Software Breeze Type Plugin Vulnerable versions = 2.1.14 Fixed in 2.1.15 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50431 Patch priority Low CVSS severity Low 5.9 Developer Cloudways PSID 40fce694a577 Credits Felipe Alcantara Filiplain Required privilege...

WordPress Contact Form 7 - Repeatable Fields Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form 7 - Repeatable Fields Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10180 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d39a0f706c9a Credits Pete...

WordPress Amilia Store Plugin <= 2.9.8 is vulnerable to Cross Site Scripting (XSS)

Software Amilia Store Type Plugin Vulnerable versions = 2.9.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50472 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c0d225726ac8 Credits SOPROBRO Required privilege Contributor...

WordPress Firelight Lightbox Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Firelight Lightbox Type Plugin Vulnerable versions = 2.3.3 Fixed in 2.3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50460 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2edb2390ea9c Credits Robert DeVore Required privilege...

WordPress Button contact VR Plugin <= 4.7.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Button contact VR Type Plugin Vulnerable versions = 4.7.9.1 Fixed in 4.7.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50414 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8a3582798f30 Credits UKO Required privilege...

WordPress WordPress Stripe Donation and Payment Plugin Plugin <= 3.2.3 is vulnerable to Broken Access Control

Software WordPress Stripe Donation and Payment Plugin Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-50459 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID bb58320243b3 Credits...

WordPress DarkMySite – Advanced Dark Mode Plugin for WordPress Plugin <= 1.2.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software DarkMySite – Advanced Dark Mode Plugin for WordPress Type Plugin Vulnerable versions = 1.2.8 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-50466 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress aDirectory Plugin <= 1.3 is vulnerable to Arbitrary File Upload

Software aDirectory Type Plugin Vulnerable versions = 1.3 Fixed in 1.3.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50420 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 8b5cfce5fa20 Credits stealthcopter Required privilege Unauthenticate...

WordPress Premium SEO Pack Plugin <= 1.6.001 is vulnerable to SQL Injection

Software Premium SEO Pack Type Plugin Vulnerable versions = 1.6.001 Fixed in 1.6.002 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-50465 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 56b65671a73e Credits Hakiduck Required privilege Contributor...

WordPress Advanced Sermons Plugin <= 3.4 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Sermons Type Plugin Vulnerable versions = 3.4 Fixed in 3.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50458 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0e069038bb43 Credits SOPROBRO Required privilege Contributor...

WordPress PostX Plugin <= 4.1.12 is vulnerable to Cross Site Scripting (XSS)

Software PostX Type Plugin Vulnerable versions = 4.1.12 Fixed in 4.1.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50443 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d794e4665795 Credits Hwang Se-yeon Required privilege Contributor...

WordPress PDF Generator Addon for Elementor Page Builder Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)

Software PDF Generator Addon for Elementor Page Builder Type Plugin Vulnerable versions = 1.7.4 Fixed in 1.7.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50449 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7f59036ae201 Credits João...

WordPress Church Admin Plugin < 5.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Church Admin Type Plugin Vulnerable versions 5.0.0 Fixed in 5.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50438 Patch priority Medium CVSS severity Medium 7.1 Developer Andy Moyle PSID 007d5118baff Credits Le Ngoc Anh Required privilege...

WordPress League of Legends Shortcodes Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software League of Legends Shortcodes Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10342 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a6f27a15f3e2 Credits István Márto...