WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Twitter Feeds Tweets Widget Type Plugin Vulnerable versions = 2.2.3 Fixed in 2.2.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49685 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID c19e764fedf7 Credits...

WordPress Smart Manager Plugin <= 8.45.0 is vulnerable to Broken Access Control

Software Smart Manager Type Plugin Vulnerable versions = 8.45.0 Fixed in 8.46.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-49687 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4f61d787da04 Credits Ananda Dhakal Patchstack...

WordPress Category and Taxonomy Meta Fields Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Category and Taxonomy Meta Fields Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-9588 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bde2763e61f5 Credits Istv...

WordPress Mags Theme <= 1.1.6 is vulnerable to Local File Inclusion

Software Mags Type Theme Vulnerable versions = 1.1.6 Fixed in 1.1.7 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-49701 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID e5bfc35540e7 Credits tahu.datar Required privilege Unauthenticated Publishe...

WordPress Google Docs RSVP Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Google Docs RSVP Type Plugin Vulnerable versions = 2.0.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49672 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 41657f6782b9 Credits SOPROBRO Required...

WordPress Simple Custom Admin Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Simple Custom Admin Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49647 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3970364b5682 Credits Mika Required privilege...

WordPress News Kit Elementor Addons Plugin <= 1.2.1 is vulnerable to Sensitive Data Exposure

Software News Kit Elementor Addons Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-9541 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1aff69c2a359 Credits Nishiv Required...

WordPress 3D Work In Progress Plugin <= 1.0.3 is vulnerable to Arbitrary File Upload

Software 3D Work In Progress Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49652 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 22382aa9215e Credits stealthcopter Required privilege...

WordPress DocumentPress Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

Software DocumentPress Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49656 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9ccb703f5e18 Credits Mika Required privilege Unauthenticate...

WordPress Product Filter by WBW Plugin <= 2.7.0 is vulnerable to SQL Injection

Software Product Filter by WBW Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-49691 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 6688f0876dc2 Credits Hakiduck Required privilege Administrator...

WordPress Campus Explorer Widget Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)

Software Campus Explorer Widget Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49660 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f8147e5ae215 Credits Mika Required privilege...

WordPress All-in-One WP Migration Plugin <= 7.86 is vulnerable to Sensitive Data Exposure

Software All-in-One WP Migration Type Plugin Vulnerable versions = 7.86 Fixed in 7.87 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-8852 Patch priority Low CVSS severity Low 5.3 Developer ServMask, Inc PSID 1b517ae2c2c6 Credits villu164 Required...

WordPress WP-Members Plugin <= 3.4.9.5 is vulnerable to Cross Site Scripting (XSS)

Software WP-Members Type Plugin Vulnerable versions = 3.4.9.5 Fixed in 3.4.9.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9231 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0e4e11a3431f Credits vgo0 Required...

WordPress Schema & Structured Data for WP & AMP Plugin <= 1.3.5 is vulnerable to Sensitive Data Exposure

Software Schema & Structured Data for WP & AMP Type Plugin Vulnerable versions = 1.3.5 Fixed in 1.36 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-49683 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID fb194b3fd454 Credits Joshua...

WordPress Rover IDX Plugin <= 3.0.0.2903 is vulnerable to Broken Access Control

Software Rover IDX Type Plugin Vulnerable versions = 3.0.0.2903 Fixed in 3.0.0.2905 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10003 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2b090aab193c Credits István Márton Required...

WordPress Coub Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)

Software Coub Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49659 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0539acd0958a Credits SOPROBRO Required privilege Contributor Published 21...

WordPress WP Sessions Time Monitoring Full Automatic Plugin <= 1.0.9 is vulnerable to SQL Injection

Software WP Sessions Time Monitoring Full Automatic Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.1.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-49681 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 5ddec7a4af4c Credits stealthcopter Requir...

WordPress Whitelist Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)

Software Whitelist Type Plugin Vulnerable versions = 3.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49643 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3e96a305df4e Credits Mika Required privilege Unauthenticated...

WordPress Qi Blocks Plugin <= 1.3.2 is vulnerable to Local File Inclusion

Software Qi Blocks Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.3.3 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-49690 Patch priority Low CVSS severity Low 7.5 Developer Qode Interactive PSID a68a3ddba7fc Credits João Pedro S Alcântara Kinorth...

WordPress Verbalize WP Plugin <= 1.0 is vulnerable to Arbitrary File Upload

Software Verbalize WP Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49668 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 5d5cf04a7cde Credits stealthcopter Required privilege Unauthenticate...