WordPress Community by PeepSo Plugin <= 6.4.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Community by PeepSo Type Plugin Vulnerable versions = 6.4.6.1 Fixed in 6.4.6.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9873 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 149b9a71dcfc Credits Bikram...

WordPress Omnipress Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Omnipress Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49278 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 27e910451326 Credits Khalid Yusuf Required privilege Contributor...

WordPress ElementInvader Addons for Elementor Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)

Software ElementInvader Addons for Elementor Type Plugin Vulnerable versions = 1.2.8 Fixed in 1.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9888 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2293b37c11ea Credits Coli...

WordPress File Manager Pro Plugin <= 8.3.9 is vulnerable to Arbitrary File Upload

Software File Manager Pro Type Plugin Vulnerable versions = 8.3.9 Fixed in 8.3.10 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-8918 Patch priority High CVSS severity High 7.4 Developer Claim ownership PSID 8b2de26c1b42 Credits TANG Cheuk Hei siunam Required privile...

CVE-2024-8602

When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE XML External Entity attack. Further information on this can be found on the website of the Open Worldwide Application Security Project OWASP. An attacker...

CVE-2024-8602 XML Eternal Entity Attack in the Software Library taxstatement.jar

When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE XML External Entity attack. Further information on this can be found on the website of the Open Worldwide Application Security Project OWASP. An attacker...

CVE-2024-8602 XML Eternal Entity Attack in the Software Library taxstatement.jar

When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE XML External Entity attack. Further information on this can be found on the website of the Open Worldwide Application Security Project OWASP. An attacker...

CVE-2024-8602

CVE-2024-8602 concerns XXE in XML parsing from PDFs via the default DocumentBuilder settings in taxstatement.jar. Connected data confirms affected software: taxstatement.jar versions 2.2.2 and 2.2.4. Root cause: DocumentBuilder configured to allow external entities, enabling an XML external entit...

WordPress Da Reactions Plugin <= 5.1.5 is vulnerable to Cross Site Scripting (XSS)

Software Da Reactions Type Plugin Vulnerable versions = 5.1.5 Fixed in 5.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49255 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e927ad34c153 Credits Khalid Yusuf Required privilege Contribut...

WordPress wpPricing Builder Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)

Software wpPricing Builder Type Plugin Vulnerable versions = 1.5.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49225 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f294416b505a Credits SOPROBRO Required privilege Contributo...

WordPress Jetpack Plugin < 13.9.1 is vulnerable to Broken Access Control

Software Jetpack Type Plugin Vulnerable versions 13.9.1 Fixed in 13.9.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9926 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 675e1d99d774 Credits Marc Montpas Required privilege...

WordPress Primary Addon for Elementor Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)

Software Primary Addon for Elementor Type Plugin Vulnerable versions = 1.5.8 Fixed in 1.5.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49259 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c68882b5abc9 Credits João Pedro S Alcântara...

WordPress Better Author Bio Plugin <= 2.7.10.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software Better Author Bio Type Plugin Vulnerable versions = 2.7.10.11 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49229 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID dd031bce3db6 Credits SOPROBRO...

WordPress Smart Blocks Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Smart Blocks Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49270 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fc8a42cfb8ae Credits João Pedro S Alcântara Kinorth Required...

WordPress Slimstat Analytics Plugin <= 5.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Slimstat Analytics Type Plugin Vulnerable versions = 5.2.6 Fixed in 5.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9548 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 36cf28244951 Credits Bilal Chawich...

WordPress Elementor Website Builder Plugin <= 3.24.5 is vulnerable to Sensitive Data Exposure

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.24.5 Fixed in 3.24.6 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-6757 Patch priority Low CVSS severity Low 4.3 Developer Elementor PSID f4cfefcf22b1 Credits stealthcopter Required...

WordPress Rescue Shortcodes Plugin <= 2.8 is vulnerable to Cross Site Scripting (XSS)

Software Rescue Shortcodes Type Plugin Vulnerable versions = 2.8 Fixed in 2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9696 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 55990669c666 Credits Peter Thaleikis Required...

WordPress Azz Anonim Posting Plugin <= 0.9 is vulnerable to Arbitrary File Upload

Software Azz Anonim Posting Type Plugin Vulnerable versions = 0.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49257 Patch priority High CVSS severity High 10 Developer Claim ownership PSID a0f84f528406 Credits stealthcopter Required privilege...

WordPress El mejor Cluster Plugin <= 1.1.14 is vulnerable to Cross Site Scripting (XSS)

Software El mejor Cluster Type Plugin Vulnerable versions = 1.1.14 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49232 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8cbf4161bc96 Credits Khalid Yusuf Required privilege...

WordPress cSlider Plugin <= 2.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software cSlider Type Plugin Vulnerable versions = 2.4.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49221 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fee1f2fb0a1b Credits SOPROBRO Required...