WordPress Big File Uploads Plugin <= 2.1.2 is vulnerable to Full Path Disclosure (FPD)

Software Big File Uploads Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A3: Sensitive Data Exposure Classification Full Path Disclosure FPD CVE CVE-2024-8538 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7d70a0318727 Credits netc4t Required privileg...

WordPress WP ULike Plugin < 4.7.2.1 is vulnerable to Cross Site Scripting (XSS)

Software WP ULike Type Plugin Vulnerable versions 4.7.2.1 Fixed in 4.7.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6792 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fcd51aa95df1 Credits stealthcopter Required...

WordPress Pinpoint Booking System Plugin <= 2.9.9.5.0 is vulnerable to SQL Injection

Software Pinpoint Booking System Type Plugin Vulnerable versions = 2.9.9.5.0 Fixed in 2.9.9.5.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-7112 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 3f6ddfc5c651 Credits Piotr Kuśpit Required privilege...

WordPress Popup Maker Plugin < 1.19.1 is vulnerable to Cross Site Scripting (XSS)

Software Popup Maker Type Plugin Vulnerable versions 1.19.1 Fixed in 1.19.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5561 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 28c13e8e0eab Credits Dmitrii Ignatyev Required...

WordPress Ninja Forms File Uploads Extension Plugin <= 3.3.16 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms File Uploads Extension Type Plugin Vulnerable versions = 3.3.16 Fixed in 3.3.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1596 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 261b89d2f6fa Credi...

WordPress Customizer Export/Import Plugin <= 0.9.7 is vulnerable to Arbitrary File Upload

Software Customizer Export/Import Type Plugin Vulnerable versions = 0.9.7 Fixed in 0.9.7.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7620 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 9417048c628d Credits Luk6785 Required privilege...

WordPress Advanced Sermons Plugin <= 3.3 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Sermons Type Plugin Vulnerable versions = 3.3 Fixed in 3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7599 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d85d91823452 Credits vgo0 Required privilege...

WordPress WP AdCenter Plugin <= 2.5.6 is vulnerable to Cross Site Scripting (XSS)

Software WP AdCenter Type Plugin Vulnerable versions = 2.5.6 Fixed in 2.5.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8317 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cf77f095bc05 Credits Francesco Carlucci Required...

WordPress ForumWP Plugin <= 2.0.2 is vulnerable to Privilege Escalation

Software ForumWP Type Plugin Vulnerable versions = 2.0.2 Fixed in 2.1.0 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8428 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 04472abbfa0c Credits wesley wcraft...

WordPress LifterLMS Plugin <= 7.7.5 is vulnerable to SQL Injection

Software LifterLMS Type Plugin Vulnerable versions = 7.7.5 Fixed in 7.7.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-7349 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 171b245559b0 Credits FKSEC Required privilege Administrator Published 6...

[9.0] Fix Risky deserialization calls

h3. Issue Summary fix This is reproducible on Data Center: Yes h3. Steps to Reproduce Cannot be reproduced h3. Expected Results Where possible, restrict the set of classes that can be deserialized. OWASP’s recommendation for readObject calls is to subclass the ObjectInputStream class, and overrid...

WordPress RD Station Plugin <= 5.3.2 is vulnerable to Cross Site Scripting (XSS)

Software RD Station Type Plugin Vulnerable versions = 5.3.2 Fixed in 5.4.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6894 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 32a1d7bae015 Credits Webbernaut Required privilege...

WordPress LiteSpeed Cache Plugin < 6.5.0.1 is vulnerable to Broken Authentication

Software LiteSpeed Cache Type Plugin Vulnerable versions 6.5.0.1 Fixed in 6.5.0.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-44000 Patch priority High CVSS severity High 9.8 Developer Hai Zheng / Lite Speed Cache PSID 8f939cc0b306...

WordPress Geo Controller Plugin <= 8.7.3 is vulnerable to Broken Access Control

Software Geo Controller Type Plugin Vulnerable versions = 8.7.3 Fixed in 8.7.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7380 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c241dd8210b8 Credits Lucio Sá Required privilege...

WordPress Share This Image Plugin <= 2.02 is vulnerable to Cross Site Scripting (XSS)

Software Share This Image Type Plugin Vulnerable versions = 2.02 Fixed in 2.03 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8363 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1f926f6e8d27 Credits Krzysztof Zając Required...

WordPress Ivory Search Plugin <= 5.5.6 is vulnerable to Sensitive Data Exposure

Software Ivory Search Type Plugin Vulnerable versions = 5.5.6 Fixed in 5.5.7 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6835 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID cb7652ee4cde Credits stealthcopter Required...

WordPress Content Blocks (Custom Post Widget) Plugin <= 3.3.5 is vulnerable to Cross Site Scripting (XSS)

Software Content Blocks Custom Post Widget Type Plugin Vulnerable versions = 3.3.5 Fixed in 3.3.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44051 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b50c32e861c5 Credits lowol ngo Required...

WordPress The Ultimate WordPress Toolkit – WP Extended Plugin <= 3.0.8 is vulnerable to Insecure Direct Object References (IDOR)

Software The Ultimate WordPress Toolkit – WP Extended Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-8123 Patch priority Low CVSS severity Low 5.4 Developer WP Extended PSID...

WordPress Attributes for Blocks Plugin <= 1.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Attributes for Blocks Type Plugin Vulnerable versions = 1.0.6 Fixed in 1.0.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8318 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 29a794b4ba36 Credits Francesco Carlucci...

WordPress The Ultimate WordPress Toolkit – WP Extended Plugin <= 3.0.8 is vulnerable to Sensitive Data Exposure

Software The Ultimate WordPress Toolkit – WP Extended Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-8106 Patch priority Medium CVSS severity Medium 6.5 Developer WP Extended PSID 027663c0c476...