WordPress Hotel Galaxy Theme <= 4.4.24 is vulnerable to Cross Site Scripting (XSS)

Software Hotel Galaxy Type Theme Vulnerable versions = 4.4.24 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43991 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1a41da70162 Credits stealthcopter Required privilege Contributo...

WordPress Funnel Kit Funnel Builder PRO Plugin <= 3.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Funnel Kit Funnel Builder PRO Type Plugin Vulnerable versions = 3.4.5 Fixed in 3.5.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1056 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8c1faa8fa285 Credits Francesco...

WordPress Favicon Generator Plugin < 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Favicon Generator Type Plugin Vulnerable versions 2.1 Fixed in 2.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7863 Patch priority Low CVSS severity Low 9.6 Developer Claim ownership PSID 2e8a0fbb5efb Credits Daniel Ruf Required...

WordPress Spiffy Calendar Plugin <= 4.9.12 is vulnerable to SQL Injection

Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.12 Fixed in 4.9.13 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43969 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 7bc8db74206e Credits Certus Cybersecurity Required privilege...

WordPress Super Store Finder Plugin < 6.9.8 is vulnerable to SQL Injection

Software Super Store Finder Type Plugin Vulnerable versions 6.9.8 Fixed in 6.9.8 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43978 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 595dac1f790f Credits Bonds Required privilege Unauthenticated...

WordPress Blockbooster Theme <= 1.0.10 is vulnerable to Broken Access Control

Software Blockbooster Type Theme Vulnerable versions = 1.0.10 Fixed in 1.0.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43979 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fac761fd31ce Credits Fariq Fadillah Gusti Insa...

WordPress Mollie Payments for WooCommerce Plugin <= 7.7.0 is vulnerable to Full Path Disclosure (FPD)

Software Mollie Payments for WooCommerce Type Plugin Vulnerable versions = 7.7.0 Fixed in 7.8.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Full Path Disclosure FPD CVE CVE-2024-6448 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 442e1f30b6d2 Credits...

WordPress Permalink Manager Lite Plugin <= 2.4.4 is vulnerable to Broken Access Control

Software Permalink Manager Lite Type Plugin Vulnerable versions = 2.4.4 Fixed in 2.4.4.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8195 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 6d2ef5ed74cf Credits stealthcopter Require...

WordPress Fota WP Theme <= 1.4.1 is vulnerable to Broken Access Control

Software Fota WP Type Theme Vulnerable versions = 1.4.1 Fixed in 1.4.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43980 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b10d5d19d02a Credits Fariq Fadillah Gusti Insani...

WordPress Login As Users Plugin <= 1.4.3 is vulnerable to Broken Access Control

Software Login As Users Type Plugin Vulnerable versions = 1.4.3 Fixed in 1.4.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43982 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 591007b6910c Credits Ananda Dhakal Patchstack...

WordPress Relevanssi Live Ajax Search Plugin <= 2.4 is vulnerable to Broken Access Control

Software Relevanssi Live Ajax Search Type Plugin Vulnerable versions = 2.4 Fixed in 2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-7573 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 091b716b5837 Credits scottaglia Required...

WordPress PageLayer Plugin <= 1.8.7 is vulnerable to Cross Site Scripting (XSS)

Software PageLayer Type Plugin Vulnerable versions = 1.8.7 Fixed in 1.8.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43972 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e5ff899f830a Credits Sharanabasappa Required privilege...

WordPress SureCart Plugin <= 2.29.3 is vulnerable to Cross Site Scripting (XSS)

Software SureCart Type Plugin Vulnerable versions = 2.29.3 Fixed in 2.29.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43970 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 031e83213ccc Credits Le Ngoc Anh Required privilege...

WordPress Funnelforms Free Plugin <= 3.7.3.2 is vulnerable to Arbitrary File Upload

Software Funnelforms Free Type Plugin Vulnerable versions = 3.7.3.2 Fixed in 3.7.4.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6311 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID a49e53d16951 Credits István Márton Required privilege...

WordPress Super Store Finder Plugin <= 6.9.7 is vulnerable to SQL Injection

Software Super Store Finder Type Plugin Vulnerable versions = 6.9.7 Fixed in 6.9.8 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43976 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 7586102df7db Credits Bonds Required privilege Subscriber Publishe...

WordPress Super Store Finder Plugin <= 6.9.7 is vulnerable to Cross Site Scripting (XSS)

Software Super Store Finder Type Plugin Vulnerable versions = 6.9.7 Fixed in 6.9.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43975 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3e09dec37e3f Credits Bonds Required privilege...

WordPress Podlove Podcast Publisher Plugin <= 4.1.13 is vulnerable to Cross Site Request Forgery (CSRF)

Software Podlove Podcast Publisher Type Plugin Vulnerable versions = 4.1.13 Fixed in 4.1.14 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43984 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID b38f22b27679 Credits...

GHSA-R3JQ-4R5C-J9HP Taipy has a Session Cookie without Secure and HTTPOnly flags

Summary Session cookie is without Secure and HTTPOnly flags. Details Please take a look at this part of code PoC screenshot or check code directly provided in Occurrences section below Occurrences: https://github.com/Avaiga/taipy/blob/develop/frontend/taipy-gui/src/components/Taipy/Navigate.tsxL6...

WordPress Xpro Elementor Addons Plugin <= 1.4.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Xpro Elementor Addons Type Plugin Vulnerable versions = 1.4.4.3 Fixed in 1.4.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7791 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 93f87661de72 Credits WordFence...

WordPress Misiek Photo Album Plugin <= 1.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Misiek Photo Album Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7817 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e7a1753e88ea Credits Bob Matyas Required...