WordPress WP Setup Wizard Plugin <= 1.0.8.1 is vulnerable to Sensitive Data Exposure

Software WP Setup Wizard Type Plugin Vulnerable versions = 1.0.8.1 Fixed in 1.0.8.2 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-25917 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 5a05aed5e6cb Credits Dave Jong Patchstack...

WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection

Software MoveTo Type Plugin Vulnerable versions = 6.2 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-25910 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 376a551a56e9 Credits Dave Jong Patchstack Required privilege Unauthenticated...

WordPress Canto Plugin <= 3.0.6 is vulnerable to Remote Code Execution (RCE)

Software Canto Type Plugin Vulnerable versions = 3.0.6 Fixed in 3.0.7 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-25096 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 5a102fd4265b Credits Rodrigo Escobar ipax Required privilege...

WordPress Awesome Support Plugin <= 6.1.7 is vulnerable to SQL Injection

Software Awesome Support Type Plugin Vulnerable versions = 6.1.7 Fixed in 6.1.8 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0594 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 63f2c5ccd5ea Credits Krzysztof Zając Required privilege Subscriber...

WordPress Booking Calendar Plugin <= 9.9 is vulnerable to SQL Injection

Software Booking Calendar Type Plugin Vulnerable versions = 9.9 Fixed in 9.9.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-1207 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID f33b420f42e8 Credits Muhammad Hassham Nagori Required privilege...

WordPress ERE Recently Viewed Plugin <= 1.3 is vulnerable to PHP Object Injection

Software ERE Recently Viewed Type Plugin Vulnerable versions = 1.3 Fixed in 2.0 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-24797 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 835850fa9817 Credits Yudistira Arya Required privilege...

WordPress WP GDPR Compliance Plugin <= 2.0.22 is vulnerable to Broken Access Control

Software WP GDPR Compliance Type Plugin Vulnerable versions = 2.0.22 Fixed in 2.0.23 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6700 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6a981b3b2d5a Credits Lucio Sá Required...

WordPress InstaWP Connect Plugin <= 0.1.0.9 is vulnerable to SQL Injection

Software InstaWP Connect Type Plugin Vulnerable versions = 0.1.0.9 Fixed in 0.1.0.10 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-23507 Patch priority High CVSS severity High 8.5 Developer InstaWP PSID 5c6a7651e601 Credits Majed Refaea Required privilege Subscriber Publish...

WordPress ChatBot Plugin <= 5.4.5 is vulnerable to PHP Object Injection

Software ChatBot Type Plugin Vulnerable versions = 5.4.5 Fixed in 5.4.6 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-22309 Patch priority High CVSS severity High 8.7 Developer Claim ownership PSID f351099f4f1e Credits Le Ngoc Anh Required privilege Unauthenticated...

WordPress Delhivery Logistics Courier Plugin <= 1.0.107 is vulnerable to SQL Injection

Software Delhivery Logistics Courier Type Plugin Vulnerable versions = 1.0.107 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-22283 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID fb6909b3979e Credits Yudistira Arya Required privilege...

WordPress Taggbox Plugin <= 3.1 is vulnerable to PHP Object Injection

Software Taggbox Type Plugin Vulnerable versions = 3.1 Fixed in 3.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-52225 Patch priority High CVSS severity High 10 Developer Claim ownership PSID cec0f62daeea Credits Rafie Muhammad Patchstack Required privilege...

WordPress Theme per user Plugin <= 1.0.1 is vulnerable to PHP Object Injection

Software Theme per user Type Plugin Vulnerable versions = 1.0.1 Fixed in 1.0.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-52181 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 74baf7cbbeba Credits Rafie Muhammad Patchstack Required privile...

WordPress JVM rich text icons Plugin <= 1.2.6 is vulnerable to Arbitrary File Deletion

Software JVM rich text icons Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-51418 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID a73cfe9ec895 Credits Rafie Muhammad...

WordPress LA-Studio Element Kit for Elementor Plugin <= 1.1.5 is vulnerable to Broken Access Control

Software LA-Studio Element Kit for Elementor Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50884 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 0dcf79343479 Credits thiennv...

WordPress WC Marketplace Plugin <= 4.0.23 is vulnerable to Broken Access Control

Software WC Marketplace Type Plugin Vulnerable versions = 4.0.23 Fixed in 4.0.24 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51355 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 98133d2bdac6 Credits thiennv Required privilege...

WordPress Essential Blocks for Gutenberg Plugin <= 4.2.0 is vulnerable to Broken Access Control

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51360 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID aa89b26b64fb Credits Rafie Muhamm...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.8.1 is vulnerable to SQL Injection

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.8.1 Fixed in 2.8.2 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-50839 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID e03053a216be Credits Fariq Fadillah...

WordPress EazyDocs Plugin < 2.3.4 is vulnerable to SQL Injection

Software EazyDocs Type Plugin Vulnerable versions 2.3.4 Fixed in 2.3.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-6035 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 6ad682fb44ae Credits Dao Xuan Hieu Required privilege Subscriber Published 19...

WordPress MW WP Form Plugin <= 5.0.3 is vulnerable to Arbitrary File Deletion

Software MW WP Form Type Plugin Vulnerable versions = 5.0.3 Fixed in 5.0.4 OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2023-6559 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 24368a3488f4 Credits Thomas Sanzey Required privilege...

WordPress Smart Forms Plugin <= 2.6.84 is vulnerable to Broken Access Control

Software Smart Forms Type Plugin Vulnerable versions = 2.6.84 Fixed in 2.6.85 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49856 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 636ea1edcfea Credits Abdi Pranata Required privile...