WordPress Awesome Support Plugin <= 6.1.7 is vulnerable to Broken Access Control

Software Awesome Support Type Plugin Vulnerable versions = 6.1.7 Fixed in 6.1.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49857 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 75c871c2eac0 Credits thiennv Required privilege...

WordPress Bacola Core Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Bacola Core Type Plugin Vulnerable versions = 1.3.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49839 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID d717888feaf6 Credits RE-ALTER Required privilege Unauthenticate...

WordPress MW WP Form Plugin <= 5.0.1 is vulnerable to Arbitrary File Upload

Software MW WP Form Type Plugin Vulnerable versions = 5.0.1 Fixed in 5.0.2 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6316 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 597833164ec3 Credits István Márton Required privilege Unauthenticat...

WordPress JetElements For Elementor Plugin <= 2.6.13 is vulnerable to Arbitrary File Download

Software JetElements For Elementor Type Plugin Vulnerable versions = 2.6.13 Fixed in 2.6.13.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-48759 Patch priority High CVSS severity High 7.5 Developer Crocoblock PSID b2e64216e8cc Credits Rafie Muhammad...

WordPress 360 Javascript Viewer Plugin <= 1.7.11 is vulnerable to Broken Access Control

Software 360 Javascript Viewer Type Plugin Vulnerable versions = 1.7.11 Fixed in 1.7.12 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-48779 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 961ea4addc67 Credits Abdi Pranata Requir...

WordPress LadiApp Plugin <= 4.4 is vulnerable to Broken Access Control

Software LadiApp Type Plugin Vulnerable versions = 4.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49158 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID d4f5b16a2edf Credits Truoc Phan Required privilege Subscribe...

WordPress HUSKY Plugin <= 1.3.4.2 is vulnerable to SQL Injection

Software HUSKY Type Plugin Vulnerable versions = 1.3.4.2 Fixed in 1.3.4.3 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-40010 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 9191c9d76ec2 Credits Nguyen Anh Tien Required privilege Unauthenticated...

WordPress Porto Theme - Functionality Plugin < 2.12.1 is vulnerable to SQL Injection

Software Porto Theme - Functionality Type Plugin Vulnerable versions 2.12.1 Fixed in 2.12.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-48738 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 5a7e2b4a3331 Credits Rafie Muhammad Patchstack Required...

WordPress Userpro Plugin <= 5.1.1 is vulnerable to Broken Authentication

Software Userpro Type Plugin Vulnerable versions = 5.1.1 Fixed in 5.1.2 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2023-2437 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 9aac076e3030 Credits István Márton...

WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Privilege Escalation

Software wpForo Forum Type Plugin Vulnerable versions = 2.2.3 Fixed in 2.2.4 OWASP Top 10 A4: Insecure Design Classification Privilege Escalation CVE CVE-2023-47868 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 18839e0584f6 Credits Jesse McNeil Required privilege...

WordPress Shortcodes and extra features for Phlox theme Plugin <= 2.14.0 is vulnerable to Local File Inclusion

Software Shortcodes and extra features for Phlox theme Type Plugin Vulnerable versions = 2.14.0 Fixed in 2.15.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2023-37888 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 2ea7a20d00de Credits Rafie...

WordPress Permalinks Customizer Plugin <= 2.8.2 is vulnerable to Cross Site Scripting (XSS)

Software Permalinks Customizer Type Plugin Vulnerable versions = 2.8.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47773 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 75025c824dd0 Credits Le Ngoc Anh Required privilege...

WordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Bus Ticket Booking with Seat Reservation Type Plugin Vulnerable versions = 5.2.5 Fixed in 5.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30496 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID cc34a3da3177...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Broken Access Control

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46146 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID dba7a9d87836 Credits Rafie Muhammad Patchstack...

WordPress Seo By 10Web Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Seo By 10Web Type Plugin Vulnerable versions = 1.2.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-34375 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 68446366bf16 Credits Le Ngoc Anh Required...

WordPress EazyDocs Plugin <= 2.3.5 is vulnerable to Broken Access Control

Software EazyDocs Type Plugin Vulnerable versions = 2.3.5 Fixed in 2.3.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47648 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 25f152946ed4 Credits Skalucy Required privilege...

WordPress MStore API Plugin <= 4.10.7 is vulnerable to Privilege Escalation

Software MStore API Type Plugin Vulnerable versions = 4.10.7 Fixed in 4.10.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-3277 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 30d740e716a7 Credits Truoc Phan ...

WordPress WP Travel Plugin <= 7.8.0 is vulnerable to Broken Access Control

Software WP Travel Type Plugin Vulnerable versions = 7.8.0 Fixed in 7.8.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47224 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID bf6c5eaeacad Credits Mika Required privilege...

WordPress Login Screen Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS)

Software Login Screen Manager Type Plugin Vulnerable versions = 3.5.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47182 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 33ab93e220c0 Credits Nano Required privilege...

WordPress Article analytics Plugin <= 1.0 is vulnerable to SQL Injection

Software Article analytics Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5640 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 78430de01615 Credits Nicolas Surribas Required privilege Unauthenticate...