WordPress Flipping Cards Plugin <= 1.30 is vulnerable to Cross Site Scripting (XSS)

Software Flipping Cards Type Plugin Vulnerable versions = 1.30 Fixed in 1.31 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-45460 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a59a35b1803e Credits Jorge Diaz ddiax Required privilege...

WordPress Envira Photo Gallery Plugin < 1.8.15 is vulnerable to Cross Site Scripting (XSS)

Software Envira Photo Gallery Type Plugin Vulnerable versions 1.8.15 Fixed in 1.8.15 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3899 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 91d28b966c51 Credits Dmitrii Ignatyev...

WordPress WooCommerce Photo Reviews - Review Reminders - Review for Discounts Plugin <= 1.3.13.2 is vulnerable to Broken Authentication

Software WooCommerce Photo Reviews - Review Reminders - Review for Discounts Type Plugin Vulnerable versions = 1.3.13.2 Fixed in 1.3.14 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-8277 Patch priority High CVSS severity High 9.8...

WordPress Flash & HTML5 Video Plugin <= 2.5.34 is vulnerable to Broken Access Control

Software Flash & HTML5 Video Type Plugin Vulnerable versions = 2.5.34 Fixed in 2.5.35 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7721 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 692106c3e036 Credits Lucio Sá Required...

WordPress Bit File Manager Plugin <= 6.5.5 is vulnerable to Arbitrary File Upload

Software Bit File Manager Type Plugin Vulnerable versions = 6.5.5 Fixed in 6.5.6 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7770 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 4d22ee982f55 Credits TANG Cheuk Hei siunam Required privileg...

WordPress Floating Contact Button Plugin < 2.8 is vulnerable to Cross Site Scripting (XSS)

Software Floating Contact Button Type Plugin Vulnerable versions 2.8 Fixed in 2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7891 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2bb2b652e147 Credits Kientt Required...

WordPress Post Grid and Gutenberg Blocks Plugin <= 2.2.90 is vulnerable to Privilege Escalation

Software Post Grid and Gutenberg Blocks Type Plugin Vulnerable versions = 2.2.90 Fixed in 2.2.91 OWASP Top 10 A4: Insecure Design Classification Privilege Escalation CVE CVE-2024-8253 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 751ae97fca06 Credits wesley wcraft...

WordPress WP-Recall Plugin <= 16.26.8 is vulnerable to Insecure Direct Object References (IDOR)

Software WP-Recall Type Plugin Vulnerable versions = 16.26.8 Fixed in 16.26.9 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-8292 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 49cff2ea1861 Credits wesley wcraft...

WordPress ForumWP Plugin <= 2.0.2 is vulnerable to Privilege Escalation

Software ForumWP Type Plugin Vulnerable versions = 2.0.2 Fixed in 2.1.0 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8428 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 04472abbfa0c Credits wesley wcraft...

WordPress LiteSpeed Cache Plugin < 6.5.0.1 is vulnerable to Broken Authentication

Software LiteSpeed Cache Type Plugin Vulnerable versions 6.5.0.1 Fixed in 6.5.0.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-44000 Patch priority High CVSS severity High 9.8 Developer Hai Zheng / Lite Speed Cache PSID 8f939cc0b306...

WordPress Geo Controller Plugin <= 8.7.3 is vulnerable to Broken Access Control

Software Geo Controller Type Plugin Vulnerable versions = 8.7.3 Fixed in 8.7.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7380 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c241dd8210b8 Credits Lucio Sá Required privilege...

WordPress Viral Signup Plugin <= 2.1 is vulnerable to SQL Injection

Software Viral Signup Type Plugin Vulnerable versions = 2.1 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-6926 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID bccf241bb1d7 Credits Project Black Required privilege Unauthenticated...

WordPress The Ultimate WordPress Toolkit – WP Extended Plugin <= 3.0.8 is vulnerable to Arbitrary File Download

Software The Ultimate WordPress Toolkit – WP Extended Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-8104 Patch priority High CVSS severity High 7.7 Developer WP Extended PSID 9fb5e1b755dd Credits...

WordPress WC Marketplace Plugin <= 4.2.0 is vulnerable to Privilege Escalation

Software WC Marketplace Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8289 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 9025ce00a31d Credits wesley...

WordPress PixelYourSite PRO Plugin <= 10.4.2 is vulnerable to Sensitive Data Exposure

Software PixelYourSite PRO Type Plugin Vulnerable versions = 10.4.2 Fixed in 10.4.3 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-7870 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c3722df4917d Credits Xetnus Required...

WordPress Sign-up Sheets Plugin < 2.2.13 is vulnerable to Cross Site Scripting (XSS)

Software Sign-up Sheets Type Plugin Vulnerable versions 2.2.13 Fixed in 2.2.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6020 Patch priority Medium CVSS severity Medium 7.1 Developer Fetch Designs PSID 65a76cb93247 Credits Bob Matyas Required...

WordPress The Ultimate WordPress Toolkit – WP Extended Plugin <= 3.0.8 is vulnerable to Insecure Direct Object References (IDOR)

Software The Ultimate WordPress Toolkit – WP Extended Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-8123 Patch priority Low CVSS severity Low 5.4 Developer WP Extended PSID...

WordPress FluentForm Plugin <= 5.1.18 is vulnerable to Broken Access Control

Software FluentForm Type Plugin Vulnerable versions = 5.1.18 Fixed in 5.1.19 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5053 Patch priority Low CVSS severity Low 4.2 Developer Claim ownership PSID 98f9a0a6e43d Credits Tobias Weißhaar kun19 Required...

WordPress WP Job Portal Plugin <= 2.1.6 is vulnerable to Broken Access Control

Software WP Job Portal Type Plugin Vulnerable versions = 2.1.6 Fixed in 2.1.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-7950 Patch priority High CVSS severity High 9.8 Developer Ahmad PSID 3162f7bd55ec Credits Connor Billings Required privilege...

WordPress Attire Theme <= 2.0.6 is vulnerable to PHP Object Injection

Software Attire Type Theme Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7435 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 834924dbc4f2 Credits Francesco Carlucci Required privilege Contribut...