WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin <= 4.3.0 is vulnerable to Broken Access Control

Software WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Type Plugin Vulnerable versions = 4.3.0 Fixed in 4.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-7068 Patch priority Low CVSS severity Low 4.3 Developer Claim...

WordPress Post SMTP Plugin <= 2.8.7 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7027 Patch priority Medium CVSS severity Medium 7.1 Developer WPExperts PSID 7142ca21bf69 Credits Sean Murphy Required privilege...

WordPress HTML5 SoundCloud Player Plugin <= 2.8.0 is vulnerable to PHP Object Injection

Software HTML5 SoundCloud Player Type Plugin Vulnerable versions = 2.8.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-52205 Patch priority High CVSS severity High 9.1 Developer Claim ownership PSID 39ab4c99fd96 Credits Rafie Muhammad Patchstack Required...

WordPress Coupon Referral Program Plugin <= 1.7.2 is vulnerable to Sensitive Data Exposure

Software Coupon Referral Program Type Plugin Vulnerable versions = 1.7.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-52190 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 3514be0010e5 Credits Dave Jong Patchstac...

WordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.23 Fixed in 1.5.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52193 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 70cd66e65bfa Credits Ngô Thiên An ancorn from...

WordPress OMGF | Host Google Fonts Locally Plugin <= 5.7.9 is vulnerable to Broken Access Control

Software OMGF | Host Google Fonts Locally Type Plugin Vulnerable versions = 5.7.9 Fixed in 5.7.10 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6600 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID f1d5094ff494 Credits Lucio Sá...

WordPress Image Source Control Plugin <= 2.17.0 is vulnerable to Sensitive Data Exposure

Software Image Source Control Type Plugin Vulnerable versions = 2.17.0 Fixed in 2.17.1 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2023-52187 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 66572409bd51 Credits...

WordPress Theme per user Plugin <= 1.0.1 is vulnerable to PHP Object Injection

Software Theme per user Type Plugin Vulnerable versions = 1.0.1 Fixed in 1.0.2 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-52181 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 74baf7cbbeba Credits Rafie Muhammad Patchstack Required privile...

WordPress Floating Button Plugin <= 6.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Floating Button Type Plugin Vulnerable versions = 6.0 Fixed in 6.0.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-52149 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 33e4d5b87e73 Credits Skalucy Required...

WordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data Exposure

Software 404 Solution Type Plugin Vulnerable versions = 2.33.0 Fixed in 2.33.1 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2023-52146 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8e10ffdc1b34 Credits Joshua Ch...

WordPress Simple Job Board Plugin <= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Simple Job Board Type Plugin Vulnerable versions = 2.10.6 Fixed in 2.10.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-52122 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c971cba266a1 Credits Brandon Roldan...

WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software WP User Profile Avatar Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52118 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4ce43b2baade Credits Khalid Yusuf Required privilege...

WordPress Affiliates Manager Plugin <= 2.9.30 is vulnerable to Sensitive Data Exposure

Software Affiliates Manager Type Plugin Vulnerable versions = 2.9.30 Fixed in 2.9.31 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2023-52148 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 6d65e80d0f2d Credits...

WordPress Easy Video Player Plugin <= 1.2.2.10 is vulnerable to Cross Site Scripting (XSS)

Software Easy Video Player Type Plugin Vulnerable versions = 1.2.2.10 Fixed in 1.2.2.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51689 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 279437fd940f Credits Ngô Thiên An ancorn from...

WordPress Simple Staff List Plugin <= 2.2.4 is vulnerable to Broken Access Control

Software Simple Staff List Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51526 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d6f5e64c564c Credits Abdi Pranata Required...

WordPress Depicter Slider Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Depicter Slider Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51491 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 121cc482ad3d Credits Abdi Pranata Requir...

WordPress WP Frontend Profile Plugin <= 1.3.1 is vulnerable to Privilege Escalation

Software WP Frontend Profile Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51483 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 33e16067363a Credits Raf...

WordPress JVM rich text icons Plugin <= 1.2.6 is vulnerable to Arbitrary File Deletion

Software JVM rich text icons Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-51418 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID a73cfe9ec895 Credits Rafie Muhammad...

WordPress Restaurant Reservations Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software Restaurant Reservations Type Plugin Vulnerable versions = 1.8 Fixed in 1.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51403 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f9150b6886d2 Credits resecured.io Required privilege...

WordPress Backup Migration Plugin 1.0.8-1.3.9 is vulnerable to Remote File Inclusion

Software Backup Migration Type Plugin Vulnerable versions 1.0.8-1.3.9 Fixed in 1.4.0 OWASP Top 10 A5: Security Misconfiguration Classification Remote File Inclusion CVE CVE-2023-6971 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID e70590c9be58 Credits NP3228 - NFlabs...