WordPress Spiffy Calendar Plugin <= 4.9.1 is vulnerable to SQL Injection

Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.1 Fixed in 4.9.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-46859 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 127ff2924c25 Credits Justiice Required privilege Subscriber Publishe...

WordPress SEOPress Plugin <= 6.5.0.2 is vulnerable to PHP Object Injection

Software SEOPress Type Plugin Vulnerable versions = 6.5.0.2 Fixed in 6.5.0.3 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-1669 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 045f095df46e Credits Nguyen Huu Do Required privilege Administrator...

Hackers Exploiting WordPress Elementor Pro Vulnerability: Millions of Sites at Risk!

Unknown threat actors are actively exploiting a recently patched security vulnerability in the Elementor Pro website builder plugin for WordPress. The flaw, described as a case of broken access control, impacts versions 3.11.6 and earlier. It was addressed by the plugin maintainers in version...

WordPress Order date time for WooCommerce Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)

Software Order date time for WooCommerce Type Plugin Vulnerable versions = 3.0.19 Fixed in 3.0.20 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28991 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7482ff6d1d87 Credits Myung...

WordPress Affiliates Manager Plugin <= 2.9.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software Affiliates Manager Type Plugin Vulnerable versions = 2.9.20 Fixed in 2.9.21 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-28986 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID fc4c4d12d1a1 Credits minhtuanact...

WordPress HappyFiles Pro Plugin <= 1.8.1 is vulnerable to Broken Access Control

Software HappyFiles Pro Type Plugin Vulnerable versions = 1.8.1 Fixed in 1.8.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25445 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 518a5cea4b57 Credits Dave Jong Patchstack...

WordPress HappyFiles Pro Plugin <= 1.8.1 is vulnerable to Arbitrary File Deletion

Software HappyFiles Pro Type Plugin Vulnerable versions = 1.8.1 Fixed in 1.8.2 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-25446 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 9c01f634cec4 Credits Dave Jong Patchstack...

WordPress real-estate-pro Plugin < 1.7.1 is vulnerable to Privilege Escalation

Software real-estate-pro Type Plugin Vulnerable versions 1.7.1 Fixed in 1.7.1 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2020-36666 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID a8f610e7b2fc Credits Omar Badran Required privilege...

WordPress Product Feed PRO for WooCommerce Plugin <= 12.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Product Feed PRO for WooCommerce Type Plugin Vulnerable versions = 12.4.4 Fixed in 12.4.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46793 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f469aaf3b8e7 Credits...

WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin <= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Product Carousel Slider & Grid Ultimate for WooCommerce Type Plugin Vulnerable versions = 1.9.3 Fixed in 1.9.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Meta Slider Plugin <= 3.29.0 is vulnerable to Cross Site Scripting (XSS)

Software Meta Slider Type Plugin Vulnerable versions = 3.29.0 Fixed in 3.29.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 2e34a11fb393 Credits WordFence Required privilege...

WordPress Elementor Addons, Widgets and Enhancements – Stax Plugin <= 1.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Elementor Addons, Widgets and Enhancements – Stax Type Plugin Vulnerable versions = 1.4.3 Fixed in 1.4.4.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress WP Mail Logging Plugin <= 1.10.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Mail Logging Type Plugin Vulnerable versions = 1.10.5 Fixed in 1.11.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8badb5d1d476 Credits István Márton...

WordPress Wiremo – Product Reviews for WooCommerce Plugin <= 1.4.96 is vulnerable to Cross Site Request Forgery (CSRF)

Software Wiremo – Product Reviews for WooCommerce Type Plugin Vulnerable versions = 1.4.96 Fixed in 1.4.97 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2d39700f9e9f...

WordPress wePOS – Point Of Sale (POS) for WooCommerce Plugin <= 1.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software wePOS – Point Of Sale POS for WooCommerce Type Plugin Vulnerable versions = 1.2.5 Fixed in 1.2.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 48be28a5ac74...

WordPress Contact Form Email Plugin <= 1.3.31 is vulnerable to Other Vulnerability Type

Software Contact Form Email Type Plugin Vulnerable versions = 1.3.31 Fixed in 1.3.32 OWASP Top 10 A5: Broken Access Control Classification Other Vulnerability Type CVE CVE-2023-28494 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1b66482cfee4 Credits István Márton Require...

WordPress Product Watermark for WooCommerce Plugin <= 1.3.5.6 is vulnerable to Broken Access Control

Software Product Watermark for WooCommerce Type Plugin Vulnerable versions = 1.3.5.6 Fixed in 1.3.5.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45813 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 83199b91f3d5 Credits István...

WordPress Min and Max Quantity for WooCommerce Plugin <= 1.3.2.6 is vulnerable to Broken Access Control

Software Min and Max Quantity for WooCommerce Type Plugin Vulnerable versions = 1.3.2.6 Fixed in 1.3.2.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45813 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID d01f544d9c9e Credits Istv...

WordPress Products Suggestions for WooCommerce Plugin <= 3.5.7.6 is vulnerable to Broken Access Control

Software Products Suggestions for WooCommerce Type Plugin Vulnerable versions = 3.5.7.6 Fixed in 3.5.7.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45813 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2035a8efcc94 Credits Istv...

WordPress Be POPIA Compliant Plugin <= 1.2.0 is vulnerable to SQL Injection

Software Be POPIA Compliant Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.3.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47445 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 90e83cd07291 Credits Team WeBoB Required privilege Unauthenticate...