WordPress Vmax Project Manager plugin <= 1.0 - Local File Inclusion to RCE vulnerability

Local File Inclusion to RCE vulnerability discovered by tahu.datar Patchstack Alliance in WordPress Plugin Vmax Project Manager versions = 1.0...

WordPress VR Calendar plugin <= 2.4.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by tahu.datar Patchstack Alliance in WordPress Plugin VR Calendar versions = 2.4.0...

WordPress WP Newsletter Subscription plugin <= 1.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by tahu.datar Patchstack Alliance in WordPress Plugin WP Newsletter Subscription versions = 1.1...

WordPress WP Ticket Ultra plugin <= 1.0.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by tahu.datar Patchstack Alliance in WordPress Plugin WP Ticket Ultra Help Desk & Support Plugin versions = 1.0.5...

WordPress WPSPX plugin <= 1.0.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by tahu.datar Patchstack Alliance in WordPress Plugin WPSPX versions = 1.0.2...

WordPress ABCApp Creator Plugin <= 1.1.2 is vulnerable to Local File Inclusion

Software ABCApp Creator Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44023 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 7fc9717656e2 Credits tahu.datar Required privilege Unauthenticat...

WordPress Google Calendar Events Plugin <= 3.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Google Calendar Events Type Plugin Vulnerable versions = 3.4.2 Fixed in 3.4.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8549 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9f01a635ec08 Credits vgo0 Requir...

WordPress Daily Prayer Time Plugin <= 2024.08.26 is vulnerable to SQL Injection

Software Daily Prayer Time Type Plugin Vulnerable versions = 2024.08.26 Fixed in 2024.09.14 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-8621 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID bdae70687f12 Credits Krzysztof Zając Required privilege...

WordPress Vmax Project Manager Plugin <= 1.0 is vulnerable to Local File Inclusion

Software Vmax Project Manager Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44014 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID 0a143d09e270 Credits tahu.datar Required privilege...

WordPress WP Newsletter Subscription Plugin <= 1.1 is vulnerable to Local File Inclusion

Software WP Newsletter Subscription Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44012 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 47db4abe89e4 Credits tahu.datar Required privilege...

WordPress Contact Form to Any API Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form to Any API Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7617 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8a05dbbe144d Credits Jorgson...

WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Crowdsignal Dashboard – Polls, Surveys & more Type Plugin Vulnerable versions = 3.1.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43338 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 64165e457270...

WordPress CSS JS Files Plugin <= 1.5.0 is vulnerable to Directory Traversal

Software CSS JS Files Type Plugin Vulnerable versions = 1.5.0 Fixed in 1.5.1 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-9146 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID eaa2d0720275 Credits jsjp Required privilege Administrator Published...

WordPress Multipurpose Ticket Booking Manager plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jorge Diaz - ddiax Patchstack Alliance in WordPress Plugin Multipurpose Ticket Booking Manager versions = 4.2.2...

WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Sunshine Photo Cart versions = 3.2.9...

WordPress IdeaPush plugin <= 8.66 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin IdeaPush versions = 8.66...

WordPress WP Datepicker plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WP Datepicker versions = 2.1.1...

WordPress Houzez Login Register Plugin <= 3.2.5 is vulnerable to Privilege Escalation

Software Houzez Login Register Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.3.0 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2024-21743 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 864db44c0749 Credits luc Required...

WordPress SKT Templates – Elementor & Gutenberg templates plugin <= 6.14 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin SKT Templates – Elementor & Gutenberg templates versions = 6.14...

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.3.6...