WordPress Woffice Theme <= 5.4.10 is vulnerable to Privilege Escalation

Software Woffice Type Theme Vulnerable versions = 5.4.10 Fixed in 5.4.12 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-43153 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID f1d354bce137 Credits Rafie Muhammad...

WordPress BookingPress Plugin 1.1.6 - 1.1.7 is vulnerable to Broken Authentication

Software BookingPress Type Plugin Vulnerable versions 1.1.6 - 1.1.7 Fixed in 1.1.8 OWASP Top 10 A1: Broken Access Control Classification Broken Authentication CVE CVE-2024-7350 Patch priority Low CVSS severity Low 10 Developer Claim ownership PSID a00d0a9226a3 Credits Gibran Abdillah Required...

WordPress The Next LVL Theme <= 1.1.0 is vulnerable to PHP Object Injection

Software The Next LVL Type Theme Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-7561 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID b79740b6d53a Credits Francesco Carlucci Required privilege...

WordPress Extensions for Elementor plugin <= 2.0.31 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Extensions for Elementor versions = 2.0.31...

WordPress WP-PostRatings plugin <= 1.91.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin WP-PostRatings versions = 1.91.1...

WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by justakazh Patchstack Alliance in WordPress Plugin Easy Digital Downloads versions = 3.2.12...

WordPress Message Filter for Contact Form 7 plugin <= 1.6.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Message Filter for Contact Form 7 versions = 1.6.1.1...

WordPress Custom 404 Pro plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Custom 404 Pro versions = 3.11.1...

WordPress Black Widgets For Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Michael Patchstack Alliance in WordPress Plugin Black Widgets For Elementor versions = 1.3.5...

WordPress RegistrationMagic plugin <= 6.0.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin RegistrationMagic versions = 6.0.0.1...

WordPress Social Feed Gallery plugin <= 4.3.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WP Social Feed Gallery versions = 4.3.9...

WordPress WordPress File Upload plugin <= 4.24.7 - Broken Access Control + CSRF vulnerability

Broken Access Control + CSRF vulnerability discovered by emad Patchstack Alliance in WordPress Plugin WordPress File Upload versions = 4.24.7...

WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce Plugin <= 2.6.18 is vulnerable to Cross Site Request Forgery (CSRF)

Software Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce Type Plugin Vulnerable versions = 2.6.18 Fixed in 2.6.19 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-39657 Patch priority Low CVSS severity Low 4.3 Developer Cla...

WordPress WP Social Feed Gallery Plugin <= 4.3.9 is vulnerable to Broken Access Control

Software WP Social Feed Gallery Type Plugin Vulnerable versions = 4.3.9 Fixed in 4.4.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-39640 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID dd020799eba7 Credits Rafie Muhammad...

WordPress Donation Block For PayPal Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Donation Block For PayPal Type Plugin Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6021 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 49c1f9f09af2 Credits Bob Matyas...

WordPress Edubin theme <= 9.2.0 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Theme Edubin versions = 9.2.0...

WordPress PowerPack for Beaver Builder plugin <= 2.33.0 - Contributor+ Privilege Escalation vulnerability

Contributor+ Privilege Escalation vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin PowerPack for Beaver Builder versions = 2.33.0...

WordPress ListingPro theme <= 2.9.4 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability

Cross Site Request Forgery CSRF to Account Takeover vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme ListingPro versions = 2.9.4...

WordPress ListingPro plugin <= 2.9.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin ListingPro versions = 2.9.4...

WordPress ConveyThis Translate plugin <= 234 - Non-arbitrary Options Update vulnerability

Non-arbitrary Options Update vulnerability discovered by Humberto Castelo Branco Patchstack Alliance in WordPress Plugin ConveyThis versions = 234...