WordPress Ultimate Auction plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Ultimate Auction versions = 4.2.5...

WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Responsive Image Gallery, Gallery Album versions = 2.0.3...

WordPress Link To Bible plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sharanabasappa Patchstack Alliance in WordPress Plugin Link To Bible versions = 2.5.9...

WordPress WP To Do Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software WP To Do Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37539 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8e78be231480 Credits younsoung kim, SeoHyeon Lee, MyungJu Kim, SeoHe...

WordPress WP Cookie Law Info Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Cookie Law Info Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37557 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f9392fcaab80 Credits filime Required privilege Administrator...

WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Broken Access Control

Software Responsive Image Gallery, Gallery Album Type Plugin Vulnerable versions = 2.0.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37542 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 563a47d11703 Credits...

WordPress Leaky Paywall Plugin <= 4.21.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Leaky Paywall Type Plugin Vulnerable versions = 4.21.2 Fixed in 4.21.3 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-37540 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6553531150a7 Credits Ananda Dhakal Patchstack...

WordPress zBench theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme zBench versions = 1.4.2...

WordPress Spectra plugin <= 2.13.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Spectra versions = 2.13.7...

WordPress XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin XPlainer - WooCommerce Product FAQ versions = 1.6.3...

WordPress Business One Page theme <= 1.2.9 - Broken Access Control on Notice Dismissal vulnerability

Broken Access Control on Notice Dismissal vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Business One Page versions = 1.2.9...

WordPress Lawyer Landing Page theme <= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Lawyer Landing Page versions = 1.2.4...

WordPress Social Login plugin <= 2.6.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WooCommerce Social Login versions = 2.6.3...

WordPress ShopBuilder – Elementor WooCommerce Builder Addons Plugin <= 2.1.12 is vulnerable to Local File Inclusion

Software ShopBuilder – Elementor WooCommerce Builder Addons Type Plugin Vulnerable versions = 2.1.12 Fixed in 2.1.13 OWASP Top 10 A6: Security Misconfiguration Classification Local File Inclusion CVE CVE-2024-37520 Patch priority Low CVSS severity Low 6.5 Developer Mamunur Rashid PSID 818612bafe4...

WordPress WooCommerce Social Login Plugin <= 2.6.3 is vulnerable to PHP Object Injection

Software WooCommerce Social Login Type Plugin Vulnerable versions = 2.6.3 Fixed in 2.7.0 OWASP Top 10 A5: Security Misconfiguration Classification PHP Object Injection CVE CVE-2024-37502 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 642655a733d8 Credits Ananda Dhak...

WordPress Featured Image from URL Plugin <= 4.8.2 is vulnerable to Broken Access Control

Software Featured Image from URL Type Plugin Vulnerable versions = 4.8.2 Fixed in 4.8.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37516 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 819896bb0ba3 Credits Rafie Muhammad...

WordPress The Events Calendar Plugin <= 6.5.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software The Events Calendar Type Plugin Vulnerable versions = 6.5.1.4 Fixed in 6.5.1.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37518 Patch priority Low CVSS severity Low 4.3 Developer Liquid Web / StellarWP PSID b351df137690 Credits Rafi...

WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Charitable versions = 1.8.1.7...

WordPress Beaver Builder plugin <= 2.8.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Beaver Builder versions = 2.8.2.2...

WordPress Donation Forms by Charitable plugin <= 1.8.1.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Manab Jyoti Dowarah Patchstack Alliance in WordPress Plugin Charitable versions = 1.8.1.7...