WordPress Easy Set Favicon Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Easy Set Favicon Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33645 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6c770d55f2af Credits Dimas Maulana Required privilege...

WordPress Leaky Paywall Plugin <= 4.20.8 is vulnerable to Broken Access Control

Software Leaky Paywall Type Plugin Vulnerable versions = 4.20.8 Fixed in 4.20.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33594 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID a83bbae5ad9a Credits Joshua Chan Required privileg...

WordPress WZone Plugin <= 14.0.33 is vulnerable to SQL Injection

Software WZone Type Plugin Vulnerable versions = 14.0.33 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-33546 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID 44537a1aade6 Credits Rafie Muhammad Patchstack Required privilege Subscriber...

WordPress Blocksy theme <= 2.0.33 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Theme Blocksy versions = 2.0.33...

WordPress Booking Ultra Pro plugin 1.1.12 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Emili Castells Patchstack Alliance in WordPress Plugin Booking Ultra Pro versions = 1.1.12...

WordPress Slash Admin Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS)

Software Slash Admin Type Plugin Vulnerable versions = 3.8.1 Fixed in 3.8.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-32958 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 52a29e92a4ae Credits Cronus Required...

WordPress Sirv Plugin <= 7.2.2 is vulnerable to Privilege Escalation

Software Sirv Type Plugin Vulnerable versions = 7.2.2 Fixed in 7.2.3 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-32959 Patch priority High CVSS severity High 8.8 Developer Sirv PSID 299a67279292 Credits Emili Castells Required...

WordPress Page Builder: Live Composer Plugin <= 1.5.38 is vulnerable to Broken Access Control

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.38 Fixed in 1.5.39 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32957 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 6edbbb14734c Credits savphill Requir...

WordPress Exclusive Addons Elementor Plugin <= 2.6.9.3 is vulnerable to Cross Site Scripting (XSS)

Software Exclusive Addons Elementor Type Plugin Vulnerable versions = 2.6.9.3 Fixed in 2.6.9.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2750 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4df0b84e184c Credits wesley...

WordPress UDesign Theme <= 4.7.3 is vulnerable to Cross Site Scripting (XSS)

Software UDesign Type Theme Vulnerable versions = 4.7.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-4077 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b5fe2949f69d Credits Rafie Muhammad Patchstack Required privilege...

WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra Patchstack Alliance in WordPress Plugin RTMKit versions = 1.4.1...

WordPress Max Addons Pro for Bricks plugin <= 1.6.1 - Unauthenticated Plugin Settings Reset vulnerability

Unauthenticated Plugin Settings Reset vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Max Addons Pro for Bricks versions = 1.6.1...

WordPress WP ADA Compliance Check Basic plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin WP ADA Compliance Check Basic versions = 3.1.3...

WordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Accessibility Widget versions = 2.2...

WordPress VK Block Patterns plugin <= 1.31.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin VK Block Patterns versions = 1.31.0...

WordPress Evergreen Content Poster plugin <= 1.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by CatFather Patchstack Alliance in WordPress Plugin Evergreen Content Poster versions = 1.4.2...

WordPress Reviews Plus plugin <= 1.3.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Reviews Plus versions = 1.3.4...

WordPress Total Poll Lite plugin <= 4.9.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by thiennv Patchstack Alliance in WordPress Plugin Total Poll Lite versions = 4.9.9...

WordPress Import and export users and customers plugin <= 1.26.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Trình Vũ / Sonicrrrr from VNPT-VCI Patchstack Alliance in WordPress Plugin Import and export users and customers versions = 1.26.2...

WordPress Combo Blocks plugin <= 2.2.78 - Sensitive Data Exposure via API vulnerability

Sensitive Data Exposure via API vulnerability discovered by Peng Zhou Patchstack Alliance in WordPress Plugin Post Grid and Gutenberg Blocks versions = 2.2.78...