WordPress Releases Update 6.4.2 to Address Critical Remote Attack Vulnerability

WordPress has released version 6.4.2 with a patch for a critical security flaw that could be exploited by threat actors by combining it with another bug to execute arbitrary PHP code on vulnerable sites. "A remote code execution vulnerability that is not directly exploitable in core; however, the...

WordPress Shortcoder Plugin <= 6.3 is vulnerable to Broken Access Control

Software Shortcoder Type Plugin Vulnerable versions = 6.3 Fixed in 6.3.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49849 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID f8adf2be0194 Credits Abdi Pranata Required privileg...

WordPress Essential Addons for Elementor Pro Plugin < 5.4.9 CSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpdeveloper:essentialaddonsforelementor"; if description...

WordPress Cosmetsy Core Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Cosmetsy Core Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49839 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 77a58ba376e1 Credits RE-ALTER Required privilege...

WordPress Astra Pro Plugin <= 4.3.1 is vulnerable to Remote Code Execution (RCE)

Software Astra Pro Type Plugin Vulnerable versions = 4.3.1 Fixed in 4.3.2 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2023-49830 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 4758946ebae8 Credits Rafie Muhammad Patchstack Required...

WordPress Soledad Theme <= 8.4.1 is vulnerable to Cross Site Scripting (XSS)

Software Soledad Type Theme Vulnerable versions = 8.4.1 Fixed in 8.4.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49827 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4415c6f5a085 Credits Rafie Muhammad Patchstack Required...

WordPress WappPress Plugin <= 5.0.3 is vulnerable to Arbitrary File Upload

Software WappPress Type Plugin Vulnerable versions = 5.0.3 Fixed in 6.0.0 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-49815 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 7f1643a48293 Credits Rafie Muhammad Patchstack Required privilege...

WordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software WOOCS – WooCommerce Currency Switcher Type Plugin Vulnerable versions = 1.4.1.4 Fixed in 1.4.1.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49834 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dcb04c679c38...

WordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to SQL Injection

Software Sayfa Sayaç Type Plugin Vulnerable versions = 2.6 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-49776 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID b5614af7ec8d Credits Rafie Muhammad Patchstack Required privilege...

WordPress Genesis Simple Love Plugin <= 2.0 is vulnerable to PHP Object Injection

Software Genesis Simple Love Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-49772 Patch priority High CVSS severity High 10 Developer Claim ownership PSID fa51f08cd8a2 Credits Rafie Muhammad Patchstack Required...

WordPress EWWW Image Optimizer Plugin < 7.2.1 Information Disclosure Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ewww:imageoptimizer"; if description...

WordPress NextGEN Gallery Plugin < 3.39 CSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:imagely:nextgengallery"; if description...

WordPress SpeedyCache Plugin <= 1.1.2 is vulnerable to Server Side Request Forgery (SSRF)

Software SpeedyCache Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2023-49746 Patch priority Low CVSS severity Low 4.9 Developer SpeedyCache PSID cc30099f18c4 Credits Yuchen Ji...

WordPress Biteship Plugin <= 2.2.27 is vulnerable to Cross Site Scripting (XSS)

Software Biteship Type Plugin Vulnerable versions = 2.2.27 Fixed in 2.2.28 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49767 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 9051a07a1e48 Credits Luqman Hakim Y Required privilege Sho...

WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Addons for Contact Form 7 Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49766 Patch priority High CVSS severity High 7.1 Developer Themefic PSID faa03e459da6 Credits RE-ALTER Required...

WordPress Elementor Timeline Widget Plugin <= 2.2 is vulnerable to Broken Access Control

Software Elementor Timeline Widget Type Plugin Vulnerable versions = 2.2 Fixed in 2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49755 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6352a8b50113 Credits Abdi Pranata Required...

WordPress PageLayer Plugin <= 1.7.7 is vulnerable to Broken Access Control

Software PageLayer Type Plugin Vulnerable versions = 1.7.7 Fixed in 1.7.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49196 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 932dd69200f0 Credits Abdi Pranata Required privilege...

WordPress PowerPack Pro for Elementor Plugin <= 2.9.23 is vulnerable to Cross Site Scripting (XSS)

Software PowerPack Pro for Elementor Type Plugin Vulnerable versions = 2.9.23 Fixed in 2.9.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49739 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2b872117ab59 Credits Rafie Muhammad...

Exploit for Code Injection in Qodeinteractive Qode_Essential_Addons

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Aut...

WordPress Machic Core Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Machic Core Type Plugin Vulnerable versions = 1.2.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49186 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a0c9d73f4a61 Credits RE-ALTER Required privilege...