WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Booking calendar, Appointment Booking System Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-24388 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID ec594d278c4...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Broken Access Control

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-46840 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2e809058d839 Credit...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46842 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID...

WordPress ChatBot Plugin <= 4.2.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software ChatBot Type Plugin Vulnerable versions = 4.2.8 Fixed in 4.2.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-24415 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 56586a24f6dd Credits Rafshanzani Suhada Required...

WordPress Easy Affiliate Links Plugin < 3.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Easy Affiliate Links Type Plugin Vulnerable versions 3.7.1 Fixed in 3.7.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0375 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6cffde070434 Credits István Márton...

WordPress Page Builder: Live Composer Plugin <= 1.5.22 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.22 Fixed in 1.5.23 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4669 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 3a851e56815e Credits Istv...

WordPress WP Review Slider Plugin < 12.2 is vulnerable to SQL Injection

Software WP Review Slider Type Plugin Vulnerable versions 12.2 Fixed in 12.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0260 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 47e53f2f24b7 Credits István Márton Required privilege Subscriber Publish...

WordPress Pinpoint Booking System Plugin < 2.9.9.2.9 is vulnerable to SQL Injection

Software Pinpoint Booking System Type Plugin Vulnerable versions 2.9.9.2.9 Fixed in 2.9.9.2.9 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0220 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 7276b0492738 Credits István Márton Required privilege...

WordPress Parsi Date Plugin < 4.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Parsi Date Type Plugin Vulnerable versions 4.0.2 Fixed in 4.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID d0d0311f443b Credits WPScan Required privilege Unauthenticat...

WordPress Upfrontwp Theme <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Upfrontwp Type Theme Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24009 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 4e64aada38f6 Credits Dave Jong Patchstack Required...

WordPress WP TripAdvisor Review Slider Plugin < 10.8 is vulnerable to SQL Injection

Software WP TripAdvisor Review Slider Type Plugin Vulnerable versions 10.8 Fixed in 10.8 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0261 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID dcd0212f495a Credits István Márton Required privilege...

WordPress Twenty20 Image Before-After Plugin <= 1.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Twenty20 Image Before-After Type Plugin Vulnerable versions = 1.7.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4580 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d082c511a4c8 Credits István...

WordPress WP Go Maps Plugin <= 9.0.15 is vulnerable to Directory Traversal

Software WP Go Maps Type Plugin Vulnerable versions = 9.0.15 Fixed in 9.0.16 OWASP Top 10 A3: Sensitive Data Exposure Classification Directory Traversal CVE CVE-2022-47595 Patch priority Low CVSS severity Low 4.9 Developer WP Go Maps PSID ce001c792740 Credits rezaduty Required privilege...

WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Quick Event Manager Type Plugin Vulnerable versions = 9.7.4 Fixed in 9.7.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23974 Patch priority Low CVSS severity Low 5.4 Developer Fullworks Plugins PSID 5e2ae440ff0d Credits yuyudhn...

WordPress MainWP Favorites Extension Plugin <= 4.0.10 is vulnerable to Broken Access Control

Software MainWP Favorites Extension Type Plugin Vulnerable versions = 4.0.10 Fixed in 4.0.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23739 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 74613185c5a7 Credits Dave Jong...

WordPress MainWP Boilerplate Extension Plugin <= 4.1 is vulnerable to Broken Access Control

Software MainWP Boilerplate Extension Type Plugin Vulnerable versions = 4.1 Fixed in 4.1.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23744 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID dc04c8344b84 Credits Dave Jong...

WordPress MainWP Code Snippets Extension Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)

Software MainWP Code Snippets Extension Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23650 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 27d865081452 Credits Dave...

WordPress MainWP Broken Links Checker Extension Plugin <= 4.0 is vulnerable to Broken Access Control

Software MainWP Broken Links Checker Extension Type Plugin Vulnerable versions = 4.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23736 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 20475e0a5f4c Credits Dave...

WordPress MainWP File Uploader Extension Plugin <= 4.1 is vulnerable to Arbitrary File Upload

Software MainWP File Uploader Extension Type Plugin Vulnerable versions = 4.1 Fixed in 4.1.1 OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Upload CVE CVE-2023-23656 Patch priority High CVSS severity High 10 Developer Claim ownership PSID f49d8364bda5 Credits Dave Jong...

WordPress MainWP Rocket Extension Plugin <= 4.0.3 is vulnerable to Settings Change

Software MainWP Rocket Extension Type Plugin Vulnerable versions = 4.0.3 Fixed in 4.0.4 OWASP Top 10 A5: Broken Access Control Classification Settings Change CVE CVE-2023-23665 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 5dab77b10cf4 Credits Dave Jong Patchstack...