WordPress Import Spreadsheets from Microsoft Excel Plugin <= 10.1.4 is vulnerable to Arbitrary File Upload

Software Import Spreadsheets from Microsoft Excel Type Plugin Vulnerable versions = 10.1.4 Fixed in 10.1.5 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-38734 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID 2c69040b9cb5 Credits Peng Zho...

WordPress Spiffy Calendar Plugin <= 4.9.11 is vulnerable to SQL Injection

Software Spiffy Calendar Type Plugin Vulnerable versions = 4.9.11 Fixed in 4.9.12 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-38692 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 21e2115ebd60 Credits Nguyễn Trung Kiên anhchangmutrang Required...

WordPress WPCS Plugin <= 1.2.0.3 is vulnerable to Content Injection

Software WPCS Type Plugin Vulnerable versions = 1.2.0.3 Fixed in 1.2.0.4 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-38700 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2b3604018b32 Credits stealthcopter Required privilege Unauthenticat...

WordPress Sky Addons for Elementor Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)

Software Sky Addons for Elementor Type Plugin Vulnerable versions = 2.5.5 Fixed in 2.5.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38687 Patch priority Low CVSS severity Low 6.5 Developer Shahidul Islam PSID d7729ac64aec Credits Khalid Yusuf Required privileg...

WordPress WooCommerce Report Plugin <= 1.4.5 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Report Type Plugin Vulnerable versions = 1.4.5 Fixed in 1.5.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38683 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d2a44e699bc6 Credits Le Ngoc Anh Required privileg...

WordPress Booking Ultra Pro Plugin <= 1.1.13 is vulnerable to Cross Site Scripting (XSS)

Software Booking Ultra Pro Type Plugin Vulnerable versions = 1.1.13 Fixed in 1.1.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38676 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5502b7d4c80c Credits LVT-tholv2k Required privilege...

WordPress Multisite Content Copier/Updater Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Multisite Content Copier/Updater Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38673 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 84ff3a1a21a7 Credits Dimas Maulana...

WordPress Bradmax Player Plugin <= 1.1.27 is vulnerable to Cross Site Scripting (XSS)

Software Bradmax Player Type Plugin Vulnerable versions = 1.1.27 Fixed in 1.1.28 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37957 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5e282b87fc01 Credits Jean Tirstan T Required privilege...

WordPress VK All in One Expansion Unit Plugin <= 9.99.1.0 is vulnerable to Cross Site Scripting (XSS)

Software VK All in One Expansion Unit Type Plugin Vulnerable versions = 9.99.1.0 Fixed in 9.99.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37956 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 525bd2086dbb Credits savphill Required...

WordPress Tutor LMS Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37947 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 54e1794329a4 Credits justakazh Required privilege editor and Tuto...

WordPress Gravity Forms: Multiple Form Instances Plugin <= 1.1.1 is vulnerable to Full Path Disclosure (FPD)

Software Gravity Forms: Multiple Form Instances Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-6550 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID af3116244e6e Credits...

WordPress WP Travel Engine Plugin <= 5.9.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Travel Engine Type Plugin Vulnerable versions = 5.9.1 Fixed in 5.9.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37944 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1b17a1368976 Credits Manab Jyoti Dowarah Required privileg...

WordPress REVIEWS.io Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)

Software REVIEWS.io Type Plugin Vulnerable versions = 1.2.8 Fixed in 1.2.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38677 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c5a7609b29f0 Credits LVT-tholv2k Required privilege Contributor...

WordPress Team Members Plugin <= 5.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Team Members Type Plugin Vulnerable versions = 5.3.3 Fixed in 5.3.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38670 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f0e47f407025 Credits Jean Tirstan T Required privilege...

WordPress Woocommerce OpenPos Plugin <= 7.0.1 is vulnerable to Broken Access Control

Software Woocommerce OpenPos Type Plugin Vulnerable versions = 7.0.1 Fixed in 7.0.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37935 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID d6898ddc425e Credits Dave Jong Patchstack...

WordPress Woocommerce OpenPos Plugin <= 6.4.4 is vulnerable to Arbitrary File Deletion

Software Woocommerce OpenPos Type Plugin Vulnerable versions = 6.4.4 Fixed in 7.0.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-37932 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 80d70b64099f Credits Dave Jong Patchstack...

WordPress Jobmonster Theme <= 4.7.4 is vulnerable to Privilege Escalation

Software Jobmonster Type Theme Vulnerable versions = 4.7.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-37927 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 2a728f531379 Credits Dave Jong Patchstack Required...

WordPress SCSS Happy Compiler Plugin <= 1.3.10 is vulnerable to Cross Site Scripting (XSS)

Software SCSS Happy Compiler Type Plugin Vulnerable versions = 1.3.10 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5600 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d155b6e3b303 Credits Lucio Sá Requir...

WordPress IQ Testimonials Plugin <= 2.2.7 is vulnerable to Arbitrary File Upload

Software IQ Testimonials Type Plugin Vulnerable versions = 2.2.7 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6314 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 8b1a4c014222 Credits István Márton Required privilege...

WordPress WordPress Form Builder Plugin – Gutenberg Forms Plugin <= 2.2.9 is vulnerable to Arbitrary File Upload

Software WordPress Form Builder Plugin – Gutenberg Forms Type Plugin Vulnerable versions = 2.2.9 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6313 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 6945098cfe6d Credits István Márt...