WordPress WP Reset Plugin <= 2.01 is vulnerable to Broken Access Control

Software WP Reset Type Plugin Vulnerable versions = 2.01 Fixed in 2.03 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4661 Patch priority Low CVSS severity Low 4.3 Developer WebFactory Ltd. PSID 7f5481b63727 Credits Foxyyy Required privilege Subscriber...

WordPress ARForms Plugin < 6.6 is vulnerable to Cross Site Scripting (XSS)

Software ARForms Type Plugin Vulnerable versions 6.6 Fixed in 6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4621 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 54c970f6100c Credits Bob Matyas Required privilege...

WordPress ARForms Plugin < 6.6 is vulnerable to Remote Code Execution (RCE)

Software ARForms Type Plugin Vulnerable versions 6.6 Fixed in 6.6 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2024-4620 Patch priority High CVSS severity High 10 Developer Claim ownership PSID eba026d169e8 Credits mgthuramoemyint Required privilege Unauthenticated...

WordPress Music Store Plugin <= 1.1.13 is vulnerable to SQL Injection

Software Music Store Type Plugin Vulnerable versions = 1.1.13 Fixed in 1.1.14 OWASP Top 10 A3: Injection Classification SQL Injection CVE N/A Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 3ee22c619ee0 Credits Noriko Totsuka JPCERT/CC Required privilege Unauthenticated...

WordPress Tutor LMS Plugin <= 2.7.1 is vulnerable to Insecure Direct Object References (IDOR)

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-5438 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 04944e6bcf56 Credits Thanh Nam Tran...

WordPress Market Exporter Plugin <= 2.0.19 is vulnerable to Arbitrary File Deletion

Software Market Exporter Type Plugin Vulnerable versions = 2.0.19 Fixed in 2.0.20 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-5637 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID c9e019d8b649 Credits Lucio Sá Required...

WordPress GDPR CCPA Compliance Support Plugin <= 2.7.0 is vulnerable to Cross Site Scripting (XSS)

Software GDPR CCPA Compliance Support Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5607 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 298f3a902d63 Credits Lucio...

WordPress Ovic Importer Plugin <= 1.6.3 is vulnerable to Arbitrary File Download

Software Ovic Importer Type Plugin Vulnerable versions = 1.6.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-35754 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID cc9fdc38f203 Credits Majed Refaea Required privile...

WordPress The Post Grid Plugin <= 7.7.1 is vulnerable to Cross Site Scripting (XSS)

Software The Post Grid Type Plugin Vulnerable versions = 7.7.1 Fixed in 7.7.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35739 Patch priority Low CVSS severity Low 6.5 Developer Mamunur Rashid PSID 3801d97a66a9 Credits SouzaZinn Required privilege Contributor...

WordPress WP Visitors Tracker Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Visitors Tracker Type Plugin Vulnerable versions = 2.3 Fixed in 2.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35737 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6ab9fca25607 Credits Dave Jong Patchstack Required...

WordPress Visualizer Plugin <= 3.11.1 is vulnerable to SQL Injection

Software Visualizer Type Plugin Vulnerable versions = 3.11.1 Fixed in 3.11.2 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-35736 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID a8a01c7cac74 Credits Trương Hữu Phúc truonghuuphuc Required privilege...

WordPress Newsletters Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)

Software Newsletters Type Plugin Vulnerable versions = 4.9.5 Fixed in 4.9.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35718 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3451f4656122 Credits Yudistira Arya Required privilege...

WordPress Idyllic Theme <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)

Software Idyllic Type Theme Vulnerable versions = 1.1.8 Fixed in 1.1.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35714 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4b8fcbebdd9f Credits stealthcopter Required privilege Contributor...

WordPress Database Cleaner Plugin <= 1.0.5 is vulnerable to Directory Traversal

Software Database Cleaner Type Plugin Vulnerable versions = 1.0.5 Fixed in 1.0.6 OWASP Top 10 A5: Security Misconfiguration Classification Directory Traversal CVE CVE-2024-35712 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 5bd9ebec1e34 Credits Ananda Dhakal Patchstack...

WordPress Heateor Social Login Plugin <= 1.1.32 is vulnerable to Cross Site Scripting (XSS)

Software Heateor Social Login Type Plugin Vulnerable versions = 1.1.32 Fixed in 1.1.33 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35706 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID dcaf15173a8d Credits LVT-tholv2k Required...

WordPress Widget Options - Extended Plugin <= 5.1.0 is vulnerable to Sensitive Data Exposure

Software Widget Options - Extended Type Plugin Vulnerable versions = 5.1.0 Fixed in 5.1.3 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-35691 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 80da7493f574 Credits Dave Jong...

WordPress Sensei Pro (WC Paid Courses) Plugin <= 4.23.1.1.23.1 is vulnerable to Cross Site Scripting (XSS)

Software Sensei Pro WC Paid Courses Type Plugin Vulnerable versions = 4.23.1.1.23.1 Fixed in 4.24.0.1.24.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34765 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ffa624f39abc Credits Rafie...

WordPress YITH WooCommerce Product Add-Ons Plugin <= 4.9.2 is vulnerable to Content Injection

Software YITH WooCommerce Product Add-Ons Type Plugin Vulnerable versions = 4.9.2 Fixed in 4.9.3 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-35680 Patch priority Low CVSS severity Low 5.3 Developer YITH PSID b074b61667f8 Credits savphill Required privilege...

WordPress Login/Signup Popup Plugin <= 2.7.2 is vulnerable to Broken Access Control

Software Login/Signup Popup Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-5665 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID c7d62032dc99 Credits 1337Wannabe Required...

WordPress Rotating Tweets Plugin <= 1.9.10 is vulnerable to Cross Site Scripting (XSS)

Software Rotating Tweets Type Plugin Vulnerable versions = 1.9.10 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5141 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 44a4d93efa2c Credits Krzysztof Zając Required...