WordPress Backup Migration Plugin <= 1.3.9 is vulnerable to Path Traversal

Software Backup Migration Type Plugin Vulnerable versions = 1.3.9 Fixed in 1.4.0 OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2023-6972 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 63ca4651f92b Credits NP3228 Required privilege...

WordPress Thrive Automator Plugin <= 1.17 is vulnerable to Cross Site Request Forgery (CSRF)

Software Thrive Automator Type Plugin Vulnerable versions = 1.17 Fixed in 1.17.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51531 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2f7174a74dd1 Credits Brandon Roldan...

WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software Spam protection, AntiSpam, FireWall by CleanTalk Type Plugin Vulnerable versions = 6.20 Fixed in 6.21 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-51535 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.1.6 is vulnerable to Cross Site Scripting (XSS)

Software WOOCS – WooCommerce Currency Switcher Type Plugin Vulnerable versions = 1.4.1.6 Fixed in 1.4.1.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6556 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 45d1f7361e75...

WordPress Verge3D Plugin <= 4.5.2 is vulnerable to Remote Code Execution (RCE)

Software Verge3D Type Plugin Vulnerable versions = 4.5.2 Fixed in 4.5.3 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2023-51420 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID ab5d91bd1b2c Credits Rafie Muhammad Patchstack Required...

WordPress WP Frontend Profile Plugin <= 1.3.1 is vulnerable to Privilege Escalation

Software WP Frontend Profile Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51483 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 33e16067363a Credits Raf...

WordPress Fluent Support Plugin <= 1.7.6 is vulnerable to SQL Injection

Software Fluent Support Type Plugin Vulnerable versions = 1.7.6 Fixed in 1.7.7 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-51547 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 5aa5f4266c5e Credits Yudistira Arya Required privilege Administrator...

WordPress Rencontre – Dating Site Plugin <= 3.10.1 is vulnerable to Privilege Escalation

Software Rencontre – Dating Site Type Plugin Vulnerable versions = 3.10.1 Fixed in 3.11 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51425 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 603c87225836 Credits...

WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload

Software JVM rich text icons Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.6 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-51417 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID b7c089e25bbe Credits Rafie Muhammad Patchstack Required...

WordPress JVM rich text icons Plugin <= 1.2.6 is vulnerable to Arbitrary File Deletion

Software JVM rich text icons Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-51418 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID a73cfe9ec895 Credits Rafie Muhammad...

WordPress Frontend Admin by DynamiApps Plugin <= 3.18.3 is vulnerable to Arbitrary File Upload

Software Frontend Admin by DynamiApps Type Plugin Vulnerable versions = 3.18.3 Fixed in 3.18.4 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-51411 Patch priority High CVSS severity High 10 Developer Claim ownership PSID d641d57f3a44 Credits Rafie Muhammad Patchstack...

WordPress Essential Blocks for Gutenberg Plugin <= 4.2.0 is vulnerable to Broken Access Control

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51360 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID aa89b26b64fb Credits Rafie Muhamm...

WordPress LA-Studio Element Kit for Elementor Plugin <= 1.1.5 is vulnerable to Broken Access Control

Software LA-Studio Element Kit for Elementor Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50884 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 0dcf79343479 Credits thiennv...

WordPress Sticky Chat Widget Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)

Software Sticky Chat Widget Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.1.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51361 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0466bd6e4c4f Credits emad Required privilege Administrat...

WordPress Product Filter by WBW Plugin <= 2.5.0 is vulnerable to Broken Access Control

Software Product Filter by WBW Type Plugin Vulnerable versions = 2.5.0 Fixed in 2.5.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50877 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID b4377cfc0c43 Credits Abdi Pranata...

WordPress EmbedPress Plugin <= 3.8.3 is vulnerable to Broken Access Control

Software EmbedPress Type Plugin Vulnerable versions = 3.8.3 Fixed in 3.8.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51375 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID b1e657828f4d Credits Abdi Pranata Required...

WordPress New User Approve Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software New User Approve Type Plugin Vulnerable versions = 2.5.1 Fixed in 2.5.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-50902 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 064c7d29ebf0 Credits RE-ALTER Required...

WordPress ZeroBounce Email Verification & Validation Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)

Software ZeroBounce Email Verification & Validation Type Plugin Vulnerable versions = 1.0.11 Fixed in 1.0.12 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-51374 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID acd9ba4e664e Credits DoYeon Pa...

WordPress WC Marketplace Plugin <= 4.0.23 is vulnerable to Broken Access Control

Software WC Marketplace Type Plugin Vulnerable versions = 4.0.23 Fixed in 4.0.24 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51355 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 98133d2bdac6 Credits thiennv Required privilege...

WordPress Conversios.io Plugin <= 6.5.0 is vulnerable to Broken Access Control

Software Conversios.io Type Plugin Vulnerable versions = 6.5.0 Fixed in 6.5.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-51357 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 76d9ded19161 Credits Mika Required privilege...