WordPress Formidable Forms Plugin < 6.3.1 is vulnerable to Remote Code Execution (RCE)

Software Formidable Forms Type Plugin Vulnerable versions 6.3.1 Fixed in 6.3.1 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-2877 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 64ee0a3444e8 Credits Alex Sanford Required privilege...

WordPress Catalyst Connect Zoho CRM Client Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Catalyst Connect Zoho CRM Client Portal Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-44629 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 3f8d40ca02b2 Credits...

WordPress Login/Signup Popup Plugin <= 2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Login/Signup Popup Type Plugin Vulnerable versions = 2.3 Fixed in 2.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3a37547594eb Credits N/A Required privilege...

WordPress Gravity Forms Plugin < 2.7.5 is vulnerable to Cross Site Scripting (XSS)

Software Gravity Forms Type Plugin Vulnerable versions 2.7.5 Fixed in 2.7.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2701 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 17cbc85493b8 Credits Fioravante Souza WPScan...

WordPress Restrict Content Plugin < 3.2.3 is vulnerable to Broken Access Control

Software Restrict Content Type Plugin Vulnerable versions 3.2.3 Fixed in 3.2.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 64157ce6271e Credits Unknown Required privilege Subscrib...

WordPress Restrict Content Plugin < 3.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Restrict Content Type Plugin Vulnerable versions 3.2.3 Fixed in 3.2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 140b3a291ad3 Credits Unknown Required privilege...

WordPress InventoryPress Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)

Software InventoryPress Type Plugin Vulnerable versions = 1.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2579 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 980d01840734 Credits daniloalbuqrque Require...

WordPress WP Mail Logging Plugin < 1.12.0 is vulnerable to Broken Access Control

Software WP Mail Logging Type Plugin Vulnerable versions 1.12.0 Fixed in 1.12.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID edb33842ede2 Credits Unknown Required privilege...

WordPress ProfilePress Plugin < 4.11.0 is vulnerable to Cross Site Scripting (XSS)

Software ProfilePress Type Plugin Vulnerable versions 4.11.0 Fixed in 4.11.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 2c2a55a770a4 Credits Unknown Required privilege...

WordPress Atarim Plugin <= 3.9.1 is vulnerable to Broken Access Control

Software Atarim Type Plugin Vulnerable versions = 3.9.1 Fixed in 3.9.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority High CVSS severity High 8.2 Developer Atarim PSID 7b9f3a87aa7b Credits N/A Required privilege Unauthenticated Published 23 June...

WordPress Balkon Theme <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Software Balkon Type Theme Vulnerable versions = 1.3.2 Fixed in 1.3.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36502 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 90ca41d6439b Credits RE-ALTER Required privilege...

WordPress PostX Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS)

Software PostX Type Plugin Vulnerable versions = 2.9.9 Fixed in 2.9.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36385 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 34333ee198ac Credits Le Ngoc Anh Required...

WordPress OOPSpam Anti-Spam Plugin <= 1.1.44 is vulnerable to Cross Site Request Forgery (CSRF)

Software OOPSpam Anti-Spam Type Plugin Vulnerable versions = 1.1.44 Fixed in 1.1.45 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-35913 Patch priority Low CVSS severity Low 4.3 Developer OOPSpam LLC PSID 2dfc3bd6e459 Credits Skalucy Required...

CVE-2023-36191

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

WordPress MaxButtons Plugin <= 9.5.3 is vulnerable to Cross Site Scripting (XSS)

Software MaxButtons Type Plugin Vulnerable versions = 9.5.3 Fixed in 9.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36503 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 24d386e76da8 Credits Rafshanzani Suhada Required...

WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)

Software Booking Calendar Contact Form Type Plugin Vulnerable versions = 1.2.40 Fixed in 1.2.41 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36384 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5ffa418dea78 Credits B...

WordPress Tutor LMS Plugin < 2.2.1 is vulnerable to Broken Access Control

Software Tutor LMS Type Plugin Vulnerable versions 2.2.1 Fixed in 2.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-3133 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 46e68bdc901b Credits A. S. M. Muhiminul Hasan Required...

WordPress CF7 Google Sheets Connector Pro Plugin <= 2.3.5 is vulnerable to Cross Site Scripting (XSS)

Software CF7 Google Sheets Connector Pro Type Plugin Vulnerable versions = 2.3.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2320 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 2600f79af18c Credits Erwan LR...

WordPress ReDi Restaurant Reservation Plugin <= 23.0211 is vulnerable to Broken Access Control

Software ReDi Restaurant Reservation Type Plugin Vulnerable versions = 23.0211 Fixed in 23.0212 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36510 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 27489b229824 Credits Abdi Pranat...

WordPress Elementor Forms Google Sheet Connector Plugin < 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Forms Google Sheet Connector Type Plugin Vulnerable versions 1.0.7 Fixed in 1.0.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2324 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 9c0650ee0f4a Credits...