WordPress bunny.net Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

Software bunny.net Type Plugin Vulnerable versions = 2.0.1 Fixed in 2.0.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31361 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID eecba96cff40 Credits Joshua Chan Required privilege Administrator...

WordPress User Activity Log Plugin <= 1.9 is vulnerable to SQL Injection

Software User Activity Log Type Plugin Vulnerable versions = 1.9 Fixed in 2.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-31356 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 35f222cae91f Credits Muhammad Daffa Required privilege Administrator...

WordPress WordPress Gallery Exporter Plugin <= 1.3 is vulnerable to Arbitrary File Download

Software WordPress Gallery Exporter Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-31342 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6307ae9c3c1f Credits Abdi Prawira Negara...

WordPress ReDi Restaurant Reservation Plugin <= 24.0128 is vulnerable to Cross Site Request Forgery (CSRF)

Software ReDi Restaurant Reservation Type Plugin Vulnerable versions = 24.0128 Fixed in 24.0303 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31299 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID b61734a1714a Credits Maj...

WordPress WP Photo Album Plus Plugin < 8.6.03.005 is vulnerable to Arbitrary File Upload

Software WP Photo Album Plus Type Plugin Vulnerable versions 8.6.03.005 Fixed in 8.6.03.005 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-31286 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID b5fb22d21826 Credits stealthcopter Required...

WordPress s2Member Pro Plugin <= 240315 is vulnerable to Privilege Escalation

Software s2Member Pro Type Plugin Vulnerable versions = 240315 Fixed in 240325 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-31237 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID db2e8d0fde5a Credits Ngô Thiê...

WordPress Generate Child Theme Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Generate Child Theme Type Plugin Vulnerable versions = 2.0 Fixed in 2.0.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31279 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 3373514288c6 Credits Abdi Pranata...

WordPress WP Poll Maker Plugin <= 3.1 is vulnerable to Arbitrary File Deletion

Software WP Poll Maker Type Plugin Vulnerable versions = 3.1 Fixed in 3.4 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-31240 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 371f80c25178 Credits Yudistira Arya Required privile...

WordPress MailMunch – Grow your Email List Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)

Software MailMunch – Grow your Email List Type Plugin Vulnerable versions = 3.1.6 Fixed in 3.1.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31349 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7297ea028cbf Credits Ray Wilson Required...

WordPress ARForms Form Builder Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software ARForms Form Builder Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31272 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 5543120d9779 Credits Yudistira Arya...

WordPress Wholesale For WooCommerce Plugin <= 2.3.0 is vulnerable to Arbitrary Content Deletion

Software Wholesale For WooCommerce Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary Content Deletion CVE CVE-2024-31297 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID f0f4371cb999 Credits Dave Jong...

WordPress ARForms Form Builder Plugin <= 1.6.1 is vulnerable to Broken Access Control

Software ARForms Form Builder Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31270 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 4ca59fc15641 Credits Yudistira Arya Require...

WordPress Media Library Folders Plugin <= 8.1.8 is vulnerable to Directory Traversal

Software Media Library Folders Type Plugin Vulnerable versions = 8.1.8 Fixed in 8.1.9 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-31287 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ba4e95251ee0 Credits Majed Refaea Required privilege Autho...

WordPress Email Subscribers & Newsletters Plugin <= 5.7.13 is vulnerable to Broken Access Control

Software Email Subscribers & Newsletters Type Plugin Vulnerable versions = 5.7.13 Fixed in 5.7.14 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31352 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 1e92fe5167c9 Credits Mika Requir...

WordPress AppPresser Plugin <= 4.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software AppPresser Type Plugin Vulnerable versions = 4.3.0 Fixed in 4.3.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31268 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 95ab9f93ef0b Credits Dhabaleshwar Das Require...

WordPress EmbedPress Plugin <= 3.9.8 is vulnerable to Broken Access Control

Software EmbedPress Type Plugin Vulnerable versions = 3.9.8 Fixed in 3.9.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31284 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0f53658201e5 Credits Majed Refaea Required...

WordPress MasterStudy LMS Plugin <= 3.3.3 is vulnerable to Local File Inclusion

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.3 Fixed in 3.3.4 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3136 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 0e613f9f337e Credits Hiroho Shimada Required privilege...

WordPress Easy Digital Downloads Plugin <= 3.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.6 Fixed in 3.2.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31293 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 89807a8f40a1 Credits Dhabaleshwar...

WordPress MPG Plugin <= 3.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software MPG Type Plugin Vulnerable versions = 3.4.0 Fixed in 3.4.1 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-31301 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 018dc38017d4 Credits Majed Refaea Required privilege...

WordPress WC Marketplace Plugin <= 4.1.3 is vulnerable to Broken Access Control

Software WC Marketplace Type Plugin Vulnerable versions = 4.1.3 Fixed in 4.1.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31304 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 245d71ae2d23 Credits LVT-tholv2k Required...