WordPress wpForo Forum Plugin <= 2.2.3 is vulnerable to Privilege Escalation

Software wpForo Forum Type Plugin Vulnerable versions = 2.2.3 Fixed in 2.2.4 OWASP Top 10 A4: Insecure Design Classification Privilege Escalation CVE CVE-2023-47868 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 18839e0584f6 Credits Jesse McNeil Required privilege...

WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Grab & Save Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-47845 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 10b2ddc4a429 Credits Dimas Maulana Required...

WordPress Contact Form to Any API Plugin <= 1.1.6 is vulnerable to Broken Access Control

Software Contact Form to Any API Type Plugin Vulnerable versions = 1.1.6 Fixed in 1.1.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47871 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 81c0f0123458 Credits Arvandy Require...

WordPress WP Child Theme Generator Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload

Software WP Child Theme Generator Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Upload CVE CVE-2023-47873 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID e915ca3d162f Credits Dateoljo of BoB 12th...

WordPress Audio Merchant Plugin <= 5.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Audio Merchant Type Plugin Vulnerable versions = 5.0.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6197 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID b9deef5e9191 Credits Ala Arfaoui Required...

WordPress wpForo Forum Plugin <= 2.2.5 is vulnerable to Content Injection

Software wpForo Forum Type Plugin Vulnerable versions = 2.2.5 Fixed in 2.2.6 OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2023-47869 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e9607ec97842 Credits Jesse McNeil Required privilege...

WordPress BlossomThemes Email Newsletter Plugin <= 2.2.4 is vulnerable to Broken Access Control

Software BlossomThemes Email Newsletter Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47849 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 051053384c38 Credits Abdi...

WordPress CataBlog Plugin <= 1.7.0 is vulnerable to Arbitrary File Upload

Software CataBlog Type Plugin Vulnerable versions = 1.7.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-47842 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID ca3ef4e541ae Credits Rafie Muhammad Patchstack Required privilege...

WordPress SearchIQ Plugin <= 4.4 is vulnerable to Broken Access Control

Software SearchIQ Type Plugin Vulnerable versions = 4.4 Fixed in 4.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47832 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID ebe24eb2b5d2 Credits Mika Required privilege...

WordPress Restaurant & Cafe Addon for Elementor Plugin <= 1.5.3 is vulnerable to Broken Access Control

Software Restaurant & Cafe Addon for Elementor Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47826 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b97882725329 Credits...

WordPress Quiz And Survey Master Plugin <= 8.1.13 is vulnerable to Cross Site Scripting (XSS)

Software Quiz And Survey Master Type Plugin Vulnerable versions = 8.1.13 Fixed in 8.1.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47834 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f34de2f1d2a5 Credits emad Required privilege...

WordPress ARI Stream Quiz Plugin <= 1.2.32 is vulnerable to Cross Site Scripting (XSS)

Software ARI Stream Quiz Type Plugin Vulnerable versions = 1.2.32 Fixed in 1.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47835 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 60fc20d13481 Credits emad Required privilege Contributor...

WordPress WP EXtra Plugin <= 6.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP EXtra Type Plugin Vulnerable versions = 6.4 Fixed in 6.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-47825 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 19cbe9873db2 Credits Huynh Tien Si Required privile...

WordPress Events Addon for Elementor Plugin <= 2.1.3 is vulnerable to Broken Access Control

Software Events Addon for Elementor Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47827 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 5dbac8531308 Credits Abdi Pranata...

WordPress WPCafe Plugin <= 2.2.22 is vulnerable to Broken Access Control

Software WPCafe Type Plugin Vulnerable versions = 2.2.22 Fixed in 2.2.23 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47805 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID b94e1d5fde71 Credits Abdi Pranata Required privileg...

WordPress Phlox Shop Plugin <= 2.0.0 is vulnerable to Local File Inclusion

Software Phlox Shop Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2023-39163 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 2e21185d83c1 Credits Rafie Muhammad Patchstack Required privilege...

WordPress Welcart e-Commerce Plugin < 2.9.6 is vulnerable to PHP Object Injection

Software Welcart e-Commerce Type Plugin Vulnerable versions 2.9.6 Fixed in 2.9.6 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE N/A Patch priority Medium CVSS severity Medium 4.4 Developer Claim ownership PSID dd10708cfd4f Credits WordFence Required privilege Published 15...

WordPress Acme Fix Images Plugin <= 1.0.0 is vulnerable to Broken Access Control

Software Acme Fix Images Type Plugin Vulnerable versions = 1.0.0 Fixed in 2.0.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47793 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 51b5ada66dce Credits Abdi Pranata Required...

WordPress Phlox Portfolio Plugin <= 2.3.1 is vulnerable to Local File Inclusion

Software Phlox Portfolio Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2023-38399 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 2298d332cdc8 Credits Rafie Muhammad Patchstack Required...

WordPress Forminator Plugin <= 1.27.0 is vulnerable to Arbitrary File Upload

Software Forminator Type Plugin Vulnerable versions = 1.27.0 Fixed in 1.28.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6133 Patch priority Low CVSS severity Low 6.6 Developer WPMU DEV PSID e543496c8db2 Credits István Márton Required privilege Administrator...