WordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerability

SQL Injection vulnerability discovered by benzdeus in WordPress Plugin WPBulky versions = 1.1.13...

WordPress Support SVG Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Support SVG Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11091 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7d70333b5396 Credits Francesco Carlucci Required...

WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.6.8 is vulnerable to Broken Access Control

Software Cryptocurrency Widgets – Price Ticker & Coins List Type Plugin Vulnerable versions = 2.6.8 Fixed in 2.6.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-27953 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 036319de798f...

WordPress WP Ultimate CSV Importer Plugin <= 7.9.8 is vulnerable to Remote Code Execution (RCE)

Software WP Ultimate CSV Importer Type Plugin Vulnerable versions = 7.9.8 Fixed in 7.9.9 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-4142 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID a395389d1982 Credits István Márton Required...

Arbitrary Code Execution

wordpress is vulnerable to arbitrary code execution. The vulnerability exists in the wpattachedfile post meta entry when a user with author privilege passes a malicious image with exif metadata causing the Post Meta entry to change to an arbitrary substring such as a .jpg?file.php...