WordPress Post Meta Data Manager Plugin <= 1.2.0 is vulnerable to Broken Access Control

Software Post Meta Data Manager Type Plugin Vulnerable versions = 1.2.0 Fixed in 1.2.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5425 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 1def5cff52bd Credits Francesco Carlucci...

WordPress WP EXtra Plugin <= 6.2 is vulnerable to Broken Access Control

Software WP EXtra Type Plugin Vulnerable versions = 6.2 Fixed in 6.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5314 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 55747fccb396 Credits TP Cyber Security Required privilege...

WordPress YOP Poll Plugin <= 6.5.28 is vulnerable to Broken Authentication

Software YOP Poll Type Plugin Vulnerable versions = 6.5.28 Fixed in 6.5.29 OWASP Top 10 A5: Security Misconfiguration Classification Broken Authentication CVE CVE-2023-46611 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f8c5b7c225ab Credits qilin99 Required privilege...

WordPress Quill Forms Plugin <= 3.3.0 is vulnerable to Broken Access Control

Software Quill Forms Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.4.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46610 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID f234d1eb3578 Credits Abdi Pranata Required privilege...

WordPress Mediabay Plugin <= 1.6 is vulnerable to Broken Access Control

Software Mediabay Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46612 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 01f288807115 Credits emad Required privilege Subscriber...

WordPress Tab Ultimate Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

Software Tab Ultimate Type Plugin Vulnerable versions = 1.3 Fixed in 1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5667 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 6b4d31988178 Credits István Márton Required privileg...

WordPress iPanorama 360 WordPress Virtual Tour Builder Plugin <= 1.8.0 is vulnerable to SQL Injection

Software iPanorama 360 WordPress Virtual Tour Builder Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5336 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 25ea3eb9ee79 Credits István Márton Require...

WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS)

Software Motors – Car Dealer & Classified Ads Type Plugin Vulnerable versions = 1.4.6 Fixed in 1.4.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46208 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID dac70b12e2be Credits...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Privilege Escalation

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE CVE-2023-46145 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 23dc050c5700 Credits Rafie Muhammad Patchstack...

WordPress Ajax Archive Calendar Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Archive Calendar Type Plugin Vulnerable versions = 2.6.7 Fixed in 2.6.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-46069 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2c6a1e009987 Credits Ngô Thiên An ancorn from...

WordPress is vulnerable to Broken Access Control

Software WordPress Type WordPress Core Vulnerable versions 6.3.2 Fixed in 6.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-39999 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 145475520c6c Credits Rafie Muhammad Patchstack...

WordPress Thumbnail Slider With Lightbox Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Thumbnail Slider With Lightbox Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-5531 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fe76aeae2c6a Credits Ala...

WordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Open Redirection

Software Responsive Column Widgets Type Plugin Vulnerable versions = 1.2.7 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Open Redirection CVE CVE-2023-45762 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 59d95f8609d5 Credits Phd Required privilege...

WordPress HTML5 Maps Plugin <= 1.7.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software HTML5 Maps Type Plugin Vulnerable versions = 1.7.1.4 Fixed in 1.7.1.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45650 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 414faf6d1725 Credits Mika Required...

WordPress Simple URLs Plugin <= 120 is vulnerable to Cross Site Request Forgery (CSRF)

Software Simple URLs Type Plugin Vulnerable versions = 120 Fixed in 121 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45606 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d8dcb8acc03a Credits Mika Required privilege...

WordPress Post View Count Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Post View Count Type Plugin Vulnerable versions = 2.0 Fixed in 2.0.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-44996 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9ca3df3cf077 Credits Rio Darmawan Required...

WordPress Publish Confirm Message Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Publish Confirm Message Type Plugin Vulnerable versions = 1.3.1 Fixed in 2.0 OWASP Top 10 A2: Broken Authentication Classification Cross Site Request Forgery CSRF CVE CVE-2023-32124 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8e7992d754f6 Credits Taihei...

WordPress Modern Events Calendar Lite Plugin < 7.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Modern Events Calendar Lite Type Plugin Vulnerable versions 7.1.0 Fixed in 7.1.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4021 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c25775cbcad2 Credits Marco Wotschka...

WordPress ActivityPub Plugin < 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software ActivityPub Type Plugin Vulnerable versions 1.0.1 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3746 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4e185588c9f2 Credits Ben Bidner Required privilege...

WordPress Raise Mag Theme <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software Raise Mag Type Theme Vulnerable versions = 1.0.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28621 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ef6477e9116b Credits László Radnai Required...