WordPress Smartsupp - live chat, AI shopping assistant and chatbots plugin <= 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

WordPress Smartsupp - live chat, AI shopping assistant and chatbots plugin = 3.9.1 - Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Smartsupp – live chat, chatbots, AI and lead generation versions = 3.9.1...

WordPress ACF Photo Gallery Field plugin <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Attachment Metadata Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Attachment Metadata Modification vulnerability discovered by Rafshanzani Suhada in WordPress Plugin ACF Photo Gallery Field versions = 3.0...

WordPress XCloner plugin <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save() vulnerability

Cross-Site Request Forgery in XclonerRemoteStorage:save vulnerability discovered by Rafshanzani Suhada in WordPress Plugin XCloner versions = 4.8.2...

WordPress UiPress lite plugin <= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Settings Update vulnerability discovered by Rafshanzani Suhada in WordPress Plugin UiPress lite versions = 3.5.08...

WordPress Quiz Maker plugin <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Quiz Maker versions = 6.7.0.80...

WordPress Tutor LMS plugin <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update vulnerability

Missing Authorization to Unauthenticated Payment Status Update vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Tutor LMS versions = 3.8.3...

WordPress Zotpress plugin <= 7.3.12 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Zotpress versions = 7.3.12...

WordPress MPG Plugin <= 4.0.1 is vulnerable to Broken Access Control

Software MPG Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7424 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 61dc998feee8 Credits Rafshanzani Suhada Required privilege...

WordPress Sirv plugin <= 7.2.7 - Authenticated (Subscriber+) Missing Authorization to Plugin Settings Update vulnerability

Authenticated Subscriber+ Missing Authorization to Plugin Settings Update vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Sirv versions = 7.2.7...

WordPress oik plugin <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via bwbutton Shortcode vulnerability discovered by Rafshanzani Suhada in WordPress Plugin oik versions = 4.10.3...

WordPress Strong Testimonials plugin <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification vulnerability

AuthenticatedContributor+ Improper Authorization to Views Modification vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Strong Testimonials versions = 3.1.12...

WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection

Software Directorist Type Plugin Vulnerable versions = 7.7.1 Fixed in 7.7.2 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-41798 Patch priority Low CVSS severity Low 5.1 Developer Claim ownership PSID 305b807eea54 Credits Rafshanzani Suhada Required privilege Editor Publishe...

WordPress Slimstat Analytics Plugin <= 5.0.5.1 is vulnerable to Broken Access Control

Software Slimstat Analytics Type Plugin Vulnerable versions = 5.0.5.1 Fixed in 5.0.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33994 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d67efaa57590 Credits Rafshanzani Suhada...

WordPress Email download link Plugin <= 3.7 is vulnerable to Sensitive Data Exposure

Software Email download link Type Plugin Vulnerable versions = 3.7 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-36523 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 65b3857a62b9 Credits Rafshanzani Suhada Requir...

WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-35093 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID fe9a14774ad1 Credits Rafshanzani Suhada...

WordPress Robo Gallery Plugin <= 3.2.12 is vulnerable to Cross Site Scripting (XSS)

Software Robo Gallery Type Plugin Vulnerable versions = 3.2.12 Fixed in 3.2.13 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27620 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0d689194a771 Credits Rafshanzani Suhada...

WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection

Software GiveWP Type Plugin Vulnerable versions = 2.25.1 Fixed in 2.25.2 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-22719 Patch priority Low CVSS severity Low 4.7 Developer Liquid Web / StellarWP PSID 7ead0bb10ca7 Credits Rafshanzani Suhada Required privilege...

WordPress Fluent Support plugin <= 1.5.7 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Rafshanzani Suhada in WordPress Fluent Support plugin versions = 1.5.7. Solution Update the WordPress Fluent Support plugin to the latest available version at least 1.5.8...

WordPress YaySMTP plugin <= 2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Rafshanzani Suhada in WordPress YaySMTP plugin versions = 2.2. Solution Update the WordPress YaySMTP plugin to the latest available version at least 2.2.1...

WordPress YaySMTP plugin <= 2.2 - Authenticated SMTP Credentials Leak vulnerability

Authenticated SMTP Credentials Leak vulnerability discovered by Rafshanzani Suhada in WordPress YaySMTP plugin versions = 2.2. Solution Update the WordPress YaySMTP plugin to the latest available version at least 2.2.1...