10079 matches found
PT-2024-16802 · WordPress · Mstore Api
Name of the Vulnerable Software and Affected Versions: MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress versions up to, and including, 4.15.7 Description: The issue is related to SQL Injection via the status type parameter due to insufficient escaping on the...
WordPress Bard Extra Plugin <= 1.2.7 is vulnerable to Broken Access Control
Software Bard Extra Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10532 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5aee743e07b2 Credits Lucio Sá Required privilege...
WordPress Grip Theme <= 1.0.9 is vulnerable to Arbitrary File Upload
Software Grip Type Theme Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52488 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID b55cacdb5723 Credits Mika Required privilege Subscriber Published 20...
WordPress MStore API plugin <= 4.15.7 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MStore API versions = 4.15.7...
WordPress Yaad Sarig Payment Gateway For WC plugin <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Log Read/Deletion vulnerability discovered by BrokenAC ignore in WordPress Plugin Yaad Sarig Payment Gateway For WC versions = 2.2.4...
CVE-2024-11194
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtclimportsettings' function in all versions up to, and including, 3.1.15.1. This...
CVE-2024-11194
CVE-2024-11194 affects the WordPress plugin Classified Listing – Classified ads & Business Directory Plugin (versions
CVE-2024-11194 Classified Listing – Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtclimportsettings' function in all versions up to, and including, 3.1.15.1. This...
CVE-2024-11194 Classified Listing – Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update
The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a misconfigured check on the 'rtclimportsettings' function in all versions up to, and including, 3.1.15.1. This...
WordPress Classified Listing plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update vulnerability
Authenticated Subscriber+ Limited Arbitrary Option Update vulnerability discovered by vgo0 in WordPress Plugin Classified Listing versions = 3.1.15.1...
WordPress Yaad Sarig Payment Gateway For WC Plugin <= 2.2.4 is vulnerable to Broken Access Control
Software Yaad Sarig Payment Gateway For WC Type Plugin Vulnerable versions = 2.2.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10665 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 3abf69feafbc Credits BrokenAC igno...
WordPress ProfileGrid Plugin <= 5.9.3.6 is vulnerable to Broken Access Control
Software ProfileGrid Type Plugin Vulnerable versions = 5.9.3.6 Fixed in 5.9.3.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10900 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e7fdd2a43e49 Credits 1337Wannabe Required...
CVE-2024-10390
The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences' function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber-level access and...
CVE-2024-10390 Elfsight Telegram Chat CC <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
The Elfsight Telegram Chat CC plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the 'updatePreferences' function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with subscriber-level access and...
WordPress Customer Reviews for WooCommerce plugin <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation vulnerability
Missing Authorization to Authenticated Subscriber+ Import Cancellation vulnerability discovered by incognito in WordPress Plugin Customer Reviews for WooCommerce versions = 5.61.0...
WordPress Elfsight Telegram Chat CC Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)
Software Elfsight Telegram Chat CC Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10390 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 79fba1da063a Credits István...
WordPress PostX Plugin <= 4.1.16 is vulnerable to Broken Access Control
Software PostX Type Plugin Vulnerable versions = 4.1.16 Fixed in 4.1.17 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10728 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 29722a758707 Credits Sean Murphy Required privilege...
PT-2024-16240 · Elfsight · Elfsight Telegram Chat Cc
Name of the Vulnerable Software and Affected Versions: Elfsight Telegram Chat CC plugin for WordPress versions up to, and including, 1.1.0 Description: The issue is related to a missing capability check on the updatePreferences function, allowing authenticated attackers with subscriber-level acce...
WordPress Banner System Plugin <= 1.0.0 is vulnerable to Privilege Escalation
Software Banner System Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-52437 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 9145175e73a6 Credits João Pedro S Alcântara Kinorth...
