WordPress CSV Product Import Export for WooCommerce Plugin <= 1.0.0 is vulnerable to SQL Injection

Software CSV Product Import Export for WooCommerce Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-49244 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 62295a347894 Credits Hakiduck Required...

WordPress WordPress Gallery Plugin – Limb Image Gallery Plugin <= 1.5.7 is vulnerable to Arbitrary File Download

Software WordPress Gallery Plugin – Limb Image Gallery Type Plugin Vulnerable versions = 1.5.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Download CVE CVE-2024-49258 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID f9ffdc125499 Credits...

WordPress ProfileGrid Plugin <= 5.9.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software ProfileGrid Type Plugin Vulnerable versions = 5.9.3 Fixed in 5.9.3.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49273 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8da39e4aabe3 Credits Trương Hữu Phúc...

WordPress Free Stock Photos Foter Plugin <= 1.5.4 is vulnerable to PHP Object Injection

Software Free Stock Photos Foter Type Plugin Vulnerable versions = 1.5.4 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-49227 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 0e6ee5afeccb Credits LVT-tholv2k Required privilege...

WordPress Htaccess File Editor Plugin <= 1.0.18 is vulnerable to Broken Access Control

Software Htaccess File Editor Type Plugin Vulnerable versions = 1.0.18 Fixed in 1.0.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-49256 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d6dd94150ebc Credits savphill Require...

WordPress Read more By Adam Plugin <= 1.1.8 is vulnerable to Broken Access Control

Software Read more By Adam Type Plugin Vulnerable versions = 1.1.8 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9187 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bad5d062abf4 Credits Francesco Carlucci Required...

CVE-2024-9756

The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing capability check on the wcoaaddattachment AJAX action in versions 2.0 to 2.4.1. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-9824

The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ipdeletepost' and 'ipupdateposttitle' functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers...

CVE-2024-9824 ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update

The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ipdeletepost' and 'ipupdateposttitle' functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers...

CVE-2024-9187 Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion

The Read more By Adam plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteRm function in all versions up to, and including, 1.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete read...

CVE-2024-9860

The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'importaction' and 'installpluginperdemo' functions in versions up to, and including, 3.3. This makes it possible for authenticated attackers with...

CVE-2024-9821

CVE-2024-9821 : The WordPress plugin “Bot for Telegram on WooCommerce” is vulnerable to sensitive information disclosure due to missing authorization checks on the stm_wpcfto_get_settings AJAX action, affecting all versions up to 1.2.4. Authenticated attackers with subscriber-level access and abo...

PT-2024-39866 · WordPress · The Bot For Telegram On Woocommerce

Name of the Vulnerable Software and Affected Versions: The Bot for Telegram on WooCommerce plugin for WordPress versions up to, and including, 1.2.4 Description: The issue is related to sensitive information disclosure due to missing authorization checks on the 'stm wpcfto get settings' AJAX...

PT-2024-39892 · WordPress · The Bridge Core

Name of the Vulnerable Software and Affected Versions: The Bridge Core plugin for WordPress versions up to, and including, 3.3 Description: The issue allows authenticated attackers with subscriber-level permissions or above to modify or lose data due to a missing capability check on the import...

PT-2024-39868 · WordPress · The Imagepress – Image Gallery

Name of the Vulnerable Software and Affected Versions: The ImagePress – Image Gallery plugin for WordPress versions prior to 1.2.3 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without authorization. This is due to a missing capability...

Exploit for CVE-2024-9821

CVE-2024-9821 Bot for Telegram on WooCommerce = 1.2.4 - Au...

Exploit for Path Traversal in Kau-Boys Hello_World

CVE-2024-9224 Hello World = 2.1.1 - Authenticated Subscri...

WordPress Bot for Telegram on WooCommerce Plugin <= 1.2.4 is vulnerable to Sensitive Data Exposure

Software Bot for Telegram on WooCommerce Type Plugin Vulnerable versions = 1.2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Sensitive Data Exposure CVE CVE-2024-9821 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 4a69a61df293 Credits István Márton Required...

WordPress Linkz.ai plugin <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Settings Update vulnerability discovered by István Márton in WordPress Plugin Linkz.ai versions = 1.1.8...

CVE-2024-9520

The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, ...