WordPress Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads Plugin <= 2.0.84 is vulnerable to Broken Access Control

Software Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads Type Plugin Vulnerable versions = 2.0.84 Fixed in 2.0.85 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47317 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3ea101b7f4e3...

WordPress Sunshine Photo Cart Plugin <= 3.2.8 is vulnerable to Broken Access Control

Software Sunshine Photo Cart Type Plugin Vulnerable versions = 3.2.8 Fixed in 3.2.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47314 Patch priority Medium CVSS severity Medium 7.1 Developer WP Sunshine PSID ce1d02e75c65 Credits Trương Hữu Phúc...

WordPress Fluent Support Plugin <= 1.8.0 is vulnerable to SQL Injection

Software Fluent Support Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-47304 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 80896110802b Credits Khalid Yusuf Required privilege Subscriber...

WordPress WCFM – Frontend Manager for WooCommerce Plugin <= 6.7.12 is vulnerable to Privilege Escalation

Software WCFM – Frontend Manager for WooCommerce Type Plugin Vulnerable versions = 6.7.12 Fixed in 6.7.13 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8290 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID...

WordPress Salon booking system Plugin <= 10.9 is vulnerable to Insecure Direct Object References (IDOR)

Software Salon booking system Type Plugin Vulnerable versions = 10.9 Fixed in 10.9.1 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-47316 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ecb95cdb72ad Credits...

WordPress ThemeHunk plugin <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updates vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin ThemeHunk versions = 1.0.9...

CVE-2024-8436 WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection

The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'editimageId' and 'editimageDelete' parameters in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2024-8436 WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection

The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'editimageId' and 'editimageDelete' parameters in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2024-8437

The CVE-2024-8437 entry concerns WP Easy Gallery – WordPress Gallery Plugin (vulnerable 4.8.5).

CVE-2024-8432

The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveappearance function in all versions up to, and including, 5.0.48. This makes it possible for authenticated attackers...

CVE-2024-8432

CVE-2024-8432 applies to the Appointment & Event Booking Calendar Plugin – Webba Booking for WordPress. Vulnerability: missing capability check in save_appearance() allows authenticated users with Subscriber level access and above to modify the booking form CSS, affecting all versions up to 5.0.4...

WordPress WP Easy Gallery plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation vulnerability

Missing Authorization to Authenticated Subscriber+ Gallery Manipulation vulnerability discovered by Lucio Sá in WordPress Plugin WP Easy Gallery versions = 4.8.5...

WordPress WP Easy Gallery Plugin <= 4.8.5 is vulnerable to Broken Access Control

Software WP Easy Gallery Type Plugin Vulnerable versions = 4.8.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8437 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 29e098328a72 Credits Lucio Sá Required privilege...

PT-2024-39013 · WordPress · Wp Easy Gallery

Name of the Vulnerable Software and Affected Versions: The WP Easy Gallery – WordPress Gallery Plugin versions up to, and including, 4.8.5 Description: The issue is related to unauthorized access due to a missing capability check on several functions hooked via AJAX, such as wpeg settings and wpe...

PT-2024-38381 · WordPress · Husky – Products Filter Professional

Name of the Vulnerable Software and Affected Versions: HUSKY – Products Filter Professional for WooCommerce plugin for WordPress versions up to, and including, 1.3.6.1 Description: The issue is related to Insecure Direct Object Reference. It affects the plugin via the woof messenger remove subscr...

PT-2024-37742 · WordPress · Spreadsheet Integration Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: The Spreadsheet Integration plugin for WordPress versions up to, and including, 3.7.9 Description: The issue is related to a missing capability check on several functions, allowing authenticated attackers with Subscriber-level access and abov...

PT-2024-39011 · Themehunk · Easy Mega Menu Plugin

Name of the Vulnerable Software and Affected Versions: Easy Mega Menu Plugin for WordPress – ThemeHunk plugin versions up to, and including, 1.0.9 Description: The issue arises from a missing capability check on several functions hooked via AJAX, allowing authenticated attackers with...

PT-2024-39009 · WordPress · Webba Booking

Name of the Vulnerable Software and Affected Versions: The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress versions up to, and including, 5.0.48 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify the booking form...

WordPress Houzez Theme <= 3.2.4 is vulnerable to Privilege Escalation

Software Houzez Type Theme Vulnerable versions = 3.2.4 Fixed in 3.3.0 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2024-22303 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 51553a618b56 Credits luc Required privilege Subscriber...

WordPress Houzez Login Register Plugin <= 3.2.5 is vulnerable to Privilege Escalation

Software Houzez Login Register Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.3.0 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2024-21743 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 864db44c0749 Credits luc Required...