WordPress Atarim Plugin <= 4.0 is vulnerable to Broken Access Control

Software Atarim Type Plugin Vulnerable versions = 4.0 Fixed in 4.0.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-38771 Patch priority Medium CVSS severity Medium 6.5 Developer Atarim PSID 7e5566c5bcde Credits piro Required privilege Unauthenticated...

WordPress FormLift for Infusionsoft Web Forms Plugin <= 7.5.17 is vulnerable to SQL Injection

Software FormLift for Infusionsoft Web Forms Type Plugin Vulnerable versions = 7.5.17 Fixed in 7.5.18 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-38773 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID d19e614d84b5 Credits Asif Wani Required...

WordPress GiveWP Plugin <= 3.13.0 is vulnerable to Insecure Direct Object References (IDOR)

Software GiveWP Type Plugin Vulnerable versions = 3.13.0 Fixed in 3.14.0 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-5977 Patch priority Low CVSS severity Low 5.4 Developer Liquid Web / StellarWP PSID 3e3c50f20b4c Credits Thanh Nam Tra...

WordPress FV Flowplayer Video Player Plugin <= 7.5.46.7212 is vulnerable to SQL Injection

Software FV Flowplayer Video Player Type Plugin Vulnerable versions = 7.5.46.7212 Fixed in 7.5.47.7212 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-6338 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 35cbf5adc214 Credits Arkadiusz Hydzik Required...

WordPress Bug Library Plugin < 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Bug Library Type Plugin Vulnerable versions 2.1.2 Fixed in 2.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5604 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 33f82588687d Credits Bob Matyas Required privilege...

WordPress CopySafe Web Protection Plugin <= 3.15 is vulnerable to Cross Site Scripting (XSS)

Software CopySafe Web Protection Type Plugin Vulnerable versions = 3.15 Fixed in 4.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38781 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d8ce0e7d373e Credits LVT-tholv2k Required...

WordPress CTX Feed Plugin <= 6.5.6 is vulnerable to Privilege Escalation

Software CTX Feed Type Plugin Vulnerable versions = 6.5.6 Fixed in 6.5.7 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-38775 Patch priority High CVSS severity High 7.2 Developer Claim ownership PSID cbdae09cf674 Credits stealthcopter Required privilege Sh...

Mozilla: Race condition in permission assignment

The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin...

Mozilla: Race condition in permission assignment

The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin...

Mozilla: Race condition in permission assignment

The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin...

Mozilla: Race condition in permission assignment

The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin...

Mozilla: Race condition in permission assignment

The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin...

WordPress Timeline Event History Plugin <= 3.1 is vulnerable to PHP Object Injection

Software Timeline Event History Type Plugin Vulnerable versions = 3.1 Fixed in 3.2 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-5726 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 38e5a517239e Credits Francesco Carlucci Required...

WordPress Elements kit Elementor addons Plugin <= 3.2.0 is vulnerable to Sensitive Data Exposure

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.2.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6455 Patch priority Low CVSS severity Low 5.3 Developer Wpmet PSID b000113e05e5 Credits stealthcopter Required...

WordPress Duplica Plugin <= 0.6 is vulnerable to Broken Access Control

Software Duplica Type Plugin Vulnerable versions = 0.6 Fixed in 0.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5997 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2d89afd960c6 Credits Lucio Sá Required privilege Subscriber...

WordPress WPForms User Registration Plugin <= 2.1.0 is vulnerable to Privilege Escalation

Software WPForms User Registration Type Plugin Vulnerable versions = 2.1.0 Fixed in 2.1.2 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-52209 Patch priority Low CVSS severity Low 8 Developer Claim ownership PSID 78ca3b70599d Credits...

WordPress Filter & Grids Plugin < 2.8.33 is vulnerable to Local File Inclusion

Software Filter & Grids Type Plugin Vulnerable versions 2.8.33 Fixed in 2.8.33 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-6164 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID fa64410035b5 Credits Project Black Required privilege...

Mozilla: Race condition in permission assignment

The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin...

Mozilla: Race condition in permission assignment

The Mozilla Foundation Security Advisory describes this flaw as: A race condition could lead to a cross-origin container obtaining permissions of the top-level origin...

WordPress Email Subscribers & Newsletters Plugin <= 5.7.26 is vulnerable to Broken Access Control

Software Email Subscribers & Newsletters Type Plugin Vulnerable versions = 5.7.26 Fixed in 5.7.27 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5703 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c1ed8caccfad Credits Arkadiusz...