WordPress WS Theme Addons Plugin <= 2.0.0 is vulnerable to Backdoor

Software WS Theme Addons Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 484368cadc2b Credits Sansec.io Required privilege Unauthenticated Published 3 July, 2024...

WordPress ADDRESSYA Plugin <= 3.1.1 is vulnerable to Backdoor

Software ADDRESSYA Type Plugin Vulnerable versions = 3.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID fbc4dd8dabc1 Credits Sansec.io Required privilege Unauthenticated Published 3 July, 2024...

This Week in Spring - July 2nd, 2024

Hi, spring fans! Welcome to another amazing installment of This Week in Spring! In last week's installment of A Bootiful Podcast, recorded a few weeks ago at Spring IO, I talked with Spring Security legend Laur Spilca In last week's installment of Spring Tips, I looked at a number of ways you cou...

WordPress Simply Show Hooks Plugin <= 1.2.1 is vulnerable to Backdoor

Software Simply Show Hooks Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Backdoor CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 9717f5492dd4 Credits Sansec.io Required privilege Unauthenticated Published 3 July, 20...

WordPress Media Library Assistant Plugin <= 3.17 is vulnerable to Cross Site Scripting (XSS)

Software Media Library Assistant Type Plugin Vulnerable versions = 3.17 Fixed in 3.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5544 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1feab5b6d22c Credits Le Ngoc Anh...

WordPress Easy Google Maps Plugin <= 1.11.15 is vulnerable to Cross Site Scripting (XSS)

Software Easy Google Maps Type Plugin Vulnerable versions = 1.11.15 Fixed in 1.11.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5219 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d0d780464155 Credits wesley wcraft...

WordPress Boot Store Theme <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Boot Store Type Theme Vulnerable versions = 1.6.4 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5938 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 849a6c7d4031 Credits Francesco Carlucci Required...

WordPress Basil Theme <= 2.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Basil Type Theme Vulnerable versions = 2.0.4 Fixed in 2.0.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-39310 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 604f7a92c550 Credits Unknown Required privilege...

WordPress UsersWP Plugin <= 1.2.10 is vulnerable to SQL Injection

Software UsersWP Type Plugin Vulnerable versions = 1.2.10 Fixed in 1.2.11 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-6265 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 32b55caea5de Credits Trương Hữu Phúc truonghuuphuc Required privilege...

WordPress Woffice Core Plugin <= 5.4.8 is vulnerable to Broken Access Control

Software Woffice Core Type Plugin Vulnerable versions = 5.4.8 Fixed in 5.4.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37470 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID d7dfbe1583d4 Credits Rafie Muhammad Patchstack...

WordPress Newspack Ads Plugin <= 1.47.1 is vulnerable to Cross Site Scripting (XSS)

Software Newspack Ads Type Plugin Vulnerable versions = 1.47.1 Fixed in 1.47.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37474 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b8d60e34d1ee Credits Rafie Muhammad Patchstack Required...

WordPress CRM Perks Forms Plugin <= 1.1.5 is vulnerable to Broken Access Control

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37463 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 16266b67c664 Credits Manab Jyoti Dowarah Required...

WordPress ProfileGrid Plugin <= 5.8.7 is vulnerable to Broken Access Control

Software ProfileGrid Type Plugin Vulnerable versions = 5.8.7 Fixed in 5.8.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37453 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a60b5a00ba24 Credits Manab Jyoti Dowarah Required...

WordPress Hestia Theme <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Hestia Type Theme Vulnerable versions = 3.1.2 Fixed in 3.1.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37467 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 143c51756c08 Credits Dhabaleshwar Das Required...

WordPress Floating Social Buttons Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Floating Social Buttons Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-6405 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 99d69d9e8109 Credits Yoshihito Kamata...

WordPress Blocksy Theme <= 2.0.22 is vulnerable to Cross Site Request Forgery (CSRF)

Software Blocksy Type Theme Vulnerable versions = 2.0.22 Fixed in 2.0.23 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37469 Patch priority Low CVSS severity Low 5.4 Developer Creative Themes PSID a4b7cfca4dc7 Credits RE-ALTER Required privileg...

WordPress Ashe Theme <= 2.233 is vulnerable to Cross Site Request Forgery (CSRF)

Software Ashe Type Theme Vulnerable versions = 2.233 Fixed in 2.234 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37478 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 01c115634ea3 Credits Dhabaleshwar Das Required...

WordPress GPT3 AI Content Writer Plugin <= 1.8.66 is vulnerable to Cross Site Scripting (XSS)

Software GPT3 AI Content Writer Type Plugin Vulnerable versions = 1.8.66 Fixed in 1.8.67 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37465 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1398a1f33d9c Credits LVT-tholv2k Required privileg...

WordPress AWSM Team Plugin <= 1.3.1 is vulnerable to Local File Inclusion

Software AWSM Team Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-37454 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a8caf37850ed Credits João Pedro S Alcântara Kinorth...

WordPress Ultimate Bootstrap Elements for Elementor Plugin <= 1.4.2 is vulnerable to Local File Inclusion

Software Ultimate Bootstrap Elements for Elementor Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-37462 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID a8f9d8a5eba6 Credits João...