WordPress WP-Recall Plugin <= 16.26.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP-Recall Type Plugin Vulnerable versions = 16.26.6 Fixed in 16.26.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-35657 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 307054abe3f6 Credits Steven Julian Require...

WordPress Popup Builder Plugin <= 4.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Popup Builder Type Plugin Vulnerable versions = 4.2.7 Fixed in 4.3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2506 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5081e1f78a97 Credits Tim Coen Required privileg...

CVE-2024-4087

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widget in all versions up to, and including, 1.3.975 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

PT-2024-29122 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.3.975 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's Back to To...

Data Leak Exposes Business Leaders and Top Celebrity Data

A data leak incident involving Clarity.fm left the personal data of business leaders and celebrities exposed to public…...

WordPress WPCafe Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)

Software WPCafe Type Plugin Vulnerable versions = 2.2.24 Fixed in 2.2.26 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5427 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8e560e47961d Credits Krzysztof Zając Required...

WordPress Flash & HTML5 Video Plugin < 2.5.27 is vulnerable to SQL Injection

Software Flash & HTML5 Video Type Plugin Vulnerable versions 2.5.27 Fixed in 2.5.27 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-5522 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID a6949d7fc215 Credits Mayank Deshmukh Required privilege...

WordPress Ninja Tables Plugin <= 5.0.9 is vulnerable to Server Side Request Forgery (SSRF)

Software Ninja Tables Type Plugin Vulnerable versions = 5.0.9 Fixed in 5.0.10 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-35635 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 2b5ac1cd1dee Credits Yuchen J...

WordPress WP Back Button Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Back Button Type Plugin Vulnerable versions = 1.1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35643 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 90452d019b78 Credits alfido osdie Patchstack Alliance Required...

WordPress Preferred Languages Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Preferred Languages Type Plugin Vulnerable versions = 2.2.2 Fixed in 2.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35644 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 719b6e177f68 Credits Jayden Caelli ret2desync Required...

WordPress Simple Spoiler Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Simple Spoiler Type Plugin Vulnerable versions = 1.2 Fixed in 1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35639 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c046b9bc81be Credits Cronus Required privilege Administrator...

WordPress StopBadBots Plugin <= 10.23 is vulnerable to Broken Access Control

Software StopBadBots Type Plugin Vulnerable versions = 10.23 Fixed in 10.24 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4355 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c1d3c12009e3 Credits Krzysztof Zając Required privilege...

WordPress Global Notification Bar Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Global Notification Bar Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35647 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2334f56ac49f Credits Rayhan Ramdhany Hanaputra Requir...

WordPress Yumpu ePaper publishing Plugin <= 2.0.24 is vulnerable to Broken Access Control

Software Yumpu ePaper publishing Type Plugin Vulnerable versions = 2.0.24 Fixed in 3.0.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3277 Patch priority Low CVSS severity Low 5 Developer Claim ownership PSID 08c9f70d34e3 Credits Lucio Sá Required...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.89 is vulnerable to Remote Code Execution (RCE)

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.89 Fixed in 1.5.91 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-6743 Patch priority High CVSS severity High 9.9 Developer Unlimited Elements PSID...

WordPress Fetch JFT Plugin <= 1.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Fetch JFT Type Plugin Vulnerable versions = 1.8.3 Fixed in 1.8.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4419 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 70f08e1c695e Credits Benedictus Jovan aillesiM...

WordPress Site Reviews Plugin < 7.0.0 is vulnerable to Bypass Vulnerability

Software Site Reviews Type Plugin Vulnerable versions 7.0.0 Fixed in 7.0.0 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-3050 Patch priority Low CVSS severity Low 5.3 Developer Gemini Labs PSID f2c354c46a11 Credits Sławomir Zakrzewski Maksymilian Kubiak AFINE...

WordPress Swiss Toolkit For WP Plugin <= 1.0.7 is vulnerable to Broken Authentication

Software Swiss Toolkit For WP Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2024-5204 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 07e08699642a Credits István Márton...

WordPress Login with phone number Plugin <= 1.7.26 is vulnerable to Privilege Escalation

Software Login with phone number Type Plugin Vulnerable versions = 1.7.26 Fixed in 1.7.27 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-5150 Patch priority High CVSS severity High 9.8 Developer Hamid Alinia PSID a2294e0242d6 Credits István Márton Required...

WordPress Integration for Contact Form 7 and Constant Contact Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Integration for Contact Form 7 and Constant Contact Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-35632 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...