WordPress Customer Reviews for WooCommerce Plugin <= 5.38.12 is vulnerable to Broken Access Control

Software Customer Reviews for WooCommerce Type Plugin Vulnerable versions = 5.38.12 Fixed in 5.39.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-1044 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7bfc65d6b633 Credits Francesco...

WordPress Elementor Addon Elements Plugin <= 1.12.11 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.12.11 Fixed in 1.12.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0834 Patch priority Low CVSS severity Low 6.5 Developer WPVibes PSID 65cab16f462f Credits Webbernaut Required...

WordPress AI Engine: ChatGPT Chatbot Plugin <= 2.1.4 is vulnerable to Arbitrary File Upload

Software AI Engine: ChatGPT Chatbot Type Plugin Vulnerable versions = 2.1.4 Fixed in 2.1.5 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-0699 Patch priority Medium CVSS severity Medium 6.6 Developer Claim ownership PSID a07cf1730f82 Credits rootxsudip Required...

WordPress Elementor Website Builder Plugin <= 3.19.0 is vulnerable to Arbitrary File Deletion

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.19.0 Fixed in 3.19.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-24934 Patch priority Low CVSS severity Low 8.5 Developer Elementor PSID 8c8af1fc63cc Credits Rhynorater Justin...

WordPress Advanced Database Cleaner Plugin <= 3.1.3 is vulnerable to PHP Object Injection

Software Advanced Database Cleaner Type Plugin Vulnerable versions = 3.1.3 Fixed in 3.1.4 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-0668 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID ae822ac39b98 Credits Richard Telleng stueotue Required...

WordPress WP Club Manager Plugin <= 2.2.10 is vulnerable to Broken Access Control

Software WP Club Manager Type Plugin Vulnerable versions = 2.2.10 Fixed in 2.2.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1177 Patch priority Low CVSS severity Low 5.3 Developer WP Club Manager PSID 6e13e5e19043 Credits Francesco Carlucci Required...

WordPress Blocksy Theme <= 2.0.19 is vulnerable to Cross Site Scripting (XSS)

Software Blocksy Type Theme Vulnerable versions = 2.0.19 Fixed in 2.0.20 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24871 Patch priority Low CVSS severity Low 6.5 Developer Creative Themes PSID 07c604dd56fb Credits savphill Required privilege Editor Published ...

WordPress Anonymous Restricted Content Plugin <= 1.6.2 is vulnerable to Bypass Vulnerability

Software Anonymous Restricted Content Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-0909 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 3b50fe0358a1 Credits Francesco Carlucci...

WordPress LearnDash LMS Plugin <= 4.10.1 is vulnerable to Sensitive Data Exposure

Software LearnDash LMS Type Plugin Vulnerable versions = 4.10.1 Fixed in 4.10.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-1209 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b49f2746f70f Credits Karl Emil Nikka Required...

WordPress CP Polls Plugin <= 1.0.71 is vulnerable to Content Injection

Software CP Polls Type Plugin Vulnerable versions = 1.0.71 Fixed in 1.0.72 OWASP Top 10 A5: Security Misconfiguration Classification Content Injection CVE CVE-2024-24874 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 01d54802a0ee Credits Kyle Sanchez Required privilege...

WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF)

Software Link Library Type Plugin Vulnerable versions = 7.5.13 Fixed in 7.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24875 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 771a2cb13065 Credits Dhabaleshwar Das Requir...

WordPress Apollo13 Framework Extensions Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)

Software Apollo13 Framework Extensions Type Plugin Vulnerable versions = 1.9.2 Fixed in 1.9.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24880 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c7023587281d Credits LVT-tholv2k Required...

WordPress RSS Aggregator by Feedzy Plugin <= 4.4.1 is vulnerable to Broken Access Control

Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions = 4.4.1 Fixed in 4.4.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1092 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d6dde9967d92 Credits Muhammad Daffa Requir...

WordPress LearnDash LMS Plugin <= 4.10.1 is vulnerable to Sensitive Data Exposure

Software LearnDash LMS Type Plugin Vulnerable versions = 4.10.1 Fixed in 4.10.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-1210 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID eac39e71b914 Credits Karl Emil Nikka Required...

WordPress Contest Gallery Plugin <= 21.2.8.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Contest Gallery Type Plugin Vulnerable versions = 21.2.8.4 Fixed in 21.2.9 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24887 Patch priority Low CVSS severity Low 5.4 Developer Wasiliy Strecker PSID bc8832951ec5 Credits Dhabaleshwar D...

Blocking Compromised Tokens with Wallarm

In our Annual API ThreatStats report, we highlighted the increasing threat of API Leaks. An API Leak is the disclosure of sensitive API information, such as a token, credential, or private schema. These leaks can occur directly via the API itself, but also via third party tools used to manage...

WordPress Premium Addons for Elementor Plugin <= 4.10.16 is vulnerable to Cross Site Scripting (XSS)

Software Premium Addons for Elementor Type Plugin Vulnerable versions = 4.10.16 Fixed in 4.10.17 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24831 Patch priority Low CVSS severity Low 6.5 Developer LeapWorx PSID 69f3ad862bdd Credits Khalid Yusuf Required...

WordPress SP Project & Document Manager Plugin <= 4.69 is vulnerable to SQL Injection

Software SP Project & Document Manager Type Plugin Vulnerable versions = 4.69 Fixed in 4.70 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-24868 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 55e058d86d8c Credits Yudistira Arya Required privilege...

WordPress EventPrime Plugin <= 3.3.9 is vulnerable to Broken Access Control

Software EventPrime Type Plugin Vulnerable versions = 3.3.9 Fixed in 3.4.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24832 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID 611d9617bb60 Credits Abdi Pranata Required privilege...

WordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)

Software Biteship Type Plugin Vulnerable versions = 2.2.24 Fixed in 2.2.25 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24866 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 138291b61ab9 Credits thiennv Required privilege...