WordPress Backup Migration Plugin <= 1.3.6 is vulnerable to Sensitive Data Exposure

Software Backup Migration Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-6266 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 7df0ea44f3d7 Credits Rafshanzani Suhada...

WordPress DoFollow Case by Case Plugin <= 3.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software DoFollow Case by Case Type Plugin Vulnerable versions = 3.4.2 Fixed in 3.5.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49197 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1e74ba3bfbc6 Credits Skalucy...

Associated Press, ESPN, CBS among top sites serving fake virus alerts

ScamClub is a threat actor whos been involved in malvertising activities since 2018. Chances are you probably ran into one of their online scams on your mobile device. Confiant, the firm that has tracked ScamClub for years, released a comprehensive report in September while also disrupting their...

WordPress Debug Log Manager Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Debug Log Manager Type Plugin Vulnerable versions = 2.2.1 Fixed in 2.2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-5772 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f9180ed4b5d0 Credits Dmitrii Ignatyev...

WordPress which template file Plugin <= 5.0.0 is vulnerable to Cross Site Scripting (XSS)

Software which template file Type Plugin Vulnerable versions = 5.0.0 Fixed in 5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-49177 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 69cd93c404ef Credits LEE SE HYOUNG...

WordPress Forms by CaptainForm Plugin <= 2.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Forms by CaptainForm Type Plugin Vulnerable versions = 2.5.3 Fixed in 2.5.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49170 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 40df54b84291 Credits Khalid Yusuf Required...

WordPress WCMultiShipping Plugin <= 2.3.7 is vulnerable to Broken Access Control

Software WCMultiShipping Type Plugin Vulnerable versions = 2.3.7 Fixed in 2.3.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e3e8c5ad85fa Credits Unknown Required privilege Subscriber...

WordPress List all posts by Authors, nested Categories and Title Plugin <= 2.8.2 is vulnerable to Cross Site Scripting (XSS)

Software List all posts by Authors, nested Categories and Title Type Plugin Vulnerable versions = 2.8.2 Fixed in 2.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-49182 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Email Address Encoder Plugin <= 1.0.22 is vulnerable to Cross Site Scripting (XSS)

Software Email Address Encoder Type Plugin Vulnerable versions = 1.0.22 Fixed in 1.0.23 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-48765 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4b554f8ca93c Credits LVT-tholv2k Required privilege...

WordPress Export WP Page to Static HTML/CSS Plugin <= 2.1.9 is vulnerable to Broken Access Control

Software Export WP Page to Static HTML/CSS Type Plugin Vulnerable versions = 2.1.9 Fixed in 2.2.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6369 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID fad061a3db6e Credits Alex Thomas...

WordPress NextScripts Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)

Software NextScripts Type Plugin Vulnerable versions = 4.4.2 Fixed in 4.4.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49183 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 43a77de242d5 Credits Le Ngoc Anh Required privilege...

WordPress Database for CF7 Plugin <= 1.2.4 is vulnerable to Broken Access Control

Software Database for CF7 Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49167 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d94c70d6f143 Credits RE-ALTER Required...

WordPress Innovs HR Plugin <= 1.0.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Innovs HR Type Plugin Vulnerable versions = 1.0.3.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49171 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e18ef701b7d2 Credits SeungYongLee Required privilege...

WordPress BP Better Messages Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

Software BP Better Messages Type Plugin Vulnerable versions = 2.4.0 Fixed in 2.4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49168 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 979ad8298842 Credits Rafshanzani Suhada Required privile...

WordPress teachPress Plugin <= 9.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software teachPress Type Plugin Vulnerable versions = 9.0.5 Fixed in 9.0.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49163 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 932dc955a019 Credits LVT-tholv2k Required...

WordPress Adifier System Plugin < 3.1.4 is vulnerable to Cross Site Scripting (XSS)

Software Adifier System Type Plugin Vulnerable versions 3.1.4 Fixed in 3.1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49187 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a67ee23d6891 Credits RE-ALTER Required privilege...

WordPress SchedulePress Plugin <= 5.0.4 is vulnerable to Broken Access Control

Software SchedulePress Type Plugin Vulnerable versions = 5.0.4 Fixed in 5.0.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID aa83517bf4e8 Credits Unknown Required privilege Contributor...

WordPress JetElements For Elementor Plugin <= 2.6.13 is vulnerable to Arbitrary File Download

Software JetElements For Elementor Type Plugin Vulnerable versions = 2.6.13 Fixed in 2.6.13.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-48759 Patch priority High CVSS severity High 7.5 Developer Crocoblock PSID b2e64216e8cc Credits Rafie Muhammad...

WordPress SVGator – Add Animated SVG Easily Plugin <= 1.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software SVGator – Add Animated SVG Easily Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48766 Patch priority Low CVSS severity Low 4.3 Developer SVGator PSID 4037a0795164 Credits Abdi...

WordPress Aruba HiSpeed Cache Plugin <= 2.0.6 is vulnerable to Sensitive Data Exposure

Software Aruba HiSpeed Cache Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2023-44983 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e52ca8ff914d Credits Josh...