WordPress GamiPress Plugin <= 6.8.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software GamiPress Type Plugin Vulnerable versions = 6.8.5 Fixed in 6.8.6 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-30455 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7284ec56cbcf Credits Ananda Dhakal Patchstack Requir...

WordPress Tumult Hype Animations Plugin <= 1.9.11 is vulnerable to Cross Site Scripting (XSS)

Software Tumult Hype Animations Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-30461 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 98402ce486d0 Credits Majed...

WordPress weForms Plugin <= 1.6.20 is vulnerable to Broken Access Control

Software weForms Type Plugin Vulnerable versions = 1.6.20 Fixed in 1.6.21 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-30512 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID e2254499c0ef Credits Kyle Sanchez Required privilege...

WordPress Tumult Hype Animations Plugin <= 1.9.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software Tumult Hype Animations Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-30460 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c704327afb62 Credits Majed Refaea...

WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom WooCommerce Checkout Fields Editor Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-30518 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1753adeaf82a...

WordPress Check & Log Email Plugin <= 1.0.9 is vulnerable to Broken Access Control

Software Check & Log Email Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.0.10 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-0866 Patch priority Low CVSS severity Low 8.1 Developer Claim ownership PSID 0ac766d27e85 Credits Sean Murphy Required...

WordPress WP-Lister Lite for Amazon Plugin <= 2.6.8 is vulnerable to Cross Site Scripting (XSS)

Software WP-Lister Lite for Amazon Type Plugin Vulnerable versions = 2.6.8 Fixed in 2.6.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30199 Patch priority Medium CVSS severity Medium 7.1 Developer WP Lab PSID fc71b299dc25 Credits Yudistira Arya Required privile...

WordPress Shortlinks by Pretty Links Plugin <= 3.6.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Shortlinks by Pretty Links Type Plugin Vulnerable versions = 3.6.3 Fixed in 3.6.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2326 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 02d57a965c0b Credits Webbernau...

WordPress Premium Packages Plugin <= 5.8.2 is vulnerable to Cross Site Scripting (XSS)

Software Premium Packages Type Plugin Vulnerable versions = 5.8.2 Fixed in 5.8.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29924 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fd83d5609f73 Credits Yudistira Arya Required privile...

WordPress Travelpayouts Plugin <= 1.1.16 is vulnerable to Open Redirection

Software Travelpayouts Type Plugin Vulnerable versions = 1.1.16 Fixed in 1.1.17 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2024-0337 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 22ec7383525a Credits Krzysztof Zając CERT PL Required privilege...

WordPress Easy Maintenance Mode Plugin <= 1.4.2 is vulnerable to Sensitive Data Exposure

Software Easy Maintenance Mode Type Plugin Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-1477 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 476e05c6025b Credits Francesco Carlucci...

WordPress MyCurator Content Curation Plugin <= 3.76 is vulnerable to Cross Site Scripting (XSS)

Software MyCurator Content Curation Type Plugin Vulnerable versions = 3.76 Fixed in 3.77 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29139 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f5416935cfa3 Credits LVT-tholv2k Required...

WordPress Post SMTP Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.8.6 Fixed in 2.8.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29128 Patch priority Medium CVSS severity Medium 7.1 Developer WPExperts PSID d4415453cdb3 Credits Le Ngoc Anh Required privilege Unauthenticat...

WordPress WooCommerce License Manager Plugin <= 5.3.1 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce License Manager Type Plugin Vulnerable versions = 5.3.1 Fixed in 5.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29121 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ebf509e643b0 Credits Dave Jong Patchstack...

WordPress WP Armour – Honeypot Anti Spam Plugin <= 2.1.13 is vulnerable to Cross Site Scripting (XSS)

Software WP Armour – Honeypot Anti Spam Type Plugin Vulnerable versions = 2.1.13 Fixed in 2.1.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29091 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0e1821a09d0d Credits Rafie Muhammad...

WordPress Link Library Plugin <= 7.6.6 is vulnerable to Cross Site Scripting (XSS)

Software Link Library Type Plugin Vulnerable versions = 7.6.6 Fixed in 7.6.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2325 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6ac3bb374efb Credits Krzysztof Zając...

WordPress Automatic Plugin <= 3.92.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Automatic Type Plugin Vulnerable versions = 3.92.0 Fixed in 3.92.1 OWASP Top 10 A8: Cross Site Request Forgery CSRF Classification Cross Site Request Forgery CSRF CVE CVE-2024-27955 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID cf1662afb1ce Credits Rafie Muhamma...

Malware Scanner < 4.7.3 and Web Application Firewall < 2.1.2 - Unauthenticated Privilege Escalation

Description The plugin does not prevent unauthenticated users from resetting any account's password, allowing them to takeover sites by resetting one of its administrators' password. PoC curl --url 'http://vulnerable-site.tld/wp-login.php' --data...

WordPress AntiSpam for Contact Form 7 Plugin <= 0.6.0 is vulnerable to Cross Site Scripting (XSS)

Software AntiSpam for Contact Form 7 Type Plugin Vulnerable versions = 0.6.0 Fixed in 0.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27961 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID f9498b94e6d4 Credits stealthcopter Required...

WordPress Team Circle Image Slider With Lightbox Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Team Circle Image Slider With Lightbox Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2015-10130 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4e4875511ed9 Credit...