CVE-2024-56043

CVE-2024-56043 concerns the WordPress plugin WPLMS by VibeThemes. The vulnerability is an Incorrect Privilege Assignment that allows unauthenticated privilege escalation in WPLMS versions up to 1.9.9. The root cause, as described in the sources, is a privilege assignment error. Impact is describe...

WordPress Otter - Gutenberg Block Plugin <= 3.0.6 is vulnerable to Path Traversal

Software Otter - Gutenberg Block Type Plugin Vulnerable versions = 3.0.6 Fixed in 3.0.7 OWASP Top 10 A4: Insecure Design Classification Path Traversal CVE CVE-2024-11219 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 16f94f193561 Credits mikemyers Required privilege...

WordPress Fence URL Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Fence URL Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53733 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 30a5e37e5481 Credits SOPROBRO Required privilege...

WordPress Zajax – Ajax Navigation Plugin <= 0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Zajax – Ajax Navigation Type Plugin Vulnerable versions = 0.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53719 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 3d6723133578 Credits SOPROBRO Requir...

WordPress RealtyCandy IDX Broker Extended Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software RealtyCandy IDX Broker Extended Type Plugin Vulnerable versions = 1.5.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53726 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 24b8b3d7db9b Credits...

WordPress IceStats Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software IceStats Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53724 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 228e60432718 Credits SOPROBRO Required privilege...

WordPress WordPress Announcement & Notification Banner Plugin – Bulletin Plugin <= 3.11.7 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Announcement & Notification Banner Plugin – Bulletin Type Plugin Vulnerable versions = 3.11.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10682 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownersh...

WordPress WPFunnels Plugin <= 3.5.5 is vulnerable to Cross Site Scripting (XSS)

Software WPFunnels Type Plugin Vulnerable versions = 3.5.5 Fixed in 3.5.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10792 Patch priority Medium CVSS severity Medium 7.1 Developer WPFunnels Team PSID b1c17399226b Credits Nathan calysteon Require...

WordPress Page Parts Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Page Parts Type Plugin Vulnerable versions = 1.4.3 Fixed in 1.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11360 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6c5273fd367a Credits vgo0 Required privileg...

WordPress Wawp Plugin < 3.0.18 is vulnerable to Broken Authentication

Software Wawp Type Plugin Vulnerable versions 3.0.18 Fixed in 3.0.18 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-52475 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 4c22e2281ddc Credits stealthcopter...

WordPress GamiPress Plugin <= 7.1.5 is vulnerable to Broken Access Control

Software GamiPress Type Plugin Vulnerable versions = 7.1.5 Fixed in 7.1.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-11036 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 528614ec92ef Credits Arkadiusz Hydzik Required...

WordPress Booster for WooCommerce Plugin <= 7.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Booster for WooCommerce Type Plugin Vulnerable versions = 7.2.3 Fixed in 7.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9239 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c5b658709ea3 Credits vgo0...

WordPress Contact Page With Google Map Plugin <= 1.6.1 is vulnerable to Arbitrary File Deletion

Software Contact Page With Google Map Type Plugin Vulnerable versions = 1.6.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-52447 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 5441375409ba Credits Mika Required...

WordPress Bootscraper Plugin <= 2.1.0 is vulnerable to Local File Inclusion

Software Bootscraper Type Plugin Vulnerable versions = 2.1.0 Fixed in 4.0.0 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-52449 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 54a81d2931c0 Credits tahu.datar Required privilege Unauthenticate...

WordPress Google for WooCommerce Plugin <= 2.8.6 is vulnerable to Sensitive Data Exposure

Software Google for WooCommerce Type Plugin Vulnerable versions = 2.8.6 Fixed in 2.8.7 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-10486 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID aafd7d494c83 Credits Francesco Carlucci...

WordPress Weather Atlas Widget Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Weather Atlas Widget Type Plugin Vulnerable versions = 3.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52472 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5504e62dc0b7 Credits LVT-tholv2k Required privileg...

WordPress Buying Buddy IDX CRM Plugin <= 1.1.12 is vulnerable to Cross Site Request Forgery (CSRF)

Software Buying Buddy IDX CRM Type Plugin Vulnerable versions = 1.1.12 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-52446 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 6670b1d35a14 Credits Mika Required...

WordPress SimpleForm Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)

Software SimpleForm Type Plugin Vulnerable versions = 2.2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10883 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c9428f96f6e1 Credits Peter Thaleikis Required...

WordPress EleForms Plugin <= 2.9.9.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software EleForms Type Plugin Vulnerable versions = 2.9.9.9 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-6628 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5925dd673838 Credits Lucio Sá Required privilege...

WordPress Popup box Plugin <= 4.9.7 is vulnerable to Broken Access Control

Software Popup box Type Plugin Vulnerable versions = 4.9.7 Fixed in 4.9.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10861 Patch priority Low CVSS severity Low 5.2 Developer Claim ownership PSID bfd2e007cc0d Credits Trương Hữu Phúc truonghuuphuc...