WordPress affiliate-toolkit Plugin <= 3.6.5 is vulnerable to Cross Site Scripting (XSS)

Software affiliate-toolkit Type Plugin Vulnerable versions = 3.6.5 Fixed in 3.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10227 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 78a335fc5aaa Credits Peter Thaleikis...

WordPress Download Monitor Plugin <= 5.0.13 is vulnerable to Broken Access Control

Software Download Monitor Type Plugin Vulnerable versions = 5.0.13 Fixed in 5.0.14 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10399 Patch priority Low CVSS severity Low 4.3 Developer WPChill PSID 4c314a68f652 Credits Trương Hữu Phúc truonghuuphuc...

WordPress Newsletters Plugin <= 4.9.9.4 is vulnerable to Cross Site Scripting (XSS)

Software Newsletters Type Plugin Vulnerable versions = 4.9.9.4 Fixed in 4.9.9.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10181 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 21f5eb2f7bba Credits Peter Thaleikis Require...

WordPress Crypto Plugin <= 2.15 is vulnerable to Cross Site Request Forgery (CSRF)

Software Crypto Type Plugin Vulnerable versions = 2.15 Fixed in 2.16 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-9990 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 9ea8df5f4b5b Credits István Márton Required privileg...

WordPress SW Kick Integration Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software SW Kick Integration Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10184 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f0ac845fe096 Credits Peter Thaleikis...

WordPress Post Status Notifier Premium Plugin <= 1.11.6 is vulnerable to Cross Site Scripting (XSS)

Software Post Status Notifier Premium Type Plugin Vulnerable versions = 1.11.6 Fixed in 1.11.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10048 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5dcdb37cb71e Credits...

WordPress WPC Smart Messages for WooCommerce Plugin <= 4.2.1 is vulnerable to Local File Inclusion

Software WPC Smart Messages for WooCommerce Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-10436 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 61988e9cc775 Credits theviper17y Required...

WordPress SEUR Oficial Plugin <= 2.2.11 is vulnerable to Cross Site Scripting (XSS)

Software SEUR Oficial Type Plugin Vulnerable versions = 2.2.11 Fixed in 2.2.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9438 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 09ee4a264f33 Credits vgo0 Required...

WordPress Marketing Automation by AZEXO Plugin <= 1.27.80 is vulnerable to Privilege Escalation

Software Marketing Automation by AZEXO Type Plugin Vulnerable versions = 1.27.80 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-50506 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 3eb031584d8d...

PT-2024-16291 · Sourcecodester · Sourcecodester Kortex Lite Advocate Office Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Kortex Lite Advocate Office Management System version 1.0 Description: A critical issue has been found in the component POST Parameter Handler, specifically in the file /kortex lite/control/edit profile.php. The manipulation of...

WordPress Posti Shipping Plugin <= 3.10.2 is vulnerable to Full Path Disclosure (FPD)

Software Posti Shipping Type Plugin Vulnerable versions = 3.10.2 Fixed in 3.10.3 OWASP Top 10 A3: Sensitive Data Exposure Classification Full Path Disclosure FPD CVE CVE-2024-50512 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f13c6383cb59 Credits Fariq Fadillah Gusti...

WordPress Contact Form 7 Telegram Plugin <= 0.8.5 is vulnerable to Broken Access Control

Software Contact Form 7 Telegram Type Plugin Vulnerable versions = 0.8.5 Fixed in 0.8.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9629 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bc9031e15885 Credits István Márton Required...

CVE-2020-26308

Validate.js provides a declarative way of validating javascript objects. Versions 0.13.1 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, no known patches are available...

CVE-2020-26309 GHSL-2020-303: Regular Expression Denial of Service (ReDoS) in nope-validator

Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, it is unknown if any patches are available...

CVE-2020-26303

The CVE-2020-26303 entry concerns the insane HTML sanitizer. Affected versions are 2.6.2 and earlier. The underlying issue is a Regular Expression Denial of Service (ReDoS) vulnerability in one or more regular expressions used by the sanitizer. Public documentation indicates that as of publicatio...

WordPress Acnoo Flutter API Plugin <= 1.0.5 is vulnerable to Privilege Escalation

Software Acnoo Flutter API Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-50486 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 69fb59b59cf8 Credits...

WordPress Extensions by HocWP Team Plugin <= 0.2.3.2 is vulnerable to Broken Authentication

Software Extensions by HocWP Team Type Plugin Vulnerable versions = 0.2.3.2 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9930 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 7d51f78c234b Credit...

WordPress Signup Page Plugin <= 1.0 is vulnerable to Privilege Escalation

Software Signup Page Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-50475 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 15ed63623277 Credits Mika Required...

WordPress WP Awesome Login Plugin <= 0.4.0 is vulnerable to Cross Site Scripting (XSS)

Software WP Awesome Login Type Plugin Vulnerable versions = 0.4.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9456 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 140160df9cee Credits Francesco Carlucci Requir...

PT-2024-33024 · Hanzhou Haobo · Hanzhou Haobo Network Management System

Name of the Vulnerable Software and Affected Versions: Hanzhou Haobo network management system version 1.0 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via a crafted script. Recommendations: For Hanzhou Haobo network management system version 1.0, at the...