WordPress Code Generate Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Code Generate Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49646 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9f72ba821343 Credits Mika Required privilege Unauthenticate...

WordPress Affiliate Platform Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)

Software Affiliate Platform Type Plugin Vulnerable versions = 1.4.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49645 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e63013ed9d44 Credits Mika Required privilege...

WordPress WP Sessions Time Monitoring Full Automatic Plugin <= 1.0.9 is vulnerable to SQL Injection

Software WP Sessions Time Monitoring Full Automatic Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.1.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-49681 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 5ddec7a4af4c Credits stealthcopter Requir...

WordPress Monitor.chat Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Monitor.chat Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49639 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c019b6d72e6e Credits Mika Required privilege Unauthenticat...

WordPress Web Bricks Addons for Elementor Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Web Bricks Addons for Elementor Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49665 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3f32b8aa058a Credits Gab Required privilege...

WordPress All-in-One WP Migration Plugin <= 7.86 is vulnerable to Sensitive Data Exposure

Software All-in-One WP Migration Type Plugin Vulnerable versions = 7.86 Fixed in 7.87 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-8852 Patch priority Low CVSS severity Low 5.3 Developer ServMask, Inc PSID 1b517ae2c2c6 Credits villu164 Required...

WordPress EKC Tournament Manager Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software EKC Tournament Manager Type Plugin Vulnerable versions = 2.2.1 Fixed in 2.2.2 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-49674 Patch priority Low CVSS severity Low 9.6 Developer Claim ownership PSID 8fe129e12d64 Credits Joshua Chan Requir...

WordPress Agile Video Player Lite Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Agile Video Player Lite Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49636 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 267bc8c567b6 Credits João Pedro S Alcântara Kinor...

WordPress Tida URL Screenshot Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Tida URL Screenshot Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49641 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 97c4a19331ca Credits Mika Required privilege...

WordPress 3D Work In Progress Plugin <= 1.0.3 is vulnerable to Arbitrary File Deletion

Software 3D Work In Progress Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2024-49657 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 209728d5f5a9 Credits stealthcopter Required privilege...

PT-2024-33470 · Vivek Tamrakar · Wp Rest Api Fns

Name of the Vulnerable Software and Affected Versions: Vivek Tamrakar WP REST API FNS versions 1.0.0 and earlier Description: The issue allows attackers to upload harmful content, including web shells, to a web server due to an Unrestricted Upload of File with Dangerous Type vulnerability. This c...

PT-2024-39140

Name of the Vulnerable Software and Affected Versions: TS Poll WordPress plugin versions prior to 2.4.0 Description: The issue allows admins to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before using it in a SQL statement. Recommendations: For versio...

Exploit for SQL Injection in Internet-Formation Wp-Advanced-Search

CVE-2024-9796 WordPress WP-Advanced-Search = 3.3.9 - Unaut...

WordPress jLayer Parallax Slider Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software jLayer Parallax Slider Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49334 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 65c219f6d335 Credits João Pedro S Alcântara Kinort...

WordPress Click to Chat – WP Support All-in-One Floating Widget Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Click to Chat – WP Support All-in-One Floating Widget Type Plugin Vulnerable versions = 2.3.3 Fixed in 2.3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10055 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...

WordPress GoogleDrive folder list Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software GoogleDrive folder list Type Plugin Vulnerable versions = 2.2.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49335 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 4b047cc300da Credits SOPROBRO...

WordPress StreamWeasels Twitch Integration Plugin <= 1.8.6 is vulnerable to Cross Site Scripting (XSS)

Software StreamWeasels Twitch Integration Type Plugin Vulnerable versions = 1.8.6 Fixed in 1.8.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9897 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 924e5605229d Credits Peter...

WordPress Advanced Advertising System Plugin <= 1.3.1 is vulnerable to PHP Object Injection

Software Advanced Advertising System Type Plugin Vulnerable versions = 1.3.1 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-49624 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 02d433e2c1ec Credits Mika Required privilege...

WordPress WP Dropbox Dropins Plugin <= 1.0 is vulnerable to Arbitrary File Upload

Software WP Dropbox Dropins Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49607 Patch priority High CVSS severity High 10 Developer Claim ownership PSID bc49371a8bf9 Credits stealthcopter Required privilege...

WordPress Time Clock Pro Plugin <= 1.1.4 is vulnerable to Remote Code Execution (RCE)

Software Time Clock Pro Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.5 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2024-9593 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 9837dd0a77ff Credits István Márton Required privilege...