WordPress Word Balloon Plugin <= 4.21.1 is vulnerable to Local File Inclusion

Software Word Balloon Type Plugin Vulnerable versions = 4.21.1 Fixed in 4.22.0 OWASP Top 10 A6: Security Misconfiguration Classification Local File Inclusion CVE CVE-2024-35781 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2b66b1bcd514 Credits João Pedro S Alcântara...

WordPress Media Library Assistant Plugin <= 3.16 is vulnerable to SQL Injection

Software Media Library Assistant Type Plugin Vulnerable versions = 3.16 Fixed in 3.17 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-5605 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID a2ffbb62fd66 Credits Krzysztof Zając Required privilege Contribut...

WordPress Slideshow SE Plugin <= 2.5.20 is vulnerable to Cross Site Scripting (XSS)

Software Slideshow SE Type Plugin Vulnerable versions = 2.5.20 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35769 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5064bdc28526 Credits Steven Julian Required privilege Author...

WordPress Salon booking system Plugin <= 10.2 is vulnerable to Arbitrary File Upload

Software Salon booking system Type Plugin Vulnerable versions = 10.2 Fixed in 10.3 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-3229 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 73c749725728 Credits Gibran Abdillah Required privilege...

WordPress DImage 360 Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software DImage 360 Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35774 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2c7cfe87c199 Credits Ngô Thiên An ancorn from VNPT-VCI Required...

WordPress MIMO Woocommerce Order Tracking Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software MIMO Woocommerce Order Tracking Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5768 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 17c034ea51f0 Credits Luci...

WordPress Sirv Plugin <= 7.2.6 is vulnerable to Arbitrary File Upload

Software Sirv Type Plugin Vulnerable versions = 7.2.6 Fixed in 7.2.7 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-5853 Patch priority Medium CVSS severity Medium 9.9 Developer Sirv PSID b8d1b016bf81 Credits Lucio Sá Required privilege Contributor Published 18 June,...

WordPress WordPress Picture / Portfolio / Media Gallery Plugin <= 3.0.1 is vulnerable to Server Side Request Forgery (SSRF)

Software WordPress Picture / Portfolio / Media Gallery Type Plugin Vulnerable versions = 3.0.1 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-5021 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 4f6e62e03ba9 Credits...

WordPress Photo Video Gallery Master Plugin <= 1.5.3 is vulnerable to PHP Object Injection

Software Photo Video Gallery Master Type Plugin Vulnerable versions = 1.5.3 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-5724 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 22871a87af76 Credits Francesco Carlucci Required...

WordPress plugin FooBox security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

WordPress Squeeze Plugin <= 1.4 is vulnerable to Arbitrary File Upload

Software Squeeze Type Plugin Vulnerable versions = 1.4 Fixed in 1.4.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-35767 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 475c5115f4ba Credits YCInfosec Required privilege Administrator Publishe...

@cdr0/active-development (1.0.0), @cdr0/config (>=1.0.1, <=1.0.2) +6 more potentially affected by CVE-2024-36580 via @cdr0/sg (1.0.10)

@cdr0/sg NPM version 1.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on @cdr0/sg and may be impacted: - @cdr0/active-development 1.0.0 - @cdr0/config =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.1 Source cves: CVE-2024-36580 Source advisory:...

WordPress Master Slider Plugin <= 3.9.10 is vulnerable to Cross Site Scripting (XSS)

Software Master Slider Type Plugin Vulnerable versions = 3.9.10 Fixed in 3.10.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4375 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1a4a36dfa73c Credits Krzysztof Zając Required...

WordPress Interface Theme <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Interface Type Theme Vulnerable versions = 3.1.0 Fixed in 3.1.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35758 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9257c03a0537 Credits stealthcopter Required privilege Contributor...

WordPress Greenshift – animation and page builder blocks Plugin <= 8.8.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Greenshift – animation and page builder blocks Type Plugin Vulnerable versions = 8.8.9.1 Fixed in 8.9.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35765 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cb212ed9cc65 Credits João...

WordPress Scheduling Plugin – Online Booking for WordPress Plugin <= 3.5.10 is vulnerable to Broken Access Control

Software Scheduling Plugin – Online Booking for WordPress Type Plugin Vulnerable versions = 3.5.10 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1634 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 166eecf10900...

WordPress Easy Age Verify Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)

Software Easy Age Verify Type Plugin Vulnerable versions = 1.8.2 Fixed in 1.8.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35757 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d39f735e9e41 Credits Huynh Tien Si Required privilege...

WordPress Church Admin Plugin <= 4.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Church Admin Type Plugin Vulnerable versions = 4.4.4 Fixed in 4.4.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35764 Patch priority Low CVSS severity Low 6.5 Developer Andy Moyle PSID ef4f8b581e9b Credits Ngô Thiên An ancorn from VNPT-VCI Required...

WordPress Business Directory Plugin Plugin <= 6.4.3 is vulnerable to CSV Injection

Software Business Directory Plugin Type Plugin Vulnerable versions = 6.4.3 Fixed in 6.4.4 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-5527 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID fa4533c87625 Credits Dmitrii Ignatyev Required privilege Auth...

WordPress Popup Builder Plugin <= 4.3.1 is vulnerable to Broken Access Control

Software Popup Builder Type Plugin Vulnerable versions = 4.3.1 Fixed in 4.3.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6696 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 7eeb41bcfcb3 Credits Lucio Sá Required privilege...