WordPress WS Form Pro Plugin <= 1.9.217 is vulnerable to CSV Injection

Software WS Form Pro Type Plugin Vulnerable versions = 1.9.217 Fixed in 1.9.218 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-5424 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID b17414acaf13 Credits Duc Manh Required privilege Unauthenticated...

WordPress WS Form LITE Plugin <= 1.9.217 is vulnerable to CSV Injection

Software WS Form LITE Type Plugin Vulnerable versions = 1.9.217 Fixed in 1.9.218 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-5424 Patch priority Low CVSS severity Low 4.7 Developer WS Form PSID 7d55c6663718 Credits Duc Manh Required privilege Unauthenticated Published 7...

WordPress Magical Addons For Elementor Plugin <= 1.1.39 is vulnerable to Cross Site Scripting (XSS)

Software Magical Addons For Elementor Type Plugin Vulnerable versions = 1.1.39 Fixed in 1.1.40 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5161 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 98225fcbb3a3 Credits...

WordPress Strong Testimonials Plugin <= 3.1.12 is vulnerable to Broken Access Control

Software Strong Testimonials Type Plugin Vulnerable versions = 3.1.12 Fixed in 3.1.13 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6491 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 107d32b5539a Credits Rafshanzani Suhada...

PT-2024-32074 · WordPress · Wp Reset

Name of the Vulnerable Software and Affected Versions: WP Reset plugin for WordPress versions up to, and including, 2.02 Description: The issue is related to a missing capability check on the save ajax function, allowing authenticated attackers with subscriber-level access and above to modify the...

WordPress Photo Gallery by 10Web Plugin <= 1.8.23 is vulnerable to Path Traversal

Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.23 Fixed in 1.8.24 OWASP Top 10 A3: Injection Classification Path Traversal CVE CVE-2024-5481 Patch priority Medium CVSS severity Medium 6.8 Developer Claim ownership PSID f9ab0048fc76 Credits Tobias Weißhaar kun19 Required...

PT-2024-6145 · Microsoft · Teams

Name of the Vulnerable Software and Affected Versions: Microsoft Teams work or school version 24046.2813.2770.1094 for macOS Description: A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams for macOS. This issue allows a specially crafted library to leverage...

WordPress TablePress Plugin <= 2.3.1 is vulnerable to Server Side Request Forgery (SSRF)

Software TablePress Type Plugin Vulnerable versions = 2.3.1 Fixed in 2.3.2 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-4354 Patch priority Low CVSS severity Low 6.4 Developer TablePress PSID e683cfb42286 Credits Tobias Weißhaar kun19 Required privilege...

WordPress SKT Addons for Elementor Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software SKT Addons for Elementor Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5091 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 81d64b5eccce Credits stealthcopter...

WordPress ARForms Plugin < 6.6 is vulnerable to Cross Site Scripting (XSS)

Software ARForms Type Plugin Vulnerable versions 6.6 Fixed in 6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4621 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 54c970f6100c Credits Bob Matyas Required privilege...

WordPress Tutor LMS Plugin <= 2.7.1 is vulnerable to Insecure Direct Object References (IDOR)

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-5438 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 04944e6bcf56 Credits Thanh Nam Tran...

CVE-2024-2624

A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the @router.get"/switchpersonalpath" endpoint in ./lollms-webui/lollmscore/lollms/server/endpoints/lollmsuser.py. The vulnerability arises due to insufficient sanitization...

PYSEC-2024-170

A stored Cross-Site Scripting XSS vulnerability was identified in the zenml-io/zenml repository, specifically within the 'logourl' field. By injecting malicious payloads into this field, an attacker could send harmful messages to other users, potentially compromising their accounts. The...

CVE-2024-5001

The Image Hover Effects for Elementor with Lightbox and Flipbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id', 'oxiaddonsftitletag', and 'contentdescriptiontag' parameters in all versions up to, and including, 3.0.2 due to insufficient input sanitization and outpu...

WordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery Plugin <= 1.4.5 is vulnerable to Broken Access Control

Software Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery Type Plugin Vulnerable versions = 1.4.5 Fixed in 1.4.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35721 Patch priority Low CVSS severity Low 4.3 Developer Claim...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.109 is vulnerable to SQL Injection

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.109 Fixed in 1.5.110 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-5329 Patch priority Low CVSS severity Low 8.5 Developer Unlimited Elements PSID 733124c0042b...

WordPress Rotating Tweets Plugin <= 1.9.10 is vulnerable to Cross Site Scripting (XSS)

Software Rotating Tweets Type Plugin Vulnerable versions = 1.9.10 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5141 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 44a4d93efa2c Credits Krzysztof Zając Required...

WordPress Testimonial Carousel For Elementor Plugin <= 10.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Testimonial Carousel For Elementor Type Plugin Vulnerable versions = 10.1.1 Fixed in 10.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-35713 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID be0db57f0489 Credits...

WordPress WP Dark Mode Plugin <= 5.0.4 is vulnerable to Broken Access Control

Software WP Dark Mode Type Plugin Vulnerable versions = 5.0.4 Fixed in 5.0.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5449 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fcf51369e44e Credits Peter Thaleikis Required privileg...

WordPress Cookie Consent Plugin <= 3.2 is vulnerable to Broken Access Control

Software Cookie Consent Type Plugin Vulnerable versions = 3.2 Fixed in 3.2.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35692 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5d7c8b562fd3 Credits Mika Required privilege...