WordPress ShopLentor Plugin <= 2.8.4 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.4 Fixed in 2.8.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2946 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 95e2e2bf1701 Credits Phuoc Pham p3tl0v3r Required...

WordPress App Builder Plugin <= 3.8.7 is vulnerable to Open Redirection

Software App Builder Type Plugin Vulnerable versions = 3.8.7 Fixed in 3.8.8 OWASP Top 10 A4: Insecure Design Classification Open Redirection CVE CVE-2024-31282 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID d4752ee01a2d Credits Yudistira Arya Required privilege...

WordPress EmbedPress Plugin <= 3.9.8 is vulnerable to Broken Access Control

Software EmbedPress Type Plugin Vulnerable versions = 3.9.8 Fixed in 3.9.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31284 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0f53658201e5 Credits Majed Refaea Required...

WordPress Premium Addons for Elementor Plugin <= 4.10.22 is vulnerable to Sensitive Data Exposure

Software Premium Addons for Elementor Type Plugin Vulnerable versions = 4.10.22 Fixed in 4.10.23 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-31278 Patch priority Low CVSS severity Low 4.3 Developer LeapWorx PSID e07cd20a1a96 Credits Khalid Yusuf...

WordPress Classified Listing Plugin <= 3.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Classified Listing Type Plugin Vulnerable versions = 3.0.4 Fixed in 3.0.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1315 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 27f9fddfe733 Credits Francesco Carlucc...

WordPress Relevanssi Premium Plugin <= 2.25.1 is vulnerable to CSV Injection

Software Relevanssi Premium Type Plugin Vulnerable versions = 2.25.1 Fixed in 2.25.2 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2024-3214 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID c945697bfd2b Credits Thura Moe Myint mgthuramoemyint Required...

AZL-39238 CVE-2023-45288 affecting package vitess for versions less than 16.0.2-8

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

WordPress ShopLentor Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.3 Fixed in 2.8.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2868 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1cdf46cdcf3 Credits wesley wcraft Required...

WordPress Easy Digital Downloads Plugin <= 3.2.9 is vulnerable to Sensitive Data Exposure

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.9 Fixed in 3.2.10 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2302 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4b720db13b09 Credits Colin Xu Required...

WordPress TaxoPress Plugin <= 3.12.0 is vulnerable to Cross Site Scripting (XSS)

Software TaxoPress Type Plugin Vulnerable versions = 3.12.0 Fixed in 3.20.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2830 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 812b03b02ecc Credits stealthcopter Required...

WordPress Spectra Plugin <= 2.10.3 is vulnerable to Cross Site Scripting (XSS)

Software Spectra Type Plugin Vulnerable versions = 2.10.3 Fixed in 2.10.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6486 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2ec9e8bd69ac Credits Akbar Kustirama Required...

WordPress WooCommerce Cart Abandonment Recovery Plugin < 1.2.27 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Cart Abandonment Recovery Type Plugin Vulnerable versions 1.2.27 Fixed in 1.2.27 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2322 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 266dfc803e4a Credit...

PT-2024-24216 · Totolink · Totolink Ex200

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX200 version 4.0.3c.7646 B20201211 Description: A remote code execution RCE issue was discovered, which can be exploited via the webWlanIdx parameter in the setWebWlanIdx function. Recommendations: For TOTOLINK EX200 version...

WordPress Oxygen Builder Plugin <= 4.9 is vulnerable to Remote Code Execution (RCE)

Software Oxygen Builder Type Plugin Vulnerable versions = 4.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-31380 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 4b3933c6a6e8 Credits Snicco Required privilege Contributo...

WOOCS – WooCommerce Currency Switcher < 1.4.1.8 - Cross-Site Request Forgery

Description The WOOCS – WooCommerce Currency Switcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.1.7. This is due to missing or incorrect nonce validation on the saveetalon function.. This makes it possible for unauthenticated attackers ...

WordPress Gutenberg Blocks by Kadence Blocks Plugin <= 3.2.17 is vulnerable to Cross Site Scripting (XSS)

Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions = 3.2.17 Fixed in 3.2.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0598 Patch priority Low CVSS severity Low 5.9 Developer KadenceWP PSID def3561720ef Credits Akbar...

PT-2024-23726 · Emlog · Emlog

Name of the Vulnerable Software and Affected Versions: emlog version Pro 2.3 Description: The issue allows remote attackers to execute arbitrary code via a crafted payload to the bottom of the homepage in the footer info parameter. This is a Cross Site Scripting XSS issue. Recommendations: For...

WordPress SecuPress Free Plugin <= 2.2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software SecuPress Free Type Plugin Vulnerable versions = 2.2.5.1 Fixed in 2.2.5.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1504 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e3f0f4ee5647 Credits Lucio Sá Required...

WordPress MasterStudy LMS Plugin <= 3.3.0 is vulnerable to Local File Inclusion

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.3.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-2411 Patch priority High CVSS severity High 9 Developer Claim ownership PSID c509d4c43d0b Credits Hiroho Shimada Required privilege...

WordPress WP Chat App Plugin <= 3.6.2 is vulnerable to Cross Site Scripting (XSS)

Software WP Chat App Type Plugin Vulnerable versions = 3.6.2 Fixed in 3.6.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2513 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3da0694e8a8a Credits Ngô Thiên An ancorn Required...