WordPress Exclusive Addons Elementor Plugin <= 2.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Exclusive Addons Elementor Type Plugin Vulnerable versions = 2.6.9 Fixed in 2.6.9.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1234 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID eec3f461cc61 Credits Webbernaut...

WordPress Visual Composer Website Builder Plugin <= 45.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Visual Composer Website Builder Type Plugin Vulnerable versions = 45.6.0 Fixed in 45.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6880 Patch priority Low CVSS severity Low 6.5 Developer Visual Composer PSID 2a3c93e3a183 Credits...

GHSA-VM9M-57JR-4PXH Mattermost fails to limit the number of role names

Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause the server to run out of memory and crash by issuing an unusually large HTTP request...

WordPress Events Manager Plugin <= 6.4.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Events Manager Type Plugin Vulnerable versions = 6.4.6.4 Fixed in 6.4.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0614 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 4d14ba7756e8 Credits Akbar Kustirama Require...

WordPress Advanced iFrame Plugin <= 2024.1 is vulnerable to Cross Site Scripting (XSS)

Software Advanced iFrame Type Plugin Vulnerable versions = 2024.1 Fixed in 2024.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1341 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f4f416259347 Credits Fariq Fadillah Gusti...

WordPress Marketing Optimizer Plugin <= 20200925 is vulnerable to Cross Site Request Forgery (CSRF)

Software Marketing Optimizer Type Plugin Vulnerable versions = 20200925 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1976 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 0dafd9769ab2 Credits suzuki kaito...

WordPress Friends Plugin <= 2.8.5 is vulnerable to Server Side Request Forgery (SSRF)

Software Friends Type Plugin Vulnerable versions = 2.8.5 Fixed in 2.8.6 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-1978 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID c75d983a4b44 Credits Francisco Gutierrez Required privilege...

WordPress Page Restrict Plugin <= 2.5.5 is vulnerable to Bypass Vulnerability

Software Page Restrict Type Plugin Vulnerable versions = 2.5.5 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-0682 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e5dc30bc662f Credits Francesco Carlucci Required privilege...

WordPress WordPress Access Control Plugin <= 4.0.13 is vulnerable to Sensitive Data Exposure

Software WordPress Access Control Type Plugin Vulnerable versions = 4.0.13 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-0975 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 6f6e7407c536 Credits Francesco Carlucci...

WordPress Chat Bubble Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Chat Bubble Type Plugin Vulnerable versions = 2.3 Fixed in 2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0898 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 32320d8c2073 Credits Dipak Panchal th3.d1p4k Required...

WordPress Yuki Theme <= 1.3.14 is vulnerable to Cross Site Request Forgery (CSRF)

Software Yuki Type Theme Vulnerable versions = 1.3.14 Fixed in 1.3.15 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1943 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d0c2045710bf Credits Lucio Sá Required privilege...

WordPress Page Duplicator Plugin <= 0.1.1 is vulnerable to Broken Access Control

Software Page Duplicator Type Plugin Vulnerable versions = 0.1.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1368 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 7dc90907c1cd Credits Lucio Sá Required privilege...

WordPress Anti Hacker Plugin <= 4.51 is vulnerable to Broken Access Control

Software Anti Hacker Type Plugin Vulnerable versions = 4.51 Fixed in 4.52 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1860 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID bbb1acb1d01e Credits Lucio Sá Required privilege...

GHSA-PX7W-C9GW-7GJ3 Apache James server: Privilege escalation via JMX pre-authentication deserialization

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JM...

WordPress Spiffy Calendar Plugin < 4.9.9 is vulnerable to Broken Access Control

Software Spiffy Calendar Type Plugin Vulnerable versions 4.9.9 Fixed in 4.9.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0855 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 34d04762f8cf Credits cyc707 Required privilege...

PT-2024-18200 · WordPress · Categorify

Name of the Vulnerable Software and Affected Versions: Categorify plugin for WordPress versions up to, and including, 1.0.7.4 Description: The issue allows unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory function. This makes it possible for...

WordPress LiteSpeed Cache Plugin <= 5.7 is vulnerable to Cross Site Scripting (XSS)

Software LiteSpeed Cache Type Plugin Vulnerable versions = 5.7 Fixed in 5.7.0.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-40000 Patch priority High CVSS severity High 8.3 Developer Hai Zheng / Lite Speed Cache PSID 61e99b6b8264 Credits Rafie Muhammad Patchsta...

PT-2024-18422 · Unknown · Osuuu Lightpicture

Name of the Vulnerable Software and Affected Versions: osuuu LightPicture versions up to 1.2.2 Description: A critical issue has been found in osuuu LightPicture, affecting the function handle of the file /app/middleware/TokenVerify.php. The manipulation leads to the use of a hard-coded...

WordPress Duitku Payment Gateway Plugin <= 2.11.6 is vulnerable to Broken Access Control

Software Duitku Payment Gateway Type Plugin Vulnerable versions = 2.11.6 Fixed in 2.11.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0631 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 48de9cbc8e6d Credits Francesco Carlucci...

WordPress ProfilePress Plugin <= 4.15.0 is vulnerable to Cross Site Scripting (XSS)

Software ProfilePress Type Plugin Vulnerable versions = 4.15.0 Fixed in 4.15.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1409 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ed81354d54ab Credits Ngô Thiên An ancorn...