WordPress Orbit Fox by ThemeIsle Plugin <= 2.10.29 is vulnerable to Cross Site Request Forgery (CSRF)

Software Orbit Fox by ThemeIsle Type Plugin Vulnerable versions = 2.10.29 Fixed in 2.10.230 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1162 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4eb624d90158 Credits Francesc...

WordPress Popup More Popups Plugin <= 2.2.4 is vulnerable to Local File Inclusion

Software Popup More Popups Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.2.5 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-0844 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 12b7d2f01a9e Credits 0x9567b Required privilege Administrator...

CVE-2024-23832 Mastodon Remote user impersonation and takeover

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is...

WordPress Userpro Plugin 5.1.5 is vulnerable to Cross Site Scripting (XSS)

Software Userpro Type Plugin Vulnerable versions 5.1.5 Fixed in 5.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2439 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 45fa634a270a Credits István Márton Required privilege...

WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6.1 is vulnerable to Broken Access Control

Software Active Products Tables for WooCommerce Type Plugin Vulnerable versions = 1.0.6.1 Fixed in 1.0.6.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0797 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e0495675d205 Credits...

WordPress Fatal Error Notify Plugin < 1.5.3 is vulnerable to Broken Access Control

Software Fatal Error Notify Type Plugin Vulnerable versions 1.5.3 Fixed in 1.5.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-7202 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 55ba4f7fb253 Credits Dmitrii Ignatyev Required...

WordPress WooCommerce Box Office Plugin <= 1.2.2 is vulnerable to Broken Access Control

Software WooCommerce Box Office Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24799 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2e62ee904d23 Credits Rafie Muhammad...

WordPress Chartify Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Chartify Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47526 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b1cfc37aafc1 Credits Jeongwoo-LeeRoronoa Required privilege...

WordPress OWL Carousel Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)

Software OWL Carousel Type Plugin Vulnerable versions = 1.4.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24801 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 615e32c78c36 Credits resecured.io Required privilege Contributor...

WordPress PropertyHive Plugin <= 2.0.6 is vulnerable to Broken Access Control

Software PropertyHive Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24718 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4eea0b5c54d4 Credits Yudistira Arya Required privileg...

WordPress Shareaholic Plugin <= 9.7.11 is vulnerable to Broken Access Control

Software Shareaholic Type Plugin Vulnerable versions = 9.7.11 Fixed in 9.7.12 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24709 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID e941ba723f22 Credits Abdi Pranata Required...

WordPress Page Restrict Plugin <= 2.5.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Page Restrict Type Plugin Vulnerable versions = 2.5.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24702 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 820413371e9a Credits emad Required privilege...

WordPress Autotitle for WordPress Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Autotitle for WordPress Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6946 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 89d669161c10 Credits Daniel Ruf...

WordPress ERE Recently Viewed Plugin <= 1.3 is vulnerable to PHP Object Injection

Software ERE Recently Viewed Type Plugin Vulnerable versions = 1.3 Fixed in 2.0 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-24797 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 835850fa9817 Credits Yudistira Arya Required privilege...

WordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload

Software Icons Font Loader Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.5 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-24714 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 8add145a8567 Credits Vulzap Required privilege Administrator...

WordPress WP GDPR Compliance Plugin <= 2.0.22 is vulnerable to Broken Access Control

Software WP GDPR Compliance Type Plugin Vulnerable versions = 2.0.22 Fixed in 2.0.23 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6700 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6a981b3b2d5a Credits Lucio Sá Required...

WordPress ACF Photo Gallery Field Plugin <= 2.6 is vulnerable to Broken Access Control

Software ACF Photo Gallery Field Type Plugin Vulnerable versions = 2.6 Fixed in 2.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-23518 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 90b02382eae5 Credits Abdi Pranata Required...

WordPress SiteOrigin Widgets Bundle Plugin <= 1.58.1 is vulnerable to Cross Site Scripting (XSS)

Software SiteOrigin Widgets Bundle Type Plugin Vulnerable versions = 1.58.1 Fixed in 1.58.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0961 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 397ef8bac9bc Credits Webbernaut...

WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection

Software ProductX – Gutenberg WooCommerce Blocks Type Plugin Vulnerable versions = 3.1.4 Fixed in 3.1.5 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-23512 Patch priority High CVSS severity High 8.7 Developer Claim ownership PSID fa4448964e74 Credits Yudistira Arya...

WordPress Formidable Forms Plugin <= 6.7.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Formidable Forms Type Plugin Vulnerable versions = 6.7.2 Fixed in 6.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0660 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7a7ac0638cbc Credits Webbernaut Required...