WordPress ReDi Restaurant Reservation Plugin <= 23.0211 is vulnerable to Broken Access Control

Software ReDi Restaurant Reservation Type Plugin Vulnerable versions = 23.0211 Fixed in 23.0212 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36510 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 27489b229824 Credits Abdi Pranat...

@frontside/backstage-plugin-humanitec-backend (>=0.1.0, <=0.2.1-changeset-release-main.1) potentially affected by CVE-2023-35926 via @backstage/plugin-scaffolder-backend (1.1.0)

@backstage/plugin-scaffolder-backend NPM version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-scaffolder-backend and may be impacted: - @frontside/backstage-plugin-humanitec-backend =0.1.0, =0.2.1-changeset-release-main.1...

GHSA-77FW-RF4V-VFP9 passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token

Information Please note that this is not a new disclosure, and is previously reported in our SECURITY-NOTICE.md which we removed in favor of github advisory. Overview This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity...

WordPress Mailtree Log Mail Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Mailtree Log Mail Type Plugin Vulnerable versions = 1.0.0 Fixed in 1.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3135 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID e74e0d24830e Credits Alex Thomas Required...

WordPress PrePost SEO Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)

Software PrePost SEO Type Plugin Vulnerable versions = 3.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2029 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b6a7fe38984b Credits Taurus Omar Required privilege...

WordPress WPForms Pro Plugin <= 1.8.1.2 is vulnerable to Cross Site Scripting (XSS)

Software WPForms Pro Type Plugin Vulnerable versions = 1.8.1.2 Fixed in 1.8.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30500 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID cfb1df78124a Credits Rafie Muhammad Patchsta...

WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce Payments Type Plugin Vulnerable versions = 5.9.0 Fixed in 5.9.1 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-35916 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID e4c9d390a631 Credits Rafie...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (IDOR)

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-23679 Patch priority Low CVSS severity Low 4.6 Developer Claim ownership PSID...

WordPress Complianz Premium Plugin <= 6.4.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Complianz Premium Type Plugin Vulnerable versions = 6.4.7 Fixed in 6.4.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-34030 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8ec92260cc85 Credits Rafie Muhammad...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.65 is vulnerable to Broken Access Control

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.65 Fixed in 1.5.66 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-31080 Patch priority Low CVSS severity Low 8.3 Developer Unlimited Elements...

WordPress WPBakery Page Builder Plugin < 6.13.0 is vulnerable to Cross Site Scripting (XSS)

Software WPBakery Page Builder Type Plugin Vulnerable versions 6.13.0 Fixed in 6.13.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-31213 Patch priority Low CVSS severity Low 6.5 Developer WPBakery PSID bf3507e23c25 Credits Rafie Muhammad Patchstac...

WordPress SupportCandy Plugin < 3.1.7 is vulnerable to SQL Injection

Software SupportCandy Type Plugin Vulnerable versions 3.1.7 Fixed in 3.1.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2719 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID c15c7e980643 Credits dc11 Required privilege Subscriber Published 19 June,...

WordPress Super Socializer Plugin < 7.13.52 is vulnerable to Cross Site Scripting (XSS)

Software Super Socializer Type Plugin Vulnerable versions 7.13.52 Fixed in 7.13.52 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2779 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e9ffcc5c9c45 Credits 40826d Required...

WordPress SupportCandy Plugin < 3.1.7 is vulnerable to SQL Injection

Software SupportCandy Type Plugin Vulnerable versions 3.1.7 Fixed in 3.1.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2805 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID a697ebaed446 Credits dc11 Required privilege Administrator Published 19 June...

WordPress Integration for Contact Form 7 and Zoho CRM, Bigin Plugin < 1.2.4 is vulnerable to SQL Injection

Software Integration for Contact Form 7 and Zoho CRM, Bigin Type Plugin Vulnerable versions 1.2.4 Fixed in 1.2.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2527 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 02c04fb3e5d2 Credits Chien Vuong...

WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection

Software Dokan Type Plugin Vulnerable versions = 3.7.19 Fixed in 3.7.20 OWASP Top 10 A8: Insecure Deserialization Classification PHP Object Injection CVE CVE-2023-34382 Patch priority Medium CVSS severity Medium 4.4 Developer Claim ownership PSID e06401ebc804 Credits Theodoros Malachias Required...

WordPress WP Custom Cursors Plugin < 3.2 is vulnerable to SQL Injection

Software WP Custom Cursors Type Plugin Vulnerable versions 3.2 Fixed in 3.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2221 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 57dc3e3d3d93 Credits Chien Vuong Required privilege Administrator Published...

WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)

Software EventPrime Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-35884 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0d78f3844de4 Credits Le Ngoc Anh Required...

WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Brands Type Plugin Vulnerable versions = 1.6.49 Fixed in 1.6.50 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-35880 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f5fc6ab7da71 Credits Rafie Muhammad...

WordPress WP Backup Manager Plugin <= 1.13.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Backup Manager Type Plugin Vulnerable versions = 1.13.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-35775 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 619985be1143 Credits Le Ngoc Anh...