WordPress XStore Theme <= 9.3.8 is vulnerable to SQL Injection

Software XStore Type Theme Vulnerable versions = 9.3.8 Fixed in 9.3.9 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-33559 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 0996b4472188 Credits Rafie Muhammad Patchstack Required privilege...

WordPress WPZOOM Addons for Elementor (Templates, Widgets) Plugin <=1.1.35 is vulnerable to Cross Site Scripting (XSS)

Software WPZOOM Addons for Elementor Templates, Widgets Type Plugin Vulnerable versions =1.1.35 Fixed in 1.1.36 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33539 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b7165a318ab9 Credits Khalid...

WordPress Opal Widgets For Elementor Plugin <= 1.6.9 is vulnerable to Cross Site Scripting (XSS)

Software Opal Widgets For Elementor Type Plugin Vulnerable versions = 1.6.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33649 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 22d8c47253d0 Credits Khalid Yusuf Required privile...

WordPress Popup box Plugin <= 4.3.6 is vulnerable to Broken Access Control

Software Popup box Type Plugin Vulnerable versions = 4.3.6 Fixed in 4.3.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3897 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a8831019ec23 Credits Krzysztof Zając Required privilege...

PT-2024-4195 · Unknown +2 · Python-Jose +2

Name of the Vulnerable Software and Affected Versions: python-jose versions 3.3.0 and earlier Description: The issue is related to algorithm confusion with OpenSSH ECDSA keys and other key formats in the python-jose component. It is associated with the definition of a prefix blacklist for OpenSSH...

WordPress Simple Membership Plugin <= 4.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Simple Membership Type Plugin Vulnerable versions = 4.4.3 Fixed in 4.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3730 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a1a8cd538bfd Credits Thanh Nam Tran Require...

WordPress Sticky Anything Plugin <= 2.1.5 is vulnerable to Broken Access Control

Software Sticky Anything Type Plugin Vulnerable versions = 2.1.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33646 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID da01f8f0e18d Credits Dimas Maulana Required...

WordPress WZone Plugin <= 14.0.33 is vulnerable to Cross Site Scripting (XSS)

Software WZone Type Plugin Vulnerable versions = 14.0.33 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33548 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 056b1a28280e Credits Rafie Muhammad Patchstack Required privile...

WordPress WZone Plugin <= 14.0.10 is vulnerable to SQL Injection

Software WZone Type Plugin Vulnerable versions = 14.0.10 Fixed in 14.0.31 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-33544 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 102966976300 Credits Rafie Muhammad Patchstack Required privilege...

WordPress Pretty Google Calendar Plugin <= 1.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Pretty Google Calendar Type Plugin Vulnerable versions = 1.7.2 Fixed in 2.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33640 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e6c5ddcc221c Credits LVT-tholv2k Required privilege...

WordPress SSU Plugin <= 1.5.0 is vulnerable to Broken Access Control

Software SSU Type Plugin Vulnerable versions = 1.5.0 Fixed in 1.5.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33597 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID d4a0eaecd496 Credits Mika Required privilege Unauthenticated...

WordPress Smart Forms Plugin <= 2.6.91 is vulnerable to Broken Access Control

Software Smart Forms Type Plugin Vulnerable versions = 2.6.91 Fixed in 2.6.92 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33593 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 810e0b29d7f7 Credits Dhabaleshwar Das Required...

WordPress Element Pack Pro Plugin <= 7.7.4 is vulnerable to Arbitrary File Download

Software Element Pack Pro Type Plugin Vulnerable versions = 7.7.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-33568 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 6b262cd1989a Credits Rafie Muhammad Patchstack...

WordPress Piotnet Addons For Elementor Pro Plugin <= 7.1.17 is vulnerable to Server Side Request Forgery (SSRF)

Software Piotnet Addons For Elementor Pro Type Plugin Vulnerable versions = 7.1.17 Fixed in N/A OWASP Top 10 A3: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-33634 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID fd220e386df6 Credits Dave Jong...

WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.8.0 is vulnerable to Server Side Request Forgery (SSRF)

Software WooCommerce PDF Invoices & Packing Slips Type Plugin Vulnerable versions = 3.8.0 Fixed in 3.8.1 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-3047 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 6d237d7ae9e9 Credits...

WordPress Classified Listing Plugin <= 3.0.10.3 is vulnerable to Broken Access Control

Software Classified Listing Type Plugin Vulnerable versions = 3.0.10.3 Fixed in 3.0.11 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3893 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 79fa3de2925e Credits Lucio Sá Required...

WordPress Instant Images Plugin <= 6.1.0 is vulnerable to Privilege Escalation

Software Instant Images Type Plugin Vulnerable versions = 6.1.0 Fixed in 6.1.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-33569 Patch priority High CVSS severity High 7.2 Developer Claim ownership PSID d731bc7eedd6 Credits Rafie...

WordPress Five Star Restaurant Reservations Plugin <= 2.6.16 is vulnerable to Broken Access Control

Software Five Star Restaurant Reservations Type Plugin Vulnerable versions = 2.6.16 Fixed in 2.6.17 OWASP Top 10 A4: Insecure Design Classification Broken Access Control CVE CVE-2024-33596 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d75b86943c20 Credits Steven Julian...

WordPress Advanced Post List Plugin <= 0.5.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Post List Type Plugin Vulnerable versions = 0.5.6.1 Fixed in 0.5.6.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33642 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 93b608a88e7f Credits emad Required privilege...

WordPress Piotnet Addons For Elementor Pro Plugin <= 7.1.17 is vulnerable to Cross Site Scripting (XSS)

Software Piotnet Addons For Elementor Pro Type Plugin Vulnerable versions = 7.1.17 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33631 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8cfe79b45474 Credits Dave Jong Patchstack...