WordPress Memberpress Plugin <= 1.11.26 is vulnerable to Cross Site Scripting (XSS)

Software Memberpress Type Plugin Vulnerable versions = 1.11.26 Fixed in 1.11.27 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1412 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 44159653a377 Credits Jamie Perrelet...

PT-2024-22345 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A vulnerability has been found in DedeCMS, affecting unknown code of the file /src/dede/mda main.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has...

CVE-2023-48903

Stored Cross-Site Scripting XSS vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary web script or HTML within parameter "imgType" via in uploadCarImages.php...

WordPress Simply Schedule Appointments Plugin <= 1.6.7.7 is vulnerable to SQL Injection

Software Simply Schedule Appointments Type Plugin Vulnerable versions = 1.6.7.7 Fixed in 1.6.7.9 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-2342 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 36408cb83a66 Credits Krzysztof Zając Required privileg...

WordPress Simply Schedule Appointments Plugin <= 1.6.7.7 is vulnerable to SQL Injection

Software Simply Schedule Appointments Type Plugin Vulnerable versions = 1.6.7.7 Fixed in 1.6.7.9 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-2341 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 6389ada68f55 Credits Krzysztof Zając Required...

WordPress Travelpayouts Plugin <= 1.1.16 is vulnerable to Open Redirection

Software Travelpayouts Type Plugin Vulnerable versions = 1.1.16 Fixed in 1.1.17 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2024-0337 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 22ec7383525a Credits Krzysztof Zając CERT PL Required privilege...

WordPress Avada Theme <= 7.11.6 is vulnerable to Server Side Request Forgery (SSRF)

Software Avada Type Theme Vulnerable versions = 7.11.6 Fixed in 7.11.7 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-2343 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID b215d9a4cc5d Credits Muhammad Zeeshan Xib3rR4dAr Required...

WordPress System Dashboard Plugin < 2.8.10 is vulnerable to Cross Site Scripting (XSS)

Software System Dashboard Type Plugin Vulnerable versions 2.8.10 Fixed in 2.8.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7246 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 59b19780b836 Credits Dmitrii Ignatyev Requir...

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

WordPress Coming Soon & Maintenance Mode by Colorlib Plugin <= 1.0.99 is vulnerable to Sensitive Data Exposure

Software Coming Soon & Maintenance Mode by Colorlib Type Plugin Vulnerable versions = 1.0.99 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-1473 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d883bd9e9110 Credits...

WordPress Social Media Share Buttons Plugin <= 2.1.0 is vulnerable to PHP Object Injection

Software Social Media Share Buttons Type Plugin Vulnerable versions = 2.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-2721 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 6b7330720e7c Credits Dimas Maulana Required privilege...

PT-2024-20867

Name of the Vulnerable Software and Affected Versions REBUILD version 3.5 Description The issue allows a remote attacker to obtain sensitive information and execute arbitrary code. This is achieved via the FileDownloader.java and the proxyDownload and URL parameters. Recommendations For REBUILD...

WordPress Live Sales Notification for Woocommerce - Woomotiv Plugin <= 3.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Live Sales Notification for Woocommerce - Woomotiv Type Plugin Vulnerable versions = 3.4.3 Fixed in 3.5.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1325 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Standout Color Boxes and Buttons Plugin <= 0.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Standout Color Boxes and Buttons Type Plugin Vulnerable versions = 0.7.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2474 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cbc359b9c82d Credits Francesco...

WordPress Weglot Translate Plugin <= 4.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Weglot Translate Type Plugin Vulnerable versions = 4.2.5 Fixed in 4.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2124 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ff81bdc0a325 Credits Ngô Thiên An ancorn -...

WordPress GamiPress – Button Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software GamiPress – Button Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2460 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 46fbe1f93240 Credits Francesco Carlucci...

WordPress Enjoy Social Feed plugin for WordPress website Plugin <= 6.2.2 is vulnerable to Broken Access Control

Software Enjoy Social Feed plugin for WordPress website Type Plugin Vulnerable versions = 6.2.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-0780 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0adff21e032c...

WordPress Permalink Manager Lite Plugin <= 2.4.3.1 is vulnerable to Broken Access Control

Software Permalink Manager Lite Type Plugin Vulnerable versions = 2.4.3.1 Fixed in 2.4.3.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-2538 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID 50143df9543f Credits Muhammad Zeeshan...

WordPress PowerPack Lite for Beaver Builder Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software PowerPack Lite for Beaver Builder Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2289 Patch priority Low CVSS severity Low 6.5 Developer IdeaBox Creations PSID 9d2284f4a282 Credits...

WordPress Innovs HR Plugin <= 1.0.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Innovs HR Type Plugin Vulnerable versions = 1.0.3.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0858 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 1fae1c140215 Credits Sushil Phuyal Required...