WordPress Honeypot for WP Comment Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Honeypot for WP Comment Type Plugin Vulnerable versions = 2.2.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24933 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 01642edd0b7b Credits Dimas Maulana Required...

WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS)

Software Brooklyn Type Theme Vulnerable versions = 4.9.7.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24927 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 61a468418831 Credits Rafie Muhammad Patchstack Required...

WordPress Royal Elementor Addons Plugin <= 1.3.87 is vulnerable to Cross Site Request Forgery (CSRF)

Software Royal Elementor Addons Type Plugin Vulnerable versions = 1.3.87 Fixed in 1.3.88 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0512 Patch priority Low CVSS severity Low 4.3 Developer WProyal PSID 883b845e41ec Credits Francesco Carlucci...

WordPress Simple Page Access Restriction Plugin <= 1.0.21 is vulnerable to Sensitive Data Exposure

Software Simple Page Access Restriction Type Plugin Vulnerable versions = 1.0.21 Fixed in 1.0.23 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-0965 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 09ce34b22c58 Credits Francesco...

WordPress Honeypot for WP Comment Plugin <= 2.2.3 is vulnerable to Arbitrary File Deletion

Software Honeypot for WP Comment Type Plugin Vulnerable versions = 2.2.3 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Arbitrary File Deletion CVE CVE-2024-1350 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 972e393f6005...

WordPress Royal Elementor Addons Plugin < 1.3.81 is vulnerable to Broken Access Control

Software Royal Elementor Addons Type Plugin Vulnerable versions 1.3.81 Fixed in 1.3.81 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5922 Patch priority Low CVSS severity Low 5.3 Developer WProyal PSID 2215bda637be Credits Krzysztof Zając CERT PL Require...

WordPress Shariff Wrapper Plugin < 4.6.10 is vulnerable to Cross Site Scripting (XSS)

Software Shariff Wrapper Type Plugin Vulnerable versions 4.6.10 Fixed in 4.6.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1106 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID da44df395b73 Credits Dmitrii Ignatyev Require...

sepidz SepidzDigitalMenu Information Disclosure Vulnerability

sepidz SepidzDigitalMenu is an electronic menu application. An information disclosure vulnerability exists in sepidz SepidzDigitalMenu version 7.1.0728.1 and prior versions. An attacker can exploit this vulnerability to obtain sensitive information...

TP-Link ER7206 Omada Gigabit VPN Router uhttpd ipsec command injection vulnerability

Talos Vulnerability Report TALOS-2023-1854 TP-Link ER7206 Omada Gigabit VPN Router uhttpd ipsec command injection vulnerability February 6, 2024 CVE Number CVE-2023-47209 SUMMARY A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada...

WordPress Elementor Addon Elements Plugin <= 1.12.11 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.12.11 Fixed in 1.12.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0834 Patch priority Low CVSS severity Low 6.5 Developer WPVibes PSID 65cab16f462f Credits Webbernaut Required...

WordPress Elementor Website Builder Plugin <= 3.19.0 is vulnerable to Arbitrary File Deletion

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.19.0 Fixed in 3.19.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-24934 Patch priority Low CVSS severity Low 8.5 Developer Elementor PSID 8c8af1fc63cc Credits Rhynorater Justin...

Cross site scripting

The Order Delivery Date for WP e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'available-days-tf' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-0668 Advanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action

The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via deserialization of untrusted input in the 'processbulkaction' function. This makes it possible for authenticated attacker, with administrator access and above, ...

WordPress Anonymous Restricted Content Plugin <= 1.6.2 is vulnerable to Bypass Vulnerability

Software Anonymous Restricted Content Type Plugin Vulnerable versions = 1.6.2 Fixed in 1.6.3 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-0909 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 3b50fe0358a1 Credits Francesco Carlucci...

WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF)

Software Link Library Type Plugin Vulnerable versions = 7.5.13 Fixed in 7.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24875 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 771a2cb13065 Credits Dhabaleshwar Das Requir...

WordPress LearnDash LMS Plugin <= 4.10.1 is vulnerable to Sensitive Data Exposure

Software LearnDash LMS Type Plugin Vulnerable versions = 4.10.1 Fixed in 4.10.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-1210 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID eac39e71b914 Credits Karl Emil Nikka Required...

WordPress LearnDash LMS Plugin <= 4.10.2 is vulnerable to Sensitive Data Exposure

Software LearnDash LMS Type Plugin Vulnerable versions = 4.10.2 Fixed in 4.10.3 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-1208 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 27fca665f224 Credits Karl Emil Nikka Required...

WordPress Product Labels For Woocommerce Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Product Labels For Woocommerce Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24886 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8481ba5af510 Credits Dhabaleshwar Das Requir...

WordPress CP Polls Plugin <= 1.0.71 is vulnerable to Content Injection

Software CP Polls Type Plugin Vulnerable versions = 1.0.71 Fixed in 1.0.72 OWASP Top 10 A5: Security Misconfiguration Classification Content Injection CVE CVE-2024-24874 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 01d54802a0ee Credits Kyle Sanchez Required privilege...

WordPress Easy Digital Downloads Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Easy Digital Downloads Type Plugin Vulnerable versions = 3.2.6 Fixed in 3.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0659 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ffe82c6fd12f Credits emad Required...