WordPress ACF Photo Gallery Field Plugin <= 2.6 is vulnerable to Broken Access Control

Software ACF Photo Gallery Field Type Plugin Vulnerable versions = 2.6 Fixed in 2.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-23518 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 90b02382eae5 Credits Abdi Pranata Required...

WordPress WP GDPR Compliance Plugin <= 2.0.22 is vulnerable to Broken Access Control

Software WP GDPR Compliance Type Plugin Vulnerable versions = 2.0.22 Fixed in 2.0.23 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6700 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6a981b3b2d5a Credits Lucio Sá Required...

WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection

Software ProductX – Gutenberg WooCommerce Blocks Type Plugin Vulnerable versions = 3.1.4 Fixed in 3.1.5 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-23512 Patch priority High CVSS severity High 8.7 Developer Claim ownership PSID fa4448964e74 Credits Yudistira Arya...

WordPress Formidable Forms Plugin <= 6.7.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Formidable Forms Type Plugin Vulnerable versions = 6.7.2 Fixed in 6.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0660 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7a7ac0638cbc Credits Webbernaut Required...

WordPress Simple Shopping Cart Plugin <= 4.7.1 is vulnerable to Cross Site Scripting (XSS)

Software Simple Shopping Cart Type Plugin Vulnerable versions = 4.7.1 Fixed in 4.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6497 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b281d4b588f2 Credits Webbernaut Required...

WordPress Instant Images Plugin <= 6.1.0 is vulnerable to Broken Access Control

Software Instant Images Type Plugin Vulnerable versions = 6.1.0 Fixed in 6.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-0869 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 5f84c56450a0 Credits Sean Murphy Required...

PT-2024-20154 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A Cross-Site Scripting XSS issue has been reported, resulting from insufficient encoding of user-controlled inputs. This can be exploited via the /cupseasylive/countrymodify.php endpoint...

CloudLinux CageFS 7.1.1-1 Token Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 CloudLinux CageFS Token Disclosure Link: https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-01CloudLinuxCageFSTokenDisclosure Vulnerability Overview CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a...

PT-2024-20133 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A vulnerability has been reported in Cups Easy Purchase & Inventory whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via...

WordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)

Software PDF Poster - PDF Embedder Plugin for WordPress Type Plugin Vulnerable versions = 2.1.17 Fixed in 2.1.18 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-23508 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 77b3bf7aca30 Credits Le Ng...

WordPress Category Discount Woocommerce Plugin <= 4.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software Category Discount Woocommerce Type Plugin Vulnerable versions = 4.11 Fixed in 4.12 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0617 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID cff1c97352ca Credits Krzyszto...

WordPress Category Discount Woocommerce Plugin <= 4.12 is vulnerable to Broken Access Control

Software Category Discount Woocommerce Type Plugin Vulnerable versions = 4.12 Fixed in 4.13 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0617 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 26f9aa0c44b8 Credits Krzysztof Zając...

WordPress File Manager Plugin <= 7.2.1 is vulnerable to Sensitive Data Exposure

Software File Manager Type Plugin Vulnerable versions = 7.2.1 Fixed in 7.2.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-0761 Patch priority Low CVSS severity Low 8.1 Developer Claim ownership PSID 8a9bf85057b9 Credits Yuki Haruma Required privileg...

WordPress PDF Generator For Fluent Forms Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

Software PDF Generator For Fluent Forms Type Plugin Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6953 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f3bea2a974ac Credits drop...

WordPress VK Block Patterns Plugin <= 1.31.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software VK Block Patterns Type Plugin Vulnerable versions = 1.31.1.1 Fixed in 1.31.2.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0623 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a3d90060aab6 Credits kodaichodai...

WordPress Filebird Plugin <= 5.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Filebird Type Plugin Vulnerable versions = 5.6.0 Fixed in 5.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0691 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 80c98e521f35 Credits Thomas Sanzey Required privileg...

PeepSo Core: Photos < 6.3.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Description The PeepSo Core: Photos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to 6.3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirection

Software Simple Membership Type Plugin Vulnerable versions = 4.4.1 Fixed in 4.4.2 OWASP Top 10 A4: Insecure Design Classification Open Redirection CVE CVE-2024-22308 Patch priority Low CVSS severity Low 3.4 Developer Claim ownership PSID e9d8815a7ad6 Credits Joshua Chan Required privilege...

WordPress Stripe Payment Gateway for WooCommerce Plugin <= 3.7.9 is vulnerable to SQL Injection

Software Stripe Payment Gateway for WooCommerce Type Plugin Vulnerable versions = 3.7.9 Fixed in 3.8.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0705 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 8c922733cce2 Credits Francesco Carlucci Requir...

CVE-2023-50030

In the module "Jms Setting" jmssetting from Joommasters for PrestaShop, a guest can perform SQL injection in versions = 1.1.0. The method JmsSetting::getSecondImgs has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a blind SQL injection...