WordPress RSS Aggregator by Feedzy Plugin <= 4.3.2 is vulnerable to Cross Site Scripting (XSS)

Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions = 4.3.2 Fixed in 4.3.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6801 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7b021f6dbd31 Credits Colin Xu Requir...

WordPress Advanced Flamingo Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Advanced Flamingo Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-52226 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c7da797f1ed4 Credits Huynh Tien Si Require...

WordPress Oxygen Builder Plugin <= 4.8 is vulnerable to Cross Site Scripting (XSS)

Software Oxygen Builder Type Plugin Vulnerable versions = 4.8 Fixed in 4.8.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6938 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5b6e074aaeac Credits Francesco Carlucci Required...

WordPress Profile Builder Plugin <= 3.10.7 is vulnerable to Insecure Direct Object References (IDOR)

Software Profile Builder Type Plugin Vulnerable versions = 3.10.7 Fixed in 3.10.8 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-6504 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4a72357868f4 Credits Francesco...

WordPress WPvivid Backup and Migration Plugin <= 0.9.68 is vulnerable to Broken Access Control

Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.68 Fixed in 0.9.69 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1982 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79947c67cdef Credits Denis Werner...

WordPress Football Pool Plugin <= 2.11.3 is vulnerable to Cross Site Scripting (XSS)

Software Football Pool Type Plugin Vulnerable versions = 2.11.3 Fixed in 2.11.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 55a90c79eb31 Credits WordFence Required privilege...

WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Broken Access Control

Software MailerLite – WooCommerce integration Type Plugin Vulnerable versions = 2.0.8 Fixed in 2.0.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52227 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ca57f2fa08b6 Credits Abdi...

PT-2024-1060 · Totolink · Totolink Lr1200Gb

Name of the Vulnerable Software and Affected Versions: Totolink LR1200GB version 9.1.0u.6619 B20230130 Description: A critical vulnerability exists in the setOpModeCfg function of the /cgi-bin/cstecgi.cgi file due to the lack of neutralization of special elements. This allows a remote attacker to...

CVE-2023-52125

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8...

WordPress Wp Ultimate Review Plugin <= 2.3.5 is vulnerable to Bypass Vulnerability

Software Wp Ultimate Review Type Plugin Vulnerable versions = 2.3.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Bypass Vulnerability CVE CVE-2024-21746 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a561906d804e Credits Mika Required privilege...

Thrive Automator < 1.17.1 - Cross-Site Request Forgery

Description The Thrive Automator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.17. This is due to missing or incorrect nonce validation on the factoryreset function. This makes it possible for unauthenticated attackers to reset plugin setting...

WordPress WP Job Manager Plugin <= 2.0.0 is vulnerable to Broken Access Control

Software WP Job Manager Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.1.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52211 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID dca091e30b7d Credits Rafie Muhammad Patchstack...

WordPress Quiz Maker Plugin <= 6.5.1.1 is vulnerable to Broken Access Control

Software Quiz Maker Type Plugin Vulnerable versions = 6.5.1.1 Fixed in 6.5.1.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-21743 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a1ecb2fb052d Credits Abdi Pranata Required...

WordPress Booster Plus for WooCommerce Plugin < 7.1.3 is vulnerable to Sensitive Data Exposure

Software Booster Plus for WooCommerce Type Plugin Vulnerable versions 7.1.3 Fixed in 7.1.3 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-52230 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 715c035601b4 Credits Dave Jong...

Rate my Post < 3.4.3 - IP Spoofing

Description The Rate my Post – WP Rating System plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 3.4.2 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for...

PT-2024-15065 · WordPress · Wp-Members Membership Plugin

Name of the Vulnerable Software and Affected Versions: WP-Members Membership Plugin versions up to, and including, 3.4.8 Description: The issue allows authenticated attackers with contributor access and above to extract sensitive data, including user emails, password hashes, and usernames, via th...

WordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.23 Fixed in 1.5.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52193 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 70cd66e65bfa Credits Ngô Thiên An ancorn from...

WordPress Product Delivery Date for WooCommerce – Lite Plugin <= 2.7.0 is vulnerable to Broken Access Control

Software Product Delivery Date for WooCommerce – Lite Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52210 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8dcb0e332619 Credits...

WordPress HTML5 SoundCloud Player Plugin <= 2.8.0 is vulnerable to PHP Object Injection

Software HTML5 SoundCloud Player Type Plugin Vulnerable versions = 2.8.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-52205 Patch priority High CVSS severity High 9.1 Developer Claim ownership PSID 39ab4c99fd96 Credits Rafie Muhammad Patchstack Required...

WordPress Post SMTP Plugin <= 2.8.7 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7027 Patch priority Medium CVSS severity Medium 7.1 Developer WPExperts PSID 7142ca21bf69 Credits Sean Murphy Required privilege...