WordPress Standout Color Boxes and Buttons Plugin <= 0.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Standout Color Boxes and Buttons Type Plugin Vulnerable versions = 0.7.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2474 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID cbc359b9c82d Credits Francesco...

PT-2024-20867

Name of the Vulnerable Software and Affected Versions REBUILD version 3.5 Description The issue allows a remote attacker to obtain sensitive information and execute arbitrary code. This is achieved via the FileDownloader.java and the proxyDownload and URL parameters. Recommendations For REBUILD...

WordPress GamiPress – Button Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software GamiPress – Button Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2460 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 46fbe1f93240 Credits Francesco Carlucci...

WordPress Live Sales Notification for Woocommerce - Woomotiv Plugin <= 3.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Live Sales Notification for Woocommerce - Woomotiv Type Plugin Vulnerable versions = 3.4.3 Fixed in 3.5.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1325 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Coming Soon & Maintenance Mode by Colorlib Plugin <= 1.0.99 is vulnerable to Sensitive Data Exposure

Software Coming Soon & Maintenance Mode by Colorlib Type Plugin Vulnerable versions = 1.0.99 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-1473 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d883bd9e9110 Credits...

WordPress Weglot Translate Plugin <= 4.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Weglot Translate Type Plugin Vulnerable versions = 4.2.5 Fixed in 4.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2124 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ff81bdc0a325 Credits Ngô Thiên An ancorn -...

WordPress Permalink Manager Lite Plugin <= 2.4.3.1 is vulnerable to Broken Access Control

Software Permalink Manager Lite Type Plugin Vulnerable versions = 2.4.3.1 Fixed in 2.4.3.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-2538 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID 50143df9543f Credits Muhammad Zeeshan...

WordPress Enjoy Social Feed plugin for WordPress website Plugin <= 6.2.2 is vulnerable to Broken Access Control

Software Enjoy Social Feed plugin for WordPress website Type Plugin Vulnerable versions = 6.2.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-0780 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0adff21e032c...

WordPress PowerPack Lite for Beaver Builder Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software PowerPack Lite for Beaver Builder Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2289 Patch priority Low CVSS severity Low 6.5 Developer IdeaBox Creations PSID 9d2284f4a282 Credits...

WordPress Enjoy Social Feed plugin for WordPress website Plugin <= 6.2.2 is vulnerable to Broken Access Control

Software Enjoy Social Feed plugin for WordPress website Type Plugin Vulnerable versions = 6.2.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-0779 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e8f7d1a904c7 Credits...

Progress Flowmon Local sudo privilege escalation

This module abuses a feature of the sudo command on Progress Flowmon. Certain binary files are allowed to automatically elevate with the sudo command. This is based off of the file name. This includes executing a PHP command with a specific file name. If the file is overwritten with PHP code it c...

WordPress Innovs HR Plugin <= 1.0.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Innovs HR Type Plugin Vulnerable versions = 1.0.3.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-0858 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 1fae1c140215 Credits Sushil Phuyal Required...

PT-2024-2236 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability. This vulnerability could be exploited by an attacker to inject malicious scripts into vulnerable form...

WordPress Ultimate Gift Cards For WooCommerce Plugin <= 2.6.6 is vulnerable to Broken Access Control

Software Ultimate Gift Cards For WooCommerce Type Plugin Vulnerable versions = 2.6.6 Fixed in 2.6.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1857 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID ac4726115ec6 Credits Krzysztof...

WordPress Passwordless Login Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Passwordless Login Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29143 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 31d1f299fb2a Credits stealthcopter Required privilege...

WordPress MyCurator Content Curation Plugin <= 3.76 is vulnerable to Cross Site Scripting (XSS)

Software MyCurator Content Curation Type Plugin Vulnerable versions = 3.76 Fixed in 3.77 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29139 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f5416935cfa3 Credits LVT-tholv2k Required...

WordPress Simple Job Board Plugin <= 2.11.0 is vulnerable to PHP Object Injection

Software Simple Job Board Type Plugin Vulnerable versions = 2.11.0 Fixed in 2.11.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-1813 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 0f7bf0484277 Credits Francesco Carlucci Required privilege...

WordPress Advanced Access Manager Plugin <= 6.9.20 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Access Manager Type Plugin Vulnerable versions = 6.9.20 Fixed in 6.9.21 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29124 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bab97a68bf4d Credits Delbert Giovanni Lie Require...

WordPress Post SMTP Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.8.6 Fixed in 2.8.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29128 Patch priority Medium CVSS severity Medium 7.1 Developer WPExperts PSID d4415453cdb3 Credits Le Ngoc Anh Required privilege Unauthenticat...

WordPress WooCommerce License Manager Plugin <= 5.3.1 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce License Manager Type Plugin Vulnerable versions = 5.3.1 Fixed in 5.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29121 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ebf509e643b0 Credits Dave Jong Patchstack...