5860 matches found
WordPress SendPress Newsletters Plugin <= 1.22.3.31 is vulnerable to Cross Site Scripting (XSS)
Software SendPress Newsletters Type Plugin Vulnerable versions = 1.22.3.31 Fixed in 1.23.11.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5660 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID faf50926089e Credits István...
WordPress Greenshift – animation and page builder blocks Plugin <= 7.6.2 is vulnerable to Arbitrary File Upload
Software Greenshift – animation and page builder blocks Type Plugin Vulnerable versions = 7.6.2 Fixed in 7.6.3 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6636 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 9779b32b5fc5 Credits István Márt...
WordPress CAOS | Host Google Analytics Locally Plugin <= 4.7.14 is vulnerable to Broken Access Control
Software CAOS | Host Google Analytics Locally Type Plugin Vulnerable versions = 4.7.14 Fixed in 4.7.15 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6637 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 62929a294e3e Credits...
WordPress Import Export WordPress Users Plugin <= 2.4.8 is vulnerable to Arbitrary File Upload
Software Import Export WordPress Users Type Plugin Vulnerable versions = 2.4.8 Fixed in 2.4.9 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6558 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID a7515a768629 Credits István Márton Required...
Ovic Responsive WPBakery < 1.2.9 - Subscriber+ Option Update
Description The plugin does not limit which options can be updated via some of its AJAX actions, which may allow attackers with a subscriber+ account to update blog options, such as 'userscanregister' and 'defaultrole'. It also unserializes user input in the process, which may lead to Object...
CVE-2023-48641
Archer Platform 6.x before 6.14 P1 HF2 6.14.0.1.2 contains an insecure direct object reference vulnerability. An authenticated malicious user in a multi-instance installation could potentially exploit this vulnerability by manipulating application resource references in user requests to bypass...
PT-2023-7864 · Adobe · Experience Manager
Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form...
PT-2023-7715 · Adobe · Experience Manager
Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. This...
WordPress Import and export users and customers Plugin <= 1.24.2 is vulnerable to Path Traversal
Software Import and export users and customers Type Plugin Vulnerable versions = 1.24.2 Fixed in 1.24.3 OWASP Top 10 A5: Security Misconfiguration Classification Path Traversal CVE CVE-2023-6583 Patch priority Low CVSS severity Low 6.6 Developer Codection PSID c0a785f9e590 Credits Labda Required...
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
...
Sql injection
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 free and versions 1.4.0 to 1.5.0 pro due to insufficient escaping on the user supplied parameter and lack of sufficient...
WordPress Advanced Page Visit Counter Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)
Software Advanced Page Visit Counter Type Plugin Vulnerable versions = 8.0.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50371 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2d2c9790972e Credits Khalid Yusuf Required...
WordPress Custom Login Plugin <= 4.1.0 is vulnerable to Broken Access Control
Software Custom Login Type Plugin Vulnerable versions = 4.1.0 Fixed in 4.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49858 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 0dfaac0266be Credits Abdi Pranata Required...
WordPress Responsive Slick Slider WordPress Plugin <= 1.4 is vulnerable to Content Injection
Software Responsive Slick Slider WordPress Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-49852 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6149e117fdc9 Credits Abdi Pranata Required privilege...
WordPress Alt Manager Plugin <= 1.6.1 is vulnerable to Broken Access Control
Software Alt Manager Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-50373 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID d15fcb372f33 Credits Nguyen Xuan Chien Required...
WordPress Social Media Feather Plugin <= 2.1.3 is vulnerable to Broken Access Control
Software Social Media Feather Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49861 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID c21113708404 Credits Abdi Pranata...
WordPress Bacola Core Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)
Software Bacola Core Type Plugin Vulnerable versions = 1.3.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49839 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID d717888feaf6 Credits RE-ALTER Required privilege Unauthenticate...
WordPress Partdo Core Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)
Software Partdo Core Type Plugin Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49839 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 032d52a975bc Credits RE-ALTER Required privilege...
WordPress Redirects Plugin <= 1.2.1 is vulnerable to Broken Access Control
Software Redirects Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49845 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 303dca83d49a Credits Skalucy Required privilege...
