WordPress Football Pool Plugin <= 2.11.3 is vulnerable to Cross Site Scripting (XSS)

Software Football Pool Type Plugin Vulnerable versions = 2.11.3 Fixed in 2.11.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 55a90c79eb31 Credits WordFence Required privilege...

WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Broken Access Control

Software MailerLite – WooCommerce integration Type Plugin Vulnerable versions = 2.0.8 Fixed in 2.0.9 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52227 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ca57f2fa08b6 Credits Abdi...

WordPress WPvivid Backup and Migration Plugin <= 0.9.68 is vulnerable to Broken Access Control

Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.68 Fixed in 0.9.69 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1982 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79947c67cdef Credits Denis Werner...

PT-2024-1060 · Totolink · Totolink Lr1200Gb

Name of the Vulnerable Software and Affected Versions: Totolink LR1200GB version 9.1.0u.6619 B20230130 Description: A critical vulnerability exists in the setOpModeCfg function of the /cgi-bin/cstecgi.cgi file due to the lack of neutralization of special elements. This allows a remote attacker to...

CVE-2023-52125

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webvitaly iframe allows Stored XSS.This issue affects iframe: from n/a through 4.8...

WordPress Wp Ultimate Review Plugin <= 2.3.5 is vulnerable to Bypass Vulnerability

Software Wp Ultimate Review Type Plugin Vulnerable versions = 2.3.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Bypass Vulnerability CVE CVE-2024-21746 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a561906d804e Credits Mika Required privilege...

Thrive Automator < 1.17.1 - Cross-Site Request Forgery

Description The Thrive Automator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.17. This is due to missing or incorrect nonce validation on the factoryreset function. This makes it possible for unauthenticated attackers to reset plugin setting...

WordPress WP Job Manager Plugin <= 2.0.0 is vulnerable to Broken Access Control

Software WP Job Manager Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.1.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52211 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID dca091e30b7d Credits Rafie Muhammad Patchstack...

WordPress Booster Plus for WooCommerce Plugin < 7.1.3 is vulnerable to Sensitive Data Exposure

Software Booster Plus for WooCommerce Type Plugin Vulnerable versions 7.1.3 Fixed in 7.1.3 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-52230 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 715c035601b4 Credits Dave Jong...

WordPress Quiz Maker Plugin <= 6.5.1.1 is vulnerable to Broken Access Control

Software Quiz Maker Type Plugin Vulnerable versions = 6.5.1.1 Fixed in 6.5.1.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-21743 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a1ecb2fb052d Credits Abdi Pranata Required...

Rate my Post < 3.4.3 - IP Spoofing

Description The Rate my Post – WP Rating System plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 3.4.2 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method for IP retrieval. This makes it possible for...

PT-2024-15065 · WordPress · Wp-Members Membership Plugin

Name of the Vulnerable Software and Affected Versions: WP-Members Membership Plugin versions up to, and including, 3.4.8 Description: The issue allows authenticated attackers with contributor access and above to extract sensitive data, including user emails, password hashes, and usernames, via th...

@clevercanyon/dev-deps (>=1.0.274, <=1.0.287), @flare-city/test (>=0.2.0, <=0.4.3) potentially affected by CVE-2023-7080 via wrangler (>=3.15.0, <=3.18.0)

wrangler NPM version =3.15.0, =1.0.274, =0.2.0, =0.4.3 Source cves: CVE-2023-7080 Source advisory: OSV:GHSA-F8MP-X433-5WPF...

WordPress HTML5 SoundCloud Player Plugin <= 2.8.0 is vulnerable to PHP Object Injection

Software HTML5 SoundCloud Player Type Plugin Vulnerable versions = 2.8.0 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-52205 Patch priority High CVSS severity High 9.1 Developer Claim ownership PSID 39ab4c99fd96 Credits Rafie Muhammad Patchstack Required...

WordPress Product Delivery Date for WooCommerce – Lite Plugin <= 2.7.0 is vulnerable to Broken Access Control

Software Product Delivery Date for WooCommerce – Lite Type Plugin Vulnerable versions = 2.7.0 Fixed in 2.7.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-52210 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 8dcb0e332619 Credits...

WordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder: Live Composer Type Plugin Vulnerable versions = 1.5.23 Fixed in 1.5.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52193 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 70cd66e65bfa Credits Ngô Thiên An ancorn from...

WordPress FooGallery Premium Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software FooGallery Premium Type Plugin Vulnerable versions = 2.3.3 Fixed in 2.4.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6747 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6e234ed1eb7c Credits WordFence Required...

WordPress Post SMTP Plugin <= 2.8.7 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7027 Patch priority Medium CVSS severity Medium 7.1 Developer WPExperts PSID 7142ca21bf69 Credits Sean Murphy Required privilege...

WordPress Randomize Plugin <= 1.4.3 is vulnerable to SQL Injection

Software Randomize Type Plugin Vulnerable versions = 1.4.3 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-52204 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 05d6b2da1650 Credits Ngô Thiên An ancorn from VNPT-VCI Required privilege...

WordPress Coupon Referral Program Plugin <= 1.7.2 is vulnerable to Sensitive Data Exposure

Software Coupon Referral Program Type Plugin Vulnerable versions = 1.7.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-52190 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 3514be0010e5 Credits Dave Jong Patchstac...