WordPress Horizontal scrolling announcement Plugin <= 9.2 is vulnerable to SQL Injection

Software Horizontal scrolling announcement Type Plugin Vulnerable versions = 9.2 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-4999 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 360dd90299d7 Credits Lana Codes Required privilege...

WordPress Dropbox Folder Share Plugin <= 1.9.7 is vulnerable to Server Side Request Forgery (SSRF)

Software Dropbox Folder Share Type Plugin Vulnerable versions = 1.9.7 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Server Side Request Forgery SSRF CVE CVE-2023-3025 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID d1ee4d4ea4d2 Credits Alex...

Tenda AC10 Security Vulnerability

Tenda AC10 is a wireless router from Tenda China. A security vulnerability exists in the Tenda AC10V4 v.USAC10V4.0siV16.03.10.13cnTDC01 version, which originates from a vulnerability that allows remote attackers to cause a denial of service via the mac parameter in the GetParentControlInfo functi...

WordPress Testimonial Slider Shortcode Plugin < 1.1.9 is vulnerable to Cross Site Scripting (XSS)

Software Testimonial Slider Shortcode Type Plugin Vulnerable versions 1.1.9 Fixed in 1.1.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0cd9339aa1a8 Credits Unknown Required...

WordPress Essential Blocks Pro Plugin <= 1.1.0 is vulnerable to PHP Object Injection

Software Essential Blocks Pro Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-4386 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID b459be820fbe Credits Marco Wotschka Required privilege...

PT-2023-27985 · Unknown · Time To Sla Plugin

Name of the Vulnerable Software and Affected Versions: Time to SLA plugin version 10.13.5 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the durationFormat parameter. This enables the execution of malicio...

WordPress Essential Blocks for Gutenberg Plugin <= 4.2.0 is vulnerable to PHP Object Injection

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions = 4.2.0 Fixed in 4.2.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-4402 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 12450c59ad4b Credits Marco Wotschka Required...

WordPress WooCommerce EAN Payment Gateway Plugin < 6.1.0 is vulnerable to Broken Access Control

Software WooCommerce EAN Payment Gateway Type Plugin Vulnerable versions 6.1.0 Fixed in 6.1.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4947 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9bfa8f9c4e66 Credits Lana Codes Yan&C...

WordPress Dropbox Folder Share Plugin <= 1.9.7 is vulnerable to Local File Inclusion

Software Dropbox Folder Share Type Plugin Vulnerable versions = 1.9.7 Fixed in N/A OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-4488 Patch priority Low CVSS severity Low 9.8 Developer Claim ownership PSID 097b8d11ce41 Credits Marco Wotschka Required privilege...

WordPress WPvivid Backup and Migration Plugin <= 0.9.90 is vulnerable to Privilege Escalation

Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.90 Fixed in 0.9.91 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2023-41243 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID a9e2cd303432 Credits Nguyen Anh Ti...

WordPress Simplr Registration Form Plus+ Plugin <= 2.4.5 is vulnerable to Insecure Direct Object References (IDOR)

Software Simplr Registration Form Plus+ Type Plugin Vulnerable versions = 2.4.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-4213 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 210dacee25d7 Credits...

Cross site scripting

The JQuery Accordion Menu Widget for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

WordPress Herd Effects Plugin < 5.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Herd Effects Type Plugin Vulnerable versions 5.2.3 Fixed in 5.2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4022 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID fe54b6fbdb79 Credits Bob Matyas Required privilege...

WordPress ProfilePress Plugin <= 4.13.1 is vulnerable to Broken Access Control

Software ProfilePress Type Plugin Vulnerable versions = 4.13.1 Fixed in 4.13.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-41953 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5739c8dcaf0e Credits Abdi Pranata Required privileg...

WordPress Staff / Employee Business Directory for Active Directory Plugin < 1.2.3 is vulnerable to Broken Access Control

Software Staff / Employee Business Directory for Active Directory Type Plugin Vulnerable versions 1.2.3 Fixed in 1.2.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-4757 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 41d386a4513c...

GHSA-RXGF-R843-G53H hutool Buffer Overflow vulnerability

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray...

WordPress My Account Page Editor for Woocommerce Plugin < 1.3.2 is vulnerable to Arbitrary File Upload

Software My Account Page Editor for Woocommerce Type Plugin Vulnerable versions 1.3.2 Fixed in 1.3.2 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-4536 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 67cdcd9b4665 Credits Alexander Concha...

ethyca-fides (>=2.10.0 <=2.18.0) potentially affected by CVE-2023-41050 via accesscontrol (=6.0.0)

accesscontrol PYPI version =6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on accesscontrol and may be impacted: - ethyca-fides =2.10.0, =2.18.0 Source cves: CVE-2023-41050 Source advisory: OSV:GHSA-8XV7-89VJ-Q48C...

WordPress Laposta Signup Embed Plugin < 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Laposta Signup Embed Type Plugin Vulnerable versions 1.1.1 Fixed in 1.1.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a512250807f5 Credits Unknown Required privilege...

WordPress Media Library Assistant Plugin <= 3.09 is vulnerable to Remote Code Execution (RCE)

Software Media Library Assistant Type Plugin Vulnerable versions = 3.09 Fixed in 3.10 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-4634 Patch priority High CVSS severity High 10 Developer Claim ownership PSID a9f84b644a17 Credits Pepitoh Required privilege...