PT-2023-27324 · WordPress · Wp 404 Auto Redirect To Similar Post

Name of the Vulnerable Software and Affected Versions: hwk-fr WP 404 Auto Redirect to Similar Post plugin versions 1.0.3 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject...

WordPress Export Import Menus Plugin <= 1.8.0 is vulnerable to Arbitrary File Upload

Software Export Import Menus Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.9.0 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Upload CVE CVE-2023-34385 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 784df5b05bad Credits Emili Castells...

WordPress WP Pipes Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Pipes Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.4.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-40009 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID a9072585c12c Credits Nguyen Xuan Chien Required...

WordPress User Feedback Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software User Feedback Type Plugin Vulnerable versions = 1.0.7 Fixed in 1.0.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-39308 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4cad82df326d Credits Revan Arifio Required privilege...

WordPress WooCommerce Conversion Tracking Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Conversion Tracking Type Plugin Vulnerable versions = 2.0.10 Fixed in 2.0.11 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4ebb849878be Credits...

WordPress Product Category Showcase for WooCommerce Plugin <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software Product Category Showcase for WooCommerce Type Plugin Vulnerable versions = 1.1.9 Fixed in 2.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e261a353a568...

WordPress Legal Pages Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Legal Pages Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.4.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 46f7055dfcca Credits István Márton Required...

WordPress WordPress CTA Plugin <= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software WordPress CTA Type Plugin Vulnerable versions = 1.5.8 Fixed in 1.5.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e01853618b33 Credits István Márton Require...

WordPress Goods Catalog Plugin <= 2.4.1 is vulnerable to Cross Site Scripting (XSS)

Software Goods Catalog Type Plugin Vulnerable versions = 2.4.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41687 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f4c4ed84d022 Credits Abdi Pranata Required...

WordPress GiveWP Plugin <= 2.33.0 is vulnerable to Privilege Escalation

Software GiveWP Type Plugin Vulnerable versions = 2.33.0 Fixed in 2.33.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-41665 Patch priority High CVSS severity High 7.2 Developer Liquid Web / StellarWP PSID db573163f3a2 Credits Rafie...

PT-2023-25420 · Smanga · Smanga

Name of the Vulnerable Software and Affected Versions: smanga versions 3.1.9 and earlier Description: The issue allows remote attackers to execute arbitrary code and gain sensitive information. This is achieved via the mediaId, mangaId, and userId parameters in the "php/history/add.php" endpoint...

WordPress Prevent files / folders access Plugin < 2.5.2 is vulnerable to Arbitrary File Upload

Software Prevent files / folders access Type Plugin Vulnerable versions 2.5.2 Fixed in 2.5.2 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-4238 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID e9cca307cf55 Credits Dmitrii Required privilege...

WordPress Ovic Product Bundle Plugin <= 1.1.2 is vulnerable to Broken Access Control

Software Ovic Product Bundle Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-41649 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 75cf7d8a70bd Credits thiennv Required...

WordPress Surfer Plugin <= 1.3.2.357 is vulnerable to Broken Access Control

Software Surfer Type Plugin Vulnerable versions = 1.3.2.357 Fixed in 1.3.3.379 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-35037 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID fee59b89530e Credits Jonas Höbenreich Required...

PT-2023-30296 · Infosoftbd · Infosoftbd Clcknshop

Name of the Vulnerable Software and Affected Versions: Infosoftbd Clcknshop version 1.0.0 Description: A vulnerability was found in Infosoftbd Clcknshop, affecting unknown code of the file /collection/all. The manipulation of the argument q leads to cross site scripting. The attack can be initiat...

WordPress WP Bannerize Pro Plugin <= 1.6.9 is vulnerable to Cross Site Scripting (XSS)

Software WP Bannerize Pro Type Plugin Vulnerable versions = 1.6.9 Fixed in 1.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-41663 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 77839e376c07 Credits thiennv Required...

WordPress Easy Newsletter Signups Plugin <= 1.0.4 is vulnerable to Broken Access Control

Software Easy Newsletter Signups Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-41664 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 31ca0e95e8ca Credits Emili Castells...

WordPress Login and Logout Redirect Plugin <= 2.0.3 is vulnerable to Open Redirection

Software Login and Logout Redirect Type Plugin Vulnerable versions = 2.0.3 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Open Redirection CVE CVE-2023-41648 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 07efb9e4b4dc Credits Phd Required privilege...

CVE-2023-4109

The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability...

WordPress All-in-One WP Migration Google Drive Extension Plugin <= 2.79 is vulnerable to Broken Access Control

Software All-in-One WP Migration Google Drive Extension Type Plugin Vulnerable versions = 2.79 Fixed in 2.80 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40004 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID a77f536f8693 Credit...