WordPress PrePost SEO Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)

Software PrePost SEO Type Plugin Vulnerable versions = 3.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2029 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b6a7fe38984b Credits Taurus Omar Required privilege...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (IDOR)

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-23679 Patch priority Low CVSS severity Low 4.6 Developer Claim ownership PSID...

WordPress WPBakery Page Builder Plugin < 6.13.0 is vulnerable to Cross Site Scripting (XSS)

Software WPBakery Page Builder Type Plugin Vulnerable versions 6.13.0 Fixed in 6.13.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-31213 Patch priority Low CVSS severity Low 6.5 Developer WPBakery PSID bf3507e23c25 Credits Rafie Muhammad Patchstac...

WordPress WPForms Pro Plugin <= 1.8.1.2 is vulnerable to Cross Site Scripting (XSS)

Software WPForms Pro Type Plugin Vulnerable versions = 1.8.1.2 Fixed in 1.8.1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30500 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID cfb1df78124a Credits Rafie Muhammad Patchsta...

WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)

Software WooCommerce Payments Type Plugin Vulnerable versions = 5.9.0 Fixed in 5.9.1 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-35916 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID e4c9d390a631 Credits Rafie...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.65 is vulnerable to Broken Access Control

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.65 Fixed in 1.5.66 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-31080 Patch priority Low CVSS severity Low 8.3 Developer Unlimited Elements...

WordPress Complianz Premium Plugin <= 6.4.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Complianz Premium Type Plugin Vulnerable versions = 6.4.7 Fixed in 6.4.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-34030 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8ec92260cc85 Credits Rafie Muhammad...

WordPress Super Socializer Plugin < 7.13.52 is vulnerable to Cross Site Scripting (XSS)

Software Super Socializer Type Plugin Vulnerable versions 7.13.52 Fixed in 7.13.52 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2779 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e9ffcc5c9c45 Credits 40826d Required...

WordPress Integration for Contact Form 7 and Zoho CRM, Bigin Plugin < 1.2.4 is vulnerable to SQL Injection

Software Integration for Contact Form 7 and Zoho CRM, Bigin Type Plugin Vulnerable versions 1.2.4 Fixed in 1.2.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2527 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 02c04fb3e5d2 Credits Chien Vuong...

WordPress SupportCandy Plugin < 3.1.7 is vulnerable to SQL Injection

Software SupportCandy Type Plugin Vulnerable versions 3.1.7 Fixed in 3.1.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2719 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID c15c7e980643 Credits dc11 Required privilege Subscriber Published 19 June,...

WordPress SupportCandy Plugin < 3.1.7 is vulnerable to SQL Injection

Software SupportCandy Type Plugin Vulnerable versions 3.1.7 Fixed in 3.1.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2805 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID a697ebaed446 Credits dc11 Required privilege Administrator Published 19 June...

WordPress WP Custom Cursors Plugin < 3.2 is vulnerable to SQL Injection

Software WP Custom Cursors Type Plugin Vulnerable versions 3.2 Fixed in 3.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2221 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 57dc3e3d3d93 Credits Chien Vuong Required privilege Administrator Published...

WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)

Software WooCommerce Brands Type Plugin Vulnerable versions = 1.6.49 Fixed in 1.6.50 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-35880 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f5fc6ab7da71 Credits Rafie Muhammad...

WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection

Software Dokan Type Plugin Vulnerable versions = 3.7.19 Fixed in 3.7.20 OWASP Top 10 A8: Insecure Deserialization Classification PHP Object Injection CVE CVE-2023-34382 Patch priority Medium CVSS severity Medium 4.4 Developer Claim ownership PSID e06401ebc804 Credits Theodoros Malachias Required...

WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)

Software EventPrime Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-35884 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0d78f3844de4 Credits Le Ngoc Anh Required...

WordPress WP Backup Manager Plugin <= 1.13.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Backup Manager Type Plugin Vulnerable versions = 1.13.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-35775 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 619985be1143 Credits Le Ngoc Anh...

WordPress Contact Form by WD Plugin <= 1.15.16 is vulnerable to Broken Access Control

Software Contact Form by WD Type Plugin Vulnerable versions = 1.15.16 Fixed in 1.15.17 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 1b7f926114eb Credits Unknown Required privilege...

PT-2023-21271 · Unknown · Shingo Intrepidity Plugin

Name of the Vulnerable Software and Affected Versions: Shingo Intrepidity plugin versions = 1.5.1 Description: The issue allows for Cross-Site Request Forgery CSRF which enables arbitrary file upload. Recommendations: For versions = 1.5.1, update to a version greater than 1.5.1 to resolve the iss...

Home Assistant < 0.57 XSS Vulnerability

Home Assistant is prone to a cross-site scription XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2023-34620

An issue was discovered hjson thru 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies...