WordPress PowerPress Podcasting Plugin <= 10.2.3 is vulnerable to Cross Site Scripting (XSS)

Software PowerPress Podcasting Type Plugin Vulnerable versions = 10.2.3 Fixed in 10.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 51009255116e Credits N/A Required privilege...

WordPress Directorist Plugin <= 7.5.4 is vulnerable to Privilege Escalation

Software Directorist Type Plugin Vulnerable versions = 7.5.4 Fixed in 7.5.5 OWASP Top 10 A2: Broken Authentication Classification Privilege Escalation CVE CVE-2023-1888 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 3e2d4eebdb38 Credits Alex Thomas Required privilege...

WordPress Abandoned Cart Lite for WooCommerce Plugin <= 5.14.2 is vulnerable to Broken Authentication

Software Abandoned Cart Lite for WooCommerce Type Plugin Vulnerable versions = 5.14.2 Fixed in 5.15.0 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-2986 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 15bb4df9e2c9 Credits István...

PT-2023-20077 · WordPress · Wp User Switch

Name of the Vulnerable Software and Affected Versions: WP User Switch plugin for WordPress versions up to, and including, 1.0.2 Description: The issue is due to incorrect authentication checking in the wpus allow user to admin bar menu function with the wpus who switch cookie value. This allows...

PT-2023-24449 · Sonicjs · Sonicjs

Name of the Vulnerable Software and Affected Versions: SonicJS versions up to 0.7.0 Description: The issue allows attackers to execute an authenticated path traversal when special characters are injected into the filename of a backup CMS. Recommendations: For SonicJS versions up to 0.7.0, update ...

WordPress WordPress Tables Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Tables Type Plugin Vulnerable versions = 1.3.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25453 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c90cdd1a03de Credits Le Ngoc Anh Requir...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.4.2 is vulnerable to Broken Access Control

Software Online Booking & Scheduling Calendar for WordPress by vcita Type Plugin Vulnerable versions = 4.4.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2299 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID...

Cross site request forgery (csrf)

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the vcitalogoutcallback function in versions up to, and including, 4.2.10. This makes it possible for unauthenticated to logout a vctia...

WordPress Constant Contact Forms Plugin <= 2.0.3 is vulnerable to Broken Access Control

Software Constant Contact Forms Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.1.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-34387 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8b821c0ab713 Credits István Márton Required...

WordPress JS Job Manager Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software JS Job Manager Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.0.1 OWASP Top 10 A2: Broken Authentication Classification Cross Site Request Forgery CSRF CVE CVE-2023-31087 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID cfbe0d0492f9 Credits Yuki Haruma Required...

WordPress WooCommerce Box Office Plugin <= 1.1.51 is vulnerable to Broken Access Control

Software WooCommerce Box Office Type Plugin Vulnerable versions = 1.1.51 Fixed in 1.1.52 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-34003 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 51c5f4c853cf Credits Rafie Muhammad...

PT-2023-24481 · Emedia Consulting · Simpleredak

Name of the Vulnerable Software and Affected Versions: eMedia Consulting simpleRedak versions up to 2.47.23.05 Description: A stored cross-site scripting XSS issue was found in the component "/de/casting/show/detail/". Recommendations: For versions up to 2.47.23.05, consider restricting access to...

WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin

On May 20, 2023, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for a Privilege Escalation vulnerability in WPDeveloper’s ReviewX plugin, which is actively installed on more than 10,000 WordPress websites. This vulnerability makes it possible for an...

WordPress Donation Platform for WooCommerce: Fundraising & Donation Management Plugin < 1.2.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Donation Platform for WooCommerce: Fundraising & Donation Management Type Plugin Vulnerable versions 1.2.10 Fixed in 1.2.10 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSI...

WordPress Draw Attention Plugin <= 2.0.11 is vulnerable to Broken Access Control

Software Draw Attention Type Plugin Vulnerable versions = 2.0.11 Fixed in 2.0.12 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2764 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 38c9e02b7556 Credits Alex Thomas Required...

WordPress CRM Perks Forms Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2836 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 82373127ce0e Credits Unknown Required privile...

WordPress Wordapp Plugin <= 1.5.0 is vulnerable to Broken Access Control

Software Wordapp Type Plugin Vulnerable versions = 1.5.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2987 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 04adbd084262 Credits Lana Codes Required privilege...

PT-2023-24461 · Microworld Technologies · Escan

Name of the Vulnerable Software and Affected Versions: Microworld Technologies eScan management console version 14.0.1400.2281 Description: The issue allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval in the New Policy form. This...

Exploit for Cross-site Scripting in Escanav Escan_Management_Console

eScan Management Console 14.0.1400.2281 - Reflected Cross Sit...

PT-2023-22385 · Unknown · Edjing Mix

Name of the Vulnerable Software and Affected Versions: edjing Mix version 7.09.01 Description: The issue allows unauthorized apps to cause escalation of privilege attacks by manipulating the database. Recommendations: For edjing Mix version 7.09.01, at the moment, there is no information about a...