WordPress WP Review Slider Plugin < 12.2 is vulnerable to SQL Injection

Software WP Review Slider Type Plugin Vulnerable versions 12.2 Fixed in 12.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0260 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 47e53f2f24b7 Credits István Márton Required privilege Subscriber Publish...

WordPress Spectra Plugin <= 2.3.0 is vulnerable to Broken Access Control

Software Spectra Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23729 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 16166b135120 Credits Dave Jong Patchstack Required privile...

PT-2023-15522 · WordPress · Wp Google My Business Auto Publish

Name of the Vulnerable Software and Affected Versions: WP Google My Business Auto Publish WordPress plugin versions prior to 3.4 Description: The issue allows users with a role as low as contributor to perform a Stored Cross-Site Scripting attack due to the plugin not validating and escaping one ...

WordPress Customer Reviews for WooCommerce Plugin < 5.16.0 is vulnerable to Local File Inclusion

Software Customer Reviews for WooCommerce Type Plugin Vulnerable versions 5.16.0 Fixed in 5.16.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-0080 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 2a336810763e Credits István Márton Required...

WordPress WP Client Reports Plugin <= 1.0.16 is vulnerable to Sensitive Data Exposure

Software WP Client Reports Type Plugin Vulnerable versions = 1.0.16 Fixed in 1.0.17 OWASP Top 10 A5: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2023-23978 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1a6f275a92fe Credits Rafshanzani Suhada...

WordPress Image Hover Effects For WPBakery Page Builder Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)

Software Image Hover Effects For WPBakery Page Builder Type Plugin Vulnerable versions = 4.0 Fixed in 5.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23681 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2843dca604e1 Credi...

WordPress Interactive Polish Map Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Interactive Polish Map Type Plugin Vulnerable versions = 1.2 Fixed in 1.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23821 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID be3ac8b7a0a2 Credits Rio Darmawan...

WordPress MailOptin Plugin <= 1.2.54.0 is vulnerable to Cross Site Scripting (XSS)

Software MailOptin Type Plugin Vulnerable versions = 1.2.54.0 Fixed in 1.2.54.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23980 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 215c7eb57abe Credits yuyudhn Required...

WordPress Heateor Social Comments Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Heateor Social Comments Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23977 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2e8e8868e318 Credits Rafshanzani...

WordPress Participants Database Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Participants Database Type Plugin Vulnerable versions = 2.4.5 Fixed in 2.4.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47612 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2aed529173b0 Credits rezaduty...

WordPress Essential Blocks for Gutenberg Plugin <= 3.8.5 is vulnerable to Broken Access Control

Software Essential Blocks for Gutenberg Type Plugin Vulnerable versions = 3.8.5 Fixed in 3.8.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-47594 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 63aa473b136c Credits Lucio Sá...

WordPress User Registration Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)

Software User Registration Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23987 Patch priority Low CVSS severity Low 5.9 Developer Masteriyo PSID 518a23296838 Credits Rio Darmawan Required...

WordPress My Calendar Plugin <= 3.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software My Calendar Type Plugin Vulnerable versions = 3.4.3 Fixed in 3.4.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23813 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID d5abc0e1e743 Credits thiennv Required...

WordPress WP Go Maps Plugin <= 9.0.15 is vulnerable to Directory Traversal

Software WP Go Maps Type Plugin Vulnerable versions = 9.0.15 Fixed in 9.0.16 OWASP Top 10 A3: Sensitive Data Exposure Classification Directory Traversal CVE CVE-2022-47595 Patch priority Low CVSS severity Low 4.9 Developer WP Go Maps PSID ce001c792740 Credits rezaduty Required privilege...

WordPress Contact Us page - Contact people LITE Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Contact Us page - Contact people LITE Type Plugin Vulnerable versions = 3.7.0 Fixed in 3.7.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23973 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 924b5ed1c57e Credi...

Authorization

The Social Warfare plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete post meta...

WordPress Mapwiz Plugin <= 1.0.1 is vulnerable to SQL Injection

Software Mapwiz Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-4546 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 5aebce0acd8a Credits Daniel Krohmer Required privilege Administrator Published 19...

WordPress Page Loading Effects Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Page Loading Effects Type Plugin Vulnerable versions = 2.0.0 Fixed in 3.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23718 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 68ff95331eeb Credits yuyudhn Required...

WordPress Nice PayPal Button Lite Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Nice PayPal Button Lite Type Plugin Vulnerable versions = 1.3.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-22686 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 497c643d4eec Credits Mika Required...

WordPress WP Fast Cache Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Fast Cache Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-22675 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e2877794830a Credits Mika Required privilege...