PT-2023-31302 · WordPress · Pubydoc Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: PubyDoc WordPress plugin versions 2.0.6 and earlier Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and escape some of...

CVE-2023-47660 WordPress Product Visibility by Country for WooCommerce Plugin <= 1.4.9 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP Wham Product Visibility by Country for WooCommerce plugin = 1.4.9 versions...

PT-2023-30123 · WordPress · Daext Autolinks Manager

Name of the Vulnerable Software and Affected Versions: DAEXT Autolinks Manager plugin versions = 1.10.04 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-23140 · WordPress · Wp Browserupdate Plugin

Name of the Vulnerable Software and Affected Versions: WP BrowserUpdate plugin versions = 4.4.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web application that...

PT-2023-23256 · WordPress · Participants Database

Name of the Vulnerable Software and Affected Versions: Participants Database plugin versions = 2.4.9 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-14762 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce versions through 5.5.2 Description: The issue is related to the improper neutralization of formula elements in a CSV file, which affects Icegram Express...

PT-2023-28098 · WordPress · Directorist

Name of the Vulnerable Software and Affected Versions: Directorist – WordPress Business Directory Plugin with Classified Ads Listings versions 7.7.1 and earlier Description: The issue is related to the improper neutralization of formula elements in a CSV file, which affects the Directorist –...

PT-2023-32282 · WordPress · Wd Widgettwitter

Name of the Vulnerable Software and Affected Versions: WD WidgetTwitter plugin for WordPress versions up to, and including, 1.0.9 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the plugin's...

CVE-2023-5454 Templately < 2.2.6 - Arbitrary post trashing via Missing Authorization

The Templately WordPress plugin before 2.2.6 does not properly authorize the saved-templates/delete REST API call, allowing unauthenticated users to delete arbitrary posts...

WordPress Backup & Migration < 1.4.4 - Subscriber+ Plugin Settings Update

Description The plugin does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings. fetch"/wp-admin/admin-ajax.php", "headers": "content-type": "application/x-www-form-urlencoded; charset=UTF-8", , "body":...

PT-2023-32435 · WordPress · Digirisk

Name of the Vulnerable Software and Affected Versions: Digirisk plugin for WordPress version 6.0.0.0 Description: The issue is related to Reflected Cross-Site Scripting via the current group id parameter due to insufficient input sanitization and output escaping. This allows unauthenticated...

Announcing Vulnerability Scanning in Wordfence CLI 2.0.1 “Voodoo Child”

Note: If youre a WordPress user, we recommend the Wordfence Security Plugin which provides a robust and complete set of security controls for WordPress websites. If you host WordPress servers and need high performance malware and vulnerability scanning on the command line, read on! Our mission at...

CVE-2023-4251 EventPrime < 3.2.0 - Booking Creation via CSRF

The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks...

WordPress Plugin Superb slideshow gallery SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2023-28383 · WordPress · Eventprime

Name of the Vulnerable Software and Affected Versions: EventPrime WordPress plugin versions prior to 3.2.0 Description: The issue concerns a lack of CSRF checks when creating bookings. This could allow attackers to make logged-in users create unwanted bookings via CSRF attacks. Recommendations: F...

CVE-2023-5820

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the addedit functionality. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged reques...

CVE-2023-5798 Assistant < 1.4.4 - Editor+ SSRF

The Assistant WordPress plugin before 1.4.4 does not validate a parameter before making a request to it via wpremoteget, which could allow users with a role as low as Editor to perform SSRF attacks...

WordPress Security & Malware scan by CleanTalk Plugin <= 2.50 is vulnerable to Broken Access Control

Software Security & Malware scan by CleanTalk Type Plugin Vulnerable versions = 2.50 Fixed in 2.51 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2020-36698 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID b7a98366ebf3 Credits Jerome...

CVE-2023-3965 nsc <= 1.0 - Prototype Pollution to Reflected Cross-Site Scripting

The nsc theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2023-4796 Booster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode

The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcjwpoption' shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated attackers, with...