WordPress Hide My WP Ghost Plugin <= 5.3.01 is vulnerable to Cross Site Scripting (XSS)

Software Hide My WP Ghost Type Plugin Vulnerable versions = 5.3.01 Fixed in 5.3.02 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10825 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3f125ce149ef Credits Peter Thaleiki...

WordPress wp-login customizer plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin wp-login customizer versions = 1.0...

CVE-2024-11028

The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the user impersonation feature inappropriately determining the current user via user-supplied input. This makes it...

WordPress SK WP Settings Backup plugin <= 1.0 - CSRF to PHP Object Injection vulnerability

CSRF to PHP Object Injection vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin SK WP Settings Backup versions = 1.0...

CVE-2024-11028

CVE-2024-11028 affects MultiManager WP – Manage All Your WordPress Sites Easily for WordPress. Versions up to 1.0.5 are vulnerable to Authentication Bypass via a user-impersonation mechanism that determin es the current user from user-supplied input, enabling unauthenticated attackers to generate...

CVE-2024-11028 MultiManager WP – Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation

The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the user impersonation feature inappropriately determining the current user via user-supplied input. This makes it...

CVE-2024-11028 MultiManager WP – Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation

The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the user impersonation feature inappropriately determining the current user via user-supplied input. This makes it...

CVE-2024-10800

The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajaxsavefields function in all versions up to, and including, 16.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to ad...

CVE-2024-10174

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.13 via the 'AbstractPermission' class due to missing validation on the 'useri...

CVE-2024-10174

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.13 via the 'AbstractPermission' class due to missing validation on the 'useri...

CVE-2024-10038

CVE-2024-10038 — WP-Strava (WordPress) is an authenticated stored XSS vulnerability in the WP-Strava plugin up to version 2.12.1. The root cause is “insufficient input sanitization and output escaping” in admin settings, allowing an attacker with administrator-level permissions to inject scripts ...

WordPress WP Githuber MD Plugin <= 1.16.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Githuber MD Type Plugin Vulnerable versions = 1.16.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52422 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 80930d0544eb Credits Fazle Mawla Required privilege Contribut...

WordPress WP Project Manager Plugin <= 2.6.13 is vulnerable to Insecure Direct Object References (IDOR)

Software WP Project Manager Type Plugin Vulnerable versions = 2.6.13 Fixed in 2.6.14 OWASP Top 10 A4: Insecure Design Classification Insecure Direct Object References IDOR CVE CVE-2024-10174 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 6aaed61c0d51 Credits stealthcopt...

WordPress SK WP Settings Backup Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software SK WP Settings Backup Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-52415 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 9e294ac36174 Credits Mika Required...

WordPress WP-Strava Plugin <= 2.12.1 is vulnerable to Cross Site Scripting (XSS)

Software WP-Strava Type Plugin Vulnerable versions = 2.12.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10038 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID dd6efa54c071 Credits paupu Required privilege...

CVE-2024-51820

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wplsquared L Squared Hub WP l-squared-hub-wp-virtual-device allows SQL Injection.This issue affects L Squared Hub WP: from n/a through = 1.0...

CVE-2024-51837

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SONS Creative Development WP Contest allows SQL Injection.This issue affects WP Contest: from n/a through 1.0.0...

CVE-2024-51837

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sophia M Williams WP Contest wp-contest allows SQL Injection.This issue affects WP Contest: from n/a through = 1.0.0...

CVE-2024-51820 WordPress L Squared Hub WP plugin <= 1.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in L Squared Support L Squared Hub WP allows SQL Injection.This issue affects L Squared Hub WP: from n/a through 1.0...

CVE-2024-51820 WordPress L Squared Hub WP plugin <= 1.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wplsquared L Squared Hub WP l-squared-hub-wp-virtual-device allows SQL Injection.This issue affects L Squared Hub WP: from n/a through = 1.0...