49933 matches found
WordPress Mindscape Theme <= 1.0.16 is vulnerable to Cross Site Request Forgery (CSRF)
Software Mindscape Type Theme Vulnerable versions = 1.0.16 Fixed in 1.0.23 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-34810 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c591d53d9f92 Credits Dhabaleshwar Das Require...
WordPress Slider Revolution Plugin <= 6.7.7 is vulnerable to Cross Site Scripting (XSS)
Software Slider Revolution Type Plugin Vulnerable versions = 6.7.7 Fixed in 6.7.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4092 Patch priority Low CVSS severity Low 6.5 Developer ThemePunch PSID 82a59957f3ec Credits wesley wcraft Required...
WordPress Essential Real Estate Plugin <= 4.3.5 is vulnerable to Arbitrary File Upload
Software Essential Real Estate Type Plugin Vulnerable versions = 4.3.5 Fixed in 4.4.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6827 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 4162eb3df384 Credits István Márton Required privilege...
WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to PHP Object Injection
Software Master Slider Pro Type Plugin Vulnerable versions = 3.6.5 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2023-47507 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 6df26bc223e4 Credits Rafie Muhammad Patchstack Required...
WordPress WP Customer Reviews Plugin <= 3.6.6 is vulnerable to Cross Site Scripting (XSS)
Software WP Customer Reviews Type Plugin Vulnerable versions = 3.6.6 Fixed in 3.6.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4648 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 36513c06abe2 Credits Marco Wotschka...
WordPress Jeg Elementor Kit Plugin < 2.5.7 is vulnerable to Broken Access Control
Software Jeg Elementor Kit Type Plugin Vulnerable versions 2.5.7 Fixed in 2.5.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-3805 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID cb8e3a1233cd Credits Ramuel Gall Required privile...
WordPress ProfileGrid plugin <= 5.1.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by zhangyunpei in the WordPress ProfileGrid plugin versions = 5.1.0. Solution Update the WordPress ProfileGrid plugin to the latest available version at least 5.1.1...
WordPress 2kb Amazon Affiliates Store plugin <= 2.1.5 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. Stored Cross-Site Scripting XSS vulnerability discovered by ptsfence Patchstack Alliance in WordPress 2kb Amazon Affiliates Store plugin versions = 2.1.5. Solution No patched version is available. No reply from the vendor...
WordPress Traffic Manager plugin <= 1.4.5 - Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS)
Broken Access Control vulnerability leading to Stored Cross-Site Scripting XSS discovered by Lana Codes Patchstack Alliance in the WordPress Traffic Manager plugin versions = 1.4.5. Solution Deactivate and delete. This plugin has been closed as of September 19, 2022 and is not available for...
WordPress Newspaper premium theme <= 11.5.1 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Truoc Phan Techlab Corporation in WordPress Newspaper premium theme versions = 11.5.1 Solution Update the WordPress Newspaper theme to the latest available version at least 12...
WordPress Awesome Filterable Portfolio plugin <= 1.9.7 - Unauthenticated Plugin Settings Change vulnerability
Unauthenticated Plugin Settings Change vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress Awesome Filterable Portfolio plugin versions = 1.9.7. Solution Deactivate and delete. This plugin has been closed as of September 14, 2022 and is not available for download. This...
WordPress Visual Composer Website Builder plugin <= 45.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Title
Authenticated Stored Cross-Site Scripting XSS vulnerability via Title discovered by Zhouyuan Yang in WordPress Visual Composer Website Builder plugin versions = 45.0. Solution Update the WordPress Visual Composer Website Builder plugin to the latest available version at least 45.0.1...
WordPress Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 - Authenticated Cross-Site Scripting (XSS) vulnerability
Authenticated Cross-Site Scripting XSS vulnerability discovered by Kim Jong Min aka Universe Patchstack Alliance in WordPress Poll, Survey, Questionnaire and Voting system plugin versions = 1.7.4. Solution No patched version available...
WordPress Visual Portfolio Plugin <= 2.18.0 - Authenticated CSS Injection vulnerability
Authenticated CSS Injection vulnerability discovered by Krzysztof ZajÄ…c in Visual Portfolio plugin versions = 2.18.0 Solution Update the WordPress Visual Portfolio, Photo Gallery & Post Grid plugin to the latest available version at least 2.19.0...
WordPress THE Leads Management System: 59sec LITE plugin <= 3.4.1 - Unauthenticated plugin settings change vulnerability
Unauthenticated plugin settings change vulnerability discovered by ptsfence Patchstack Alliance in WordPress THE Leads Management System: 59sec LITE plugin versions = 3.4.1. Solution Deactivate and delete. This plugin has been closed as of August 12, 2022 and is not available for download. This...
WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Read vulnerability
Authenticated Arbitrary File Read vulnerability discovered by Brandon James Roldan Patchstack Alliance in WordPress WPide plugin versions = 2.6. Solution Update the WordPress WPIDE – File Manager & Code Editor plugin to the latest available version at least 3.0...
WordPress Download Manager plugin <= 3.2.48 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability leading to template status change discovered by Muhammad Daffa Patchstack Alliance in WordPress Download Manager plugin versions = 3.2.48. Solution Update the WordPress Download Manager plugin to the latest available version at least 3.2.49...
WordPress Download Manager plugin <= 3.2.48 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities were discovered by Vlad Vector Patchstack in the WordPress Download Manager plugin versions = 3.2.48. Solution Update the WordPress Download Manager plugin to the latest available version at least 3.2.49...
WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability via malicious SVG file upload discovered by Kim Jong Min aka Universe Patchstack Alliance in WordPress Enable SVG, WebP & ICO Upload plugin versions = 1.0.3. Solution No patched version available...
WordPress NEX-Forms plugin <= 7.9.6 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability discovered by Elias Hohl in WordPress NEX-Forms plugin versions = 7.9.6. Solution Update the WordPress NEX-Forms – Ultimate Form Builder plugin to the latest available version at least 7.9.7...
WordPress GiveWP plugin <= 2.20.2 - Authenticated Arbitrary File Read via Export function vulnerability
Authenticated Arbitrary File Read via Export function vulnerability discovered by Rafie Muhammad aka Yeraisci Patchstack Alliance in WordPress GiveWP plugin versions = 2.20.2. Solution Update the WordPress GiveWP plugin to the latest available version at least 2.21.0...
WordPress Exports and Reports plugin <= 0.9.1 - Authenticated CSV Injection vulnerability
Authenticated CSV Injection vulnerability discovered by websafe2021 in WordPress Exports and Reports plugin versions = 0.9.1. Solution Update the WordPress Exports and Reports plugin to the latest available version at least 0.9.2...
WordPress Bold Page Builder plugin <= 4.3.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Nikhil Kapoor in WordPress Bold Page Builder plugin versions = 4.3.2. Solution Update the WordPress Bold Page Builder plugin to the latest available version at least 4.3.3...
WordPress Core plugin for Kitestudio themes <= 2.3.0 - Reflected Cross-Site-Scripting (XSS) vulnerability
Reflected Cross-Site-Scripting XSS vulnerability discovered by cydave in WordPress Core plugin for Kitestudio themes versions = 2.3.0. Solution Update the WordPress Core plugin for Kitestudio themes to the latest available version at least 2.3.1...
WordPress Photo Gallery by Supsystic plugin <= 1.15.5 - Cross-Site Request Forgery (CSRF) leading to Plugin Settings Change
Cross-Site Request Forgery CSRF leading to Plugin Settings Change discovered by Rasi Afeef Patchstack Alliance in WordPress Photo Gallery by Supsystic plugin versions = 1.15.5. Solution Update the WordPress Photo Gallery by Supsystic plugin to the latest available version at least 1.15.6...
WordPress HTML2WP plugin <= 1.0.0 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Daniel Ruf in WordPress HTML2WP plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of May 4, 2022 and is not available for download. This closure is temporary, pending a full review...
WordPress WPMK Ajax Finder plugin <= 1.0.1 - Stored Cross-Site Scripting (XSS) via CSRF vulnerability
Stored Cross-Site Scripting XSS via CSRF vulnerability discovered by Tsubasa Imaizumi Cryptography Laboratory in Tokyo Denki University in WordPress WPMK Ajax Finder plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of May 17, 2022 and is not available for...
WordPress Export All URLs plugin <= 4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Universe Patchstack Alliance in WordPress Export All URLs plugin versions = 4.1. Solution Update the WordPress Export All URLs plugin to the latest available version at least 4.2...
WordPress Note Press plugin <= 0.1.10 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability was discovered by Daniel Krohmer and Shi Chen in the WordPress Note Press plugin versions = 0.1.10. Solution Deactivate and delete. This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a...
WordPress Slideshow plugin <= 2.3.1 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Fayçal CHENA in WordPress Slideshow plugin versions = 2.3.1. Solution Deactivate and delete. This plugin has been closed as of April 11, 2022 and is not available for download. This closure is temporary, pending a full review...
WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability
Subscriber+ Plugin Settings Update vulnerability discovered by Tien Nguyen Anh Patchstack Alliance in WordPress ShortPixel Adaptive Images plugin versions = 3.3.1. Solution Update the WordPress ShortPixel Adaptive Images plugin to the latest available version at least 3.4.0...
WordPress Webba Booking plugin <= 4.2.21 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas Patchstack Alliance in WordPress Webba Booking plugin versions = 4.2.21. Solution Update the WordPress Webba Booking plugin to the latest available version at least 4.2.22...
WordPress Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Template Import
Cross-Site Request Forgery CSRF vulnerability leading to Template Import discovered by Ex.Mi Patchstack in WordPress Yoo Slider plugin versions = 2.0.0. Solution Update the WordPress Yoo Slider plugin to the latest available version at least 2.1.0...
WordPress Documentor plugin <= 1.5.3 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Documentor plugin versions = 1.5.3. Solution Deactivate and delete. This plugin has been closed as of March 29, 2022 and is not available for download. This closure is temporary, pending a full review...
WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 5.174 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Ramuel Gall Wordfence in WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin versions = 5.174. Solution Update the WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin to the latest available version at leas...
WordPress Be POPIA Compliant plugin <= 1.1.5 - Unauthenticated Sensitive Information Exposure vulnerability
Unauthenticated Sensitive Information Exposure vulnerability discovered by Chris Meistre in WordPress Be POPIA Compliant plugin versions = 1.1.5. Solution Update the WordPress Be POPIA Compliant plugin to the latest available version at least 1.1.6...
WordPress amr users plugin <= 4.59.3 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Ankur Bakre in WordPress amr users plugin versions = 4.59.3. Solution Update the WordPress amr users plugin to the latest available version at least 4.59.4...
WordPress Conference Scheduler plugin <= 2.4.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Conference Scheduler plugin versions = 2.4.2. Solution Update the WordPress Conference Scheduler plugin to the latest available version at least 2.4.3...
WordPress Tarot Card Oracle plugin <= 1.0.5 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Tarot Card Oracle plugin versions = 1.0.5. Solution Update the WordPress Tarot Card Oracle plugin to the latest available version at least 1.0.6...
WordPress Login/Signup Popup plugin <= 2.2 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Options Update
Cross-Site Request Forgery CSRF vulnerability leading to Arbitrary Options Update discovered by Chloe Chamberland Wordfence in WordPress Login/Signup Popup plugin versions = 2.2. Solution Update the WordPress Login/Signup Popup plugin to the latest available version at least 2.3...
WordPress VMag theme <= 1.2.7 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Lenon Leite Patchstack Red Team project in WordPress VMag theme versions = 1.2.7. This theme uses a vulnerable piece of code related to previously identified vulnerability - CVE-2021-39317. Solution Deactivate and delete. The vendor ignores the...
WordPress Preview E-mails for WooCommerce plugin <= 1.6.8 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Chloe Chamberland WordFence in WordPress Preview E-mails for WooCommerce plugin versions = 1.6.8. Solution Update the WordPress Preview E-mails for WooCommerce plugin to the latest available version at least 2.0.0...
WordPress Age Gate plugin <= 2.17.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability was discovered by Nguyen Van Khanh Patchstack Alliance in the WordPress Age Gate plugin versions = 2.17.0. Solution Update the WordPress Age Gate plugin to the latest available version at least 2.17.1...
WordPress Google Language Translator plugin <= 6.0.11 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Google Language Translator plugin versions = 6.0.11. Solution Update the WordPress Google Language Translator plugin to the latest available version at least 6.0.12...
WordPress Slider Hero plugin <= 8.2.6 - SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability discovered by apple502j in WordPress Slider Hero plugin versions = 8.2.6. Solution Update the WordPress Slider Hero plugin to the latest available version at least 8.2.7...
WordPress Polls Widget plugin <= 1.5.2 - Unauthenticated Blind SQL Injection (SQLi) vulnerability
Unauthenticated Blind SQL Injection SQLi vulnerability discovered by Toby Jackson in WordPress Polls Widget plugin versions = 1.5.2. Solution Update the WordPress Polls Widget plugin to the latest available version at least 1.5.3...
WordPress wpForo Forum plugin <= 1.9.6 - Open Redirect vulnerability
Open Redirect vulnerability discovered by Hosein Vita in WordPress wpForo Forum plugin versions = 1.9.6. Solution Update the WordPress wpForo Forum plugin to the latest available version at least 1.9.7...
WordPress Delightful Downloads plugin <= 1.6.6 - Path Traversal vulnerability
Path Traversal vulnerability discovered by Nicholas Ferreira in WordPress Delightful Downloads plugin versions = 1.6.6. Solution Plugin closed. Deactivate and delete...
WordPress Stockdio Historical Chart plugin <= 2.7.2 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found by Jondow in WordPress Stockdio Historical Chart plugin versions = 2.7.2. Solution Update the WordPress Stockdio Historical Chart plugin to the latest available version at least 2.8.1...
WordPress File Manager plugin <= 6.4 - Backup File Directory Listing vulnerability
Backup File Directory Listing vulnerability found by zerodetail & ratherbland in WordPress File Manager plugin versions = 6.4. Solution Update the WordPress File Manager plugin to the latest available version at least 6.5...