WordPress WP Job Portal Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Job Portal Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35760 Patch priority Low CVSS severity Low 5.9 Developer Ahmad PSID 4b9d73fda6dd Credits LuxF0z Required privilege Administrator Published ...

WordPress Search & Replace Plugin < 3.2.2 is vulnerable to SQL Injection

Software Search & Replace Type Plugin Vulnerable versions 3.2.2 Fixed in 3.2.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-4145 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 279ec626c422 Credits Krugov Artyom Required privilege Administrator...

WordPress Sensei Pro (WC Paid Courses) Plugin <= 4.23.1.1.23.1 is vulnerable to Cross Site Scripting (XSS)

Software Sensei Pro WC Paid Courses Type Plugin Vulnerable versions = 4.23.1.1.23.1 Fixed in 4.24.0.1.24.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34765 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ffa624f39abc Credits Rafie...

WordPress Qi Addons For Elementor Plugin <= 1.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Qi Addons For Elementor Type Plugin Vulnerable versions = 1.7.2 Fixed in 1.7.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4364 Patch priority Low CVSS severity Low 6.5 Developer Qode Interactive PSID 0676734b6c2d Credits wesley wcraft...

WordPress ElasticPress Plugin <= 5.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software ElasticPress Type Plugin Vulnerable versions = 5.1.1 Fixed in 5.1.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-35684 Patch priority Low CVSS severity Low 4.3 Developer 10up PSID fbb3d18344c4 Credits Ananda Dhakal Patchstack Required...

WordPress Startklar Elementor Addons Plugin <= 1.7.15 is vulnerable to Arbitrary File Deletion

Software Startklar Elementor Addons Type Plugin Vulnerable versions = 1.7.15 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-5153 Patch priority High CVSS severity High 9.1 Developer Claim ownership PSID ac59d6e1fb44 Credits stealthcopter...

WordPress RestroPress Plugin <= 3.1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software RestroPress Type Plugin Vulnerable versions = 3.1.2.1 Fixed in 3.1.2.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35719 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4f811f4d1bd1 Credits LVT-tholv2k Required privilege...

WordPress GP Premium Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

Software GP Premium Type Plugin Vulnerable versions = 2.4.0 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3469 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID dbeca6e72752 Credits 1337Wannabe - home M.Aw...

WordPress Newsletter Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Newsletter Type Plugin Vulnerable versions = 8.3.4 Fixed in 8.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5317 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a76e0f4cc75c Credits Arkadiusz Hydzik Requir...

WordPress Hash Form Plugin <= 1.1.0 is vulnerable to PHP Object Injection

Software Hash Form Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-5085 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 96e7546828a2 Credits Francesco Carlucci Required privilege...

WordPress Business Directory Plugin Plugin <= 6.4.2 is vulnerable to SQL Injection

Software Business Directory Plugin Type Plugin Vulnerable versions = 6.4.2 Fixed in 6.4.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-4443 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID e684c455bb1f Credits Krzysztof Zając Required privilege...

WordPress Rank Math SEO Plugin <= 1.0.218 is vulnerable to Cross Site Scripting (XSS)

Software Rank Math SEO Type Plugin Vulnerable versions = 1.0.218 Fixed in 1.0.219-beta OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4617 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e1bcca408b13 Credits Ngô Thiên An anco...

WordPress Pods Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Pods Type Plugin Vulnerable versions = 3.2.1 Fixed in 3.2.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3956 Patch priority Low CVSS severity Low 6.5 Developer Pods Framework PSID dfdffac18c6b Credits wesley wcraft Required privilege...

WordPress Divi Theme <= 4.25.0 is vulnerable to Cross Site Scripting (XSS)

Software Divi Type Theme Vulnerable versions = 4.25.0 Fixed in 4.25.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4490 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1cc1a7dd8fd8 Credits Webbernaut Required privilege...

WordPress Form Maker by 10Web Plugin <= 1.15.24 is vulnerable to Cross Site Scripting (XSS)

Software Form Maker by 10Web Type Plugin Vulnerable versions = 1.15.24 Fixed in 1.15.25 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34437 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bccbcab6c64f Credits Huynh Tien Si Required privile...

WordPress 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin Plugin <= 3.71 is vulnerable to Cross Site Scripting (XSS)

Software 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin Type Plugin Vulnerable versions = 3.71 Fixed in 3.72 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34561 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...

WordPress WOLF Plugin <=1.0.8.2 is vulnerable to Cross Site Scripting (XSS)

Software WOLF Type Plugin Vulnerable versions =1.0.8.2 Fixed in 1.0.8.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34558 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 75bcc909e11e Credits Elmini Required privilege Administrator...

WordPress Filterable Portfolio Plugin <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Filterable Portfolio Type Plugin Vulnerable versions = 1.6.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-4234 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a352fd807519 Credits Steven Julian Required privilege...

WordPress KB Support Plugin <= 1.6.0 is vulnerable to Broken Access Control

Software KB Support Type Plugin Vulnerable versions = 1.6.0 Fixed in 1.6.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33589 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 770dfcb61dbb Credits Yudistira Arya Required privilege...

WordPress FileOrganizer plugin <= 1.0.6 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Nikolas in WordPress Plugin FileOrganizer versions = 1.0.6...

WordPress Newspaper Theme <= 12.6.5 is vulnerable to Cross Site Scripting (XSS)

Software Newspaper Type Theme Vulnerable versions = 12.6.5 Fixed in 12.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3815 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7fb86a187abf Credits István Márton Required...

WordPress WP Show Posts Plugin <= 1.1.5 is vulnerable to Sensitive Data Exposure

Software WP Show Posts Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-6731 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0bc24cb2903a Credits Lucio Sá Required privilege...

WordPress WooCommerce Plugin < 8.6 is vulnerable to Broken Access Control

Software WooCommerce Type Plugin Vulnerable versions 8.6 Fixed in 8.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-1310 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1c0523f0c515 Credits Scott Kingsley Clark Required privilege...

WordPress WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content Plugin <= 7.0 is vulnerable to Sensitive Data Exposure

Software WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content Type Plugin Vulnerable versions = 7.0 Fixed in 7.1.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-7046 Patch priority Low CVSS severity Low 7.5...

WordPress Table & Contact Form 7 Database – Tablesome Plugin <= 1.0.25 is vulnerable to Cross Site Request Forgery (CSRF)

Software Table & Contact Form 7 Database – Tablesome Type Plugin Vulnerable versions = 1.0.25 Fixed in 1.0.26 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-31388 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress WP Sort Order Plugin <= 1.3.1 is vulnerable to Broken Access Control

Software WP Sort Order Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31294 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fa1bc46c4a98 Credits CatFather Required privilege...

WordPress Watu Quiz Plugin <= 3.4.1 is vulnerable to Sensitive Data Exposure

Software Watu Quiz Type Plugin Vulnerable versions = 3.4.1 Fixed in 3.4.1.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-0872 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 458d166de345 Credits Lucio Sá Required privilege...

WordPress File Manager Plugin <= 7.2.5 is vulnerable to Path Traversal

Software File Manager Type Plugin Vulnerable versions = 7.2.5 Fixed in 7.2.6 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-2654 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 1c905e547371 Credits DarkT Required privilege Administrator...

WordPress DearFlip Plugin <= 2.2.26 is vulnerable to Cross Site Scripting (XSS)

Software DearFlip Type Plugin Vulnerable versions = 2.2.26 Fixed in 2.2.27 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29807 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 59b13b8a28ca Credits emad Required privilege Contributor Publish...

WordPress Weglot Translate Plugin <= 4.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Weglot Translate Type Plugin Vulnerable versions = 4.2.5 Fixed in 4.2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2124 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ff81bdc0a325 Credits Ngô Thiên An ancorn -...

WordPress PropertyHive Plugin <= 2.0.9 is vulnerable to PHP Object Injection

Software PropertyHive Type Plugin Vulnerable versions = 2.0.9 Fixed in 2.0.10 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-27985 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 245763d3996e Credits CatFather Required privilege Subscribe...

WordPress Seriously Simple Podcasting Plugin < 3.0.0 is vulnerable to Sensitive Data Exposure

Software Seriously Simple Podcasting Type Plugin Vulnerable versions 3.0.0 Fixed in 3.0.0 OWASP Top 10 A4: Insecure Design Classification Sensitive Data Exposure CVE CVE-2023-6444 Patch priority Low CVSS severity Low 5.3 Developer Castos PSID d8c267ec50e4 Credits Krzysztof Zając CERT PL Required...

WordPress MasterStudy LMS Plugin <= 3.2.5 is vulnerable to SQL Injection

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.2.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-1512 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID e235479f4753 Credits Krzysztof Zając Required privilege Unauthenticat...

WordPress Formidable Forms Plugin <= 6.7 is vulnerable to Content Injection

Software Formidable Forms Type Plugin Vulnerable versions = 6.7 Fixed in 6.7.1 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-23522 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID b82c61d4e6f0 Credits Revan Arifio Required privilege...

WordPress WOLF Plugin <= 1.0.8.1 is vulnerable to Broken Access Control

Software WOLF Type Plugin Vulnerable versions = 1.0.8.1 Fixed in 1.0.8.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-0791 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 9624a396772c Credits Francesco Carlucci Required privilege...

WordPress MaxButtons Plugin <= 9.7.6 is vulnerable to Cross Site Scripting (XSS)

Software MaxButtons Type Plugin Vulnerable versions = 9.7.6 Fixed in 9.7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7029 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d11aac46fc3d Credits Webbernaut Required privilege...

WordPress WPvivid Backup and Migration Plugin <= 0.9.94 is vulnerable to Broken Access Control

Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.94 Fixed in 0.9.95 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4637 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 9fe28924b5f3 Credits Revan Arifio...

WordPress Unlimited Addons for WPBakery Page Builder Plugin <= 1.0.42 is vulnerable to Arbitrary File Upload

Software Unlimited Addons for WPBakery Page Builder Type Plugin Vulnerable versions = 1.0.42 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6925 Patch priority Low CVSS severity Low 8 Developer Claim ownership PSID 9599a24cfc17 Credits István Márton...

WordPress MapPress Maps for WordPress Plugin <= 2.88.13 is vulnerable to Cross Site Scripting (XSS)

Software MapPress Maps for WordPress Type Plugin Vulnerable versions = 2.88.13 Fixed in 2.88.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6524 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 602a4e053876 Credits Akbar...

WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Auto Amazon Links Type Plugin Vulnerable versions = 5.1.1 Fixed in 5.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52175 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f072a5fa406e Credits Nguyen Anh Tien Required privilege...

WordPress Calculated Fields Form Plugin <= 1.2.28 is vulnerable to Open Redirection

Software Calculated Fields Form Type Plugin Vulnerable versions = 1.2.28 Fixed in 1.2.29 OWASP Top 10 A3: Injection Classification Open Redirection CVE CVE-2023-51517 Patch priority Low CVSS severity Low 4.1 Developer Claim ownership PSID 4cc332044480 Credits Ngô Thiên An ancorn from VNPT-VCI...

WordPress Media File Renamer Plugin <= 5.7.7 is vulnerable to Arbitrary File Upload

Software Media File Renamer Type Plugin Vulnerable versions = 5.7.7 Fixed in 5.7.8 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-50897 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 364780c1ddc1 Credits Taihei Shimamine Required privilege...

WordPress Import and export users and customers Plugin <= 1.24.3 is vulnerable to Cross Site Scripting (XSS)

Software Import and export users and customers Type Plugin Vulnerable versions = 1.24.3 Fixed in 1.24.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6624 Patch priority Low CVSS severity Low 6.5 Developer Codection PSID 8dfbaad9de1b Credits...

WordPress BigCommerce Plugin <= 5.1.1 is vulnerable to Sensitive Data Exposure

Software BigCommerce Type Plugin Vulnerable versions = 5.1.1 Fixed in N/A OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2023-49162 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e6538cb5a9be Credits Joshua Chan...

WordPress Shortcodes Ultimate Plugin <= 5.13.3 is vulnerable to Cross Site Scripting (XSS)

Software Shortcodes Ultimate Type Plugin Vulnerable versions = 5.13.3 Fixed in 7.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6225 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f77e11ca5365 Credits Francesco Carlucci...

WordPress Happyforms Plugin <= 1.25.9 is vulnerable to Cross Site Scripting (XSS)

Software Happyforms Type Plugin Vulnerable versions = 1.25.9 Fixed in 1.25.10 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-48752 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 31f86188864b Credits Le Ngoc Anh Required privilege...

WordPress TextMe SMS Plugin <= 1.9.0 is vulnerable to Broken Access Control

Software TextMe SMS Type Plugin Vulnerable versions = 1.9.0 Fixed in 1.9.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-48287 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 91f657366fb1 Credits Arvandy Required privilege...

WordPress Elementor Addon Elements Plugin <= 1.12.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.12.7 Fixed in 1.12.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-4690 Patch priority Low CVSS severity Low 4.3 Developer WPVibes PSID 4fc8bb67050e Credits WordFence Require...

WordPress Awesome Support Plugin < 6.1.5 is vulnerable to Arbitrary File Deletion

Software Awesome Support Type Plugin Vulnerable versions 6.1.5 Fixed in 6.1.5 OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Deletion CVE CVE-2023-5355 Patch priority Medium CVSS severity Medium 7.7 Developer Claim ownership PSID b2eca27b2e54 Credits Alex Sanford Require...

WordPress News & Blog Designer Pack – WordPress Blog Plugin Plugin <= 3.4.1 is vulnerable to Remote Code Execution (RCE)

Software News & Blog Designer Pack – WordPress Blog Plugin Type Plugin Vulnerable versions = 3.4.1 Fixed in 3.4.2 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-5815 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 968958ed229c Credits...