WordPress Bricks Builder Theme <= 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Bricks Builder Type Theme Vulnerable versions = 1.8.1 Fixed in 1.8.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-3408 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a8763892e84e Credits Ram Required privilege...

WordPress Ultimate Store Kit Elementor Addons Plugin <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Store Kit Elementor Addons Type Plugin Vulnerable versions = 1.6.4 Fixed in 2.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43342 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bae240e72e97 Credits 4rCanJ0x! Required...

WordPress ReviewX Plugin <= 1.6.28 is vulnerable to Broken Access Control

Software ReviewX Type Plugin Vulnerable versions = 1.6.28 Fixed in 1.6.29 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43323 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID aac7e9823c91 Credits Manab Jyoti Dowarah Required...

WordPress Slider by 10Web Plugin <= 1.2.57 is vulnerable to SQL Injection

Software Slider by 10Web Type Plugin Vulnerable versions = 1.2.57 Fixed in 1.2.58 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-7150 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 4ad1a30beb69 Credits Arkadiusz Hydzik Required privilege Contributor...

WordPress Redux Framework Plugin <= 4.4.17 is vulnerable to Cross Site Scripting (XSS)

Software Redux Framework Type Plugin Vulnerable versions = 4.4.17 Fixed in 4.4.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6828 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3b2115820306 Credits villu164 Require...

WordPress Timetable and Event Schedule Plugin <= 2.4.13 is vulnerable to PHP Object Injection

Software Timetable and Event Schedule Type Plugin Vulnerable versions = 2.4.13 Fixed in 2.4.14 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-39630 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 6ee205917cb2 Credits !\VNPT\ Nguyễn Phương...

WordPress Affiliate Manager Plugin < 6.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Affiliate Manager Type Plugin Vulnerable versions 6.5.1 Fixed in 6.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5280 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0fe8966b39d9 Credits caon Required...

WordPress WPS Hide Login Plugin < 1.9.16.4 is vulnerable to Bypass Vulnerability

Software WPS Hide Login Type Plugin Vulnerable versions 1.9.16.4 Fixed in 1.9.16.4 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-6289 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f53af1c9d210 Credits Juan Pablo Gomez Postigo Required...

WordPress MStore API Plugin <= 4.14.7 is vulnerable to Broken Authentication

Software MStore API Type Plugin Vulnerable versions = 4.14.7 Fixed in 4.15.0 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-6328 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID eb61c3a933bb Credits Truoc Phan...

WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.10 is vulnerable to Cross Site Scripting (XSS)

Software NEX-Forms – Ultimate Form Builder Type Plugin Vulnerable versions = 8.5.10 Fixed in 8.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37512 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6818a3b8cb82 Credits LVT-tholv2k Require...

WordPress Paid Memberships Pro Plugin <= 3.0.5 is vulnerable to SQL Injection

Software Paid Memberships Pro Type Plugin Vulnerable versions = 3.0.5 Fixed in 3.0.6 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-37486 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 6111a0093c77 Credits Trương Hữu Phúc truonghuuphuc Required...

WordPress WPQA - Builder forms Addon Plugin < 6.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WPQA - Builder forms Addon Type Plugin Vulnerable versions 6.1.1 Fixed in 6.1.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2376 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 77943f96c05b Credits Bob Matyas...

WordPress WPQA - Builder forms Addon Plugin < 6.1.1 is vulnerable to Cross Site Scripting (XSS)

Software WPQA - Builder forms Addon Type Plugin Vulnerable versions 6.1.1 Fixed in 6.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2375 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b62f23b8b86a Credits Bob Matyas...

WordPress LearnPress Plugin <= 4.2.6.8.1 is vulnerable to Broken Access Control

Software LearnPress Type Plugin Vulnerable versions = 4.2.6.8.1 Fixed in 4.2.6.8.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6088 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 437341849e3b Credits shaman0x01 Required privile...

WordPress Elegant Pink theme 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Elegant Pink versions = 1.3.0...

WordPress Interactive Content – H5P Plugin < 1.15.8 is vulnerable to Cross Site Scripting (XSS)

Software Interactive Content – H5P Type Plugin Vulnerable versions 1.15.8 Fixed in 1.15.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3111 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b51ad18a9f74 Credits Dmitrii Ignaty...

WordPress Laybuy Payment Extension for WooCommerce Plugin <= 5.3.9 is vulnerable to Broken Access Control

Software Laybuy Payment Extension for WooCommerce Type Plugin Vulnerable versions = 5.3.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37203 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 165650bb5335 Credits Abdi...

WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Arbitrary File Upload

Software Pexels: Free Stock Photos Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6132 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 042650894638 Credits István Márton Required...

WordPress Easy Age Verify Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)

Software Easy Age Verify Type Plugin Vulnerable versions = 1.8.2 Fixed in 1.8.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35757 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d39f735e9e41 Credits Huynh Tien Si Required privilege...

WordPress WP Job Portal Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Job Portal Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35760 Patch priority Low CVSS severity Low 5.9 Developer Ahmad PSID 4b9d73fda6dd Credits LuxF0z Required privilege Administrator Published ...

WordPress Search & Replace Plugin < 3.2.2 is vulnerable to SQL Injection

Software Search & Replace Type Plugin Vulnerable versions 3.2.2 Fixed in 3.2.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-4145 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 279ec626c422 Credits Krugov Artyom Required privilege Administrator...

WordPress Sensei Pro (WC Paid Courses) Plugin <= 4.23.1.1.23.1 is vulnerable to Cross Site Scripting (XSS)

Software Sensei Pro WC Paid Courses Type Plugin Vulnerable versions = 4.23.1.1.23.1 Fixed in 4.24.0.1.24.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34765 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ffa624f39abc Credits Rafie...

WordPress Qi Addons For Elementor Plugin <= 1.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Qi Addons For Elementor Type Plugin Vulnerable versions = 1.7.2 Fixed in 1.7.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4364 Patch priority Low CVSS severity Low 6.5 Developer Qode Interactive PSID 0676734b6c2d Credits wesley wcraft...

WordPress Qi Blocks Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Qi Blocks Type Plugin Vulnerable versions = 1.2.9 Fixed in 1.3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5221 Patch priority Low CVSS severity Low 5.9 Developer Qode Interactive PSID 7421a294030a Credits wesley wcraft Required...

WordPress ElasticPress Plugin <= 5.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software ElasticPress Type Plugin Vulnerable versions = 5.1.1 Fixed in 5.1.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-35684 Patch priority Low CVSS severity Low 4.3 Developer 10up PSID fbb3d18344c4 Credits Ananda Dhakal Patchstack Required...

WordPress Startklar Elementor Addons Plugin <= 1.7.15 is vulnerable to Arbitrary File Deletion

Software Startklar Elementor Addons Type Plugin Vulnerable versions = 1.7.15 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-5153 Patch priority High CVSS severity High 9.1 Developer Claim ownership PSID ac59d6e1fb44 Credits stealthcopter...

WordPress RestroPress Plugin <= 3.1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software RestroPress Type Plugin Vulnerable versions = 3.1.2.1 Fixed in 3.1.2.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35719 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4f811f4d1bd1 Credits LVT-tholv2k Required privilege...

WordPress Newsletter Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Newsletter Type Plugin Vulnerable versions = 8.3.4 Fixed in 8.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5317 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a76e0f4cc75c Credits Arkadiusz Hydzik Requir...

WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Plugin <= 3.1.77 is vulnerable to Cross Site Scripting (XSS)

Software Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Type Plugin Vulnerable versions = 3.1.77 Fixed in 3.1.78 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35668 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Hash Form Plugin <= 1.1.0 is vulnerable to PHP Object Injection

Software Hash Form Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-5085 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 96e7546828a2 Credits Francesco Carlucci Required privilege...

WordPress Business Directory Plugin Plugin <= 6.4.2 is vulnerable to SQL Injection

Software Business Directory Plugin Type Plugin Vulnerable versions = 6.4.2 Fixed in 6.4.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-4443 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID e684c455bb1f Credits Krzysztof Zając Required privilege...

WordPress Rank Math SEO Plugin <= 1.0.218 is vulnerable to Cross Site Scripting (XSS)

Software Rank Math SEO Type Plugin Vulnerable versions = 1.0.218 Fixed in 1.0.219-beta OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4617 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e1bcca408b13 Credits Ngô Thiên An anco...

WordPress WP Fundraising Donation and Crowdfunding Platform Plugin <= 1.6.4 is vulnerable to Broken Access Control

Software WP Fundraising Donation and Crowdfunding Platform Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.7.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-34758 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 115891fc59b1...

WordPress Pods Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

Software Pods Type Plugin Vulnerable versions = 3.2.1 Fixed in 3.2.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3956 Patch priority Low CVSS severity Low 6.5 Developer Pods Framework PSID dfdffac18c6b Credits wesley wcraft Required privilege...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.102 is vulnerable to SQL Injection

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.102 Fixed in 1.5.105 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3055 Patch priority Low CVSS severity Low 8.5 Developer Unlimited Elements PSID 6f752cde8e3d...

WordPress Divi Theme <= 4.25.0 is vulnerable to Cross Site Scripting (XSS)

Software Divi Type Theme Vulnerable versions = 4.25.0 Fixed in 4.25.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4490 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1cc1a7dd8fd8 Credits Webbernaut Required privilege...

WordPress Form Maker by 10Web Plugin <= 1.15.24 is vulnerable to Cross Site Scripting (XSS)

Software Form Maker by 10Web Type Plugin Vulnerable versions = 1.15.24 Fixed in 1.15.25 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34437 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bccbcab6c64f Credits Huynh Tien Si Required privile...

WordPress 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin Plugin <= 3.71 is vulnerable to Cross Site Scripting (XSS)

Software 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin Type Plugin Vulnerable versions = 3.71 Fixed in 3.72 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34561 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...

WordPress WOLF Plugin <=1.0.8.2 is vulnerable to Cross Site Scripting (XSS)

Software WOLF Type Plugin Vulnerable versions =1.0.8.2 Fixed in 1.0.8.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34558 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 75bcc909e11e Credits Elmini Required privilege Administrator...

WordPress Filterable Portfolio Plugin <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Filterable Portfolio Type Plugin Vulnerable versions = 1.6.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-4234 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a352fd807519 Credits Steven Julian Required privilege...

WordPress KB Support Plugin <= 1.6.0 is vulnerable to Broken Access Control

Software KB Support Type Plugin Vulnerable versions = 1.6.0 Fixed in 1.6.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33589 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 770dfcb61dbb Credits Yudistira Arya Required privilege...

WordPress Newspaper Theme <= 12.6.5 is vulnerable to Cross Site Scripting (XSS)

Software Newspaper Type Theme Vulnerable versions = 12.6.5 Fixed in 12.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3815 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7fb86a187abf Credits István Márton Required...

WordPress WP Show Posts Plugin <= 1.1.5 is vulnerable to Sensitive Data Exposure

Software WP Show Posts Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-6731 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0bc24cb2903a Credits Lucio Sá Required privilege...

WordPress WooCommerce Plugin < 8.6 is vulnerable to Broken Access Control

Software WooCommerce Type Plugin Vulnerable versions 8.6 Fixed in 8.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-1310 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1c0523f0c515 Credits Scott Kingsley Clark Required privilege...

WordPress WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content Plugin <= 7.0 is vulnerable to Sensitive Data Exposure

Software WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content Type Plugin Vulnerable versions = 7.0 Fixed in 7.1.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-7046 Patch priority Low CVSS severity Low 7.5...

WordPress Table & Contact Form 7 Database – Tablesome Plugin <= 1.0.25 is vulnerable to Cross Site Request Forgery (CSRF)

Software Table & Contact Form 7 Database – Tablesome Type Plugin Vulnerable versions = 1.0.25 Fixed in 1.0.26 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-31388 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress WP Sort Order Plugin <= 1.3.1 is vulnerable to Broken Access Control

Software WP Sort Order Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31294 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fa1bc46c4a98 Credits CatFather Required privilege...

WordPress Watu Quiz Plugin <= 3.4.1 is vulnerable to Sensitive Data Exposure

Software Watu Quiz Type Plugin Vulnerable versions = 3.4.1 Fixed in 3.4.1.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-0872 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 458d166de345 Credits Lucio Sá Required privilege...

WordPress File Manager Plugin <= 7.2.5 is vulnerable to Path Traversal

Software File Manager Type Plugin Vulnerable versions = 7.2.5 Fixed in 7.2.6 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-2654 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 1c905e547371 Credits DarkT Required privilege Administrator...

WordPress DearFlip Plugin <= 2.2.26 is vulnerable to Cross Site Scripting (XSS)

Software DearFlip Type Plugin Vulnerable versions = 2.2.26 Fixed in 2.2.27 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29807 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 59b13b8a28ca Credits emad Required privilege Contributor Publish...