WordPress WP-Recall Plugin <= 16.26.8 is vulnerable to Insecure Direct Object References (IDOR)

Software WP-Recall Type Plugin Vulnerable versions = 16.26.8 Fixed in 16.26.9 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-8292 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 49cff2ea1861 Credits wesley wcraft...

WordPress Content Blocks (Custom Post Widget) Plugin <= 3.3.5 is vulnerable to Cross Site Scripting (XSS)

Software Content Blocks Custom Post Widget Type Plugin Vulnerable versions = 3.3.5 Fixed in 3.3.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44051 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b50c32e861c5 Credits lowol ngo Required...

WordPress The Ultimate WordPress Toolkit – WP Extended Plugin <= 3.0.8 is vulnerable to Sensitive Data Exposure

Software The Ultimate WordPress Toolkit – WP Extended Type Plugin Vulnerable versions = 3.0.8 Fixed in 3.0.9 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-8106 Patch priority Medium CVSS severity Medium 6.5 Developer WP Extended PSID 027663c0c476...

WordPress WP Job Portal Plugin <= 2.1.6 is vulnerable to Broken Access Control

Software WP Job Portal Type Plugin Vulnerable versions = 2.1.6 Fixed in 2.1.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-7950 Patch priority High CVSS severity High 9.8 Developer Ahmad PSID 3162f7bd55ec Credits Connor Billings Required privilege...

WordPress Enfold Theme <= 6.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Enfold Type Theme Vulnerable versions = 6.0.3 Fixed in 6.0.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5061 Patch priority Low CVSS severity Low 6.5 Developer Kriesi PSID 85813e2bbfbb Credits stealthcopter Required privilege Contributo...

WordPress The Post Grid Plugin <= 7.7.11 is vulnerable to Sensitive Data Exposure

Software The Post Grid Type Plugin Vulnerable versions = 7.7.11 Fixed in 7.7.12 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-7418 Patch priority Low CVSS severity Low 4.3 Developer Mamunur Rashid PSID 5912b382937d Credits stealthcopter Required...

WordPress Taxi Booking Manager for WooCommerce Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)

Software Taxi Booking Manager for WooCommerce Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43986 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID cd7a0b805b0e Credits Sharanabasappa...

WordPress Funnelforms Free Plugin <= 3.7.3.2 is vulnerable to Arbitrary File Deletion

Software Funnelforms Free Type Plugin Vulnerable versions = 3.7.3.2 Fixed in 3.7.4.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-6312 Patch priority Low CVSS severity Low 5.5 Developer Claim ownership PSID 8300ca56d7fc Credits István Márton Required...

WordPress SendGrid for WordPress Plugin <= 1.4 is vulnerable to SQL Injection

Software SendGrid for WordPress Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-43965 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 897d693aed88 Credits Ananda Dhakal Patchstack Required privilege...

WordPress LiteSpeed Cache Plugin <= 6.3.0.1 is vulnerable to Privilege Escalation

Software LiteSpeed Cache Type Plugin Vulnerable versions = 6.3.0.1 Fixed in 6.4 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-28000 Patch priority High CVSS severity High 9.8 Developer Hai Zheng / Lite Speed Cache PSID b9efa0ab6b82...

WordPress oik Plugin <= 4.12.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software oik Type Plugin Vulnerable versions = 4.12.0 Fixed in 4.12.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43356 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 865f6e2dc335 Credits Abdi Pranata Required privile...

WordPress Ultimate Store Kit Elementor Addons Plugin <= 1.6.4 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Store Kit Elementor Addons Type Plugin Vulnerable versions = 1.6.4 Fixed in 2.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43342 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bae240e72e97 Credits 4rCanJ0x! Required...

WordPress Form Maker by 10Web Plugin <= 1.15.26 is vulnerable to Cross Site Scripting (XSS)

Software Form Maker by 10Web Type Plugin Vulnerable versions = 1.15.26 Fixed in 1.15.27 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43220 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 77f57c6e5d92 Credits Le Ngoc Anh Required...

WordPress Filr – Secure document library Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Filr – Secure document library Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43216 Patch priority Low CVSS severity Low 6.5 Developer Patrick Posner PSID d8538e254980 Credits domiee13 Required...

WordPress LearnPress Plugin <= 4.2.6.9.3 is vulnerable to SQL Injection

Software LearnPress Type Plugin Vulnerable versions = 4.2.6.9.3 Fixed in 4.2.6.9.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-7548 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 65b855bf9a50 Credits Lucio Sá Required privilege Contributor Publish...

WordPress Redux Framework Plugin <= 4.4.17 is vulnerable to Cross Site Scripting (XSS)

Software Redux Framework Type Plugin Vulnerable versions = 4.4.17 Fixed in 4.4.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6828 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3b2115820306 Credits villu164 Require...

WordPress Smartsupp – live chat, chatbots, AI and lead generation Plugin <= 3.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Smartsupp – live chat, chatbots, AI and lead generation Type Plugin Vulnerable versions = 3.6 Fixed in 3.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-38790 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...

WordPress JetWidgets for Elementor and WooCommerce Plugin <= 1.1.7 is vulnerable to Local File Inclusion

Software JetWidgets for Elementor and WooCommerce Type Plugin Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2024-38772 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8f1a24339fa6 Credits João...

WordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.20 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Addons for WPBakery Page Builder Type Plugin Vulnerable versions = 3.19.20 Fixed in 3.19.20.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5251 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 581cfa0b62a8...

WordPress Ocean Extra Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS)

Software Ocean Extra Type Plugin Vulnerable versions = 2.2.9 Fixed in 2.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37489 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 89f5ea12cc74 Credits wcraft Required privilege Contributor...

WordPress WPQA - Builder forms Addon Plugin < 6.1.1 is vulnerable to Cross Site Scripting (XSS)

Software WPQA - Builder forms Addon Type Plugin Vulnerable versions 6.1.1 Fixed in 6.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2375 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b62f23b8b86a Credits Bob Matyas...

WordPress PayPlus Payment Gateway Plugin <= 6.6.8 is vulnerable to SQL Injection

Software PayPlus Payment Gateway Type Plugin Vulnerable versions = 6.6.8 Fixed in 6.6.9 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-6205 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 47e962c92ffc Credits Project Black Required privilege...

WordPress SEOPress Plugin < 7.8 is vulnerable to Open Redirection

Software SEOPress Type Plugin Vulnerable versions 7.8 Fixed in 7.8 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2024-4900 Patch priority Low CVSS severity Low 4.1 Developer Claim ownership PSID 872385ee96c3 Credits Dmitrii Ignatyev Required privilege Contributor Published 24...

WordPress Tabs Plugin <= 4.0.6 is vulnerable to Cross Site Scripting (XSS)

Software Tabs Type Plugin Vulnerable versions = 4.0.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37120 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID cca26fed23f5 Credits Jean Tirstan T Required privilege Administrator...

WordPress Folders Plugin <= 3.0 is vulnerable to Path Traversal

Software Folders Type Plugin Vulnerable versions = 3.0 Fixed in 3.0.1 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-2023 Patch priority Medium CVSS severity Medium 4.1 Developer Claim ownership PSID 79dd420f62c9 Credits Colin Xu Required privilege Author...

WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Slider Responsive Slideshow – Image slider, Gallery slideshow versions = 1.4.0...

WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow Plugin <= 1.4.0 is vulnerable to Broken Access Control

Software Slider Responsive Slideshow – Image slider, Gallery slideshow Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.4.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35722 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress Analytify Plugin <= 5.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Analytify Type Plugin Vulnerable versions = 5.2.3 Fixed in 5.2.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-35689 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4a532a64f850 Credits Majed Refaea Required...

WordPress Qi Addons For Elementor Plugin <= 1.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Qi Addons For Elementor Type Plugin Vulnerable versions = 1.7.2 Fixed in 1.7.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4364 Patch priority Low CVSS severity Low 6.5 Developer Qode Interactive PSID 0676734b6c2d Credits wesley wcraft...

WordPress BuddyForms Plugin <= 2.8.9 is vulnerable to Bypass Vulnerability

Software BuddyForms Type Plugin Vulnerable versions = 2.8.9 Fixed in 2.8.10 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2024-5149 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5566e284be9a Credits István Márton Required privilege...

WordPress Newsletter Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

Software Newsletter Type Plugin Vulnerable versions = 8.3.4 Fixed in 8.3.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5317 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID a76e0f4cc75c Credits Arkadiusz Hydzik Requir...

WordPress WPCafe Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)

Software WPCafe Type Plugin Vulnerable versions = 2.2.24 Fixed in 2.2.26 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5427 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8e560e47961d Credits Krzysztof Zając Required...

WordPress Expert Invoice Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Expert Invoice Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5172 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e96705f138f8 Credits Guido Iván García Duva...

WordPress Web Directory Free Plugin < 1.7.0 is vulnerable to SQL Injection

Software Web Directory Free Type Plugin Vulnerable versions 1.7.0 Fixed in 1.7.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3552 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 93c3a72f236f Credits Simone Onofri Kim Cerra Andrea De Dominicis...

WordPress KKProgressbar2 Free Plugin <= 1.1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software KKProgressbar2 Free Type Plugin Vulnerable versions = 1.1.4.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-4535 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1928f58a695a Credits Bob Matyas...

WordPress Photo Gallery by 10Web Plugin <= 1.8.25 is vulnerable to Broken Access Control

Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.25 Fixed in 1.8.26 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35628 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 904616965144 Credits Dhabaleshwar Das...

WordPress Memberpress Plugin <= 1.11.29 is vulnerable to Server Side Request Forgery (SSRF)

Software Memberpress Type Plugin Vulnerable versions = 1.11.29 Fixed in 1.11.30 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-5031 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID fdb3181ef572 Credits stealthcopter Required privileg...

WordPress NextScripts Plugin <= 4.4.3 is vulnerable to Cross Site Scripting (XSS)

Software NextScripts Type Plugin Vulnerable versions = 4.4.3 Fixed in 4.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1762 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2c09536c816a Credits Piotr Kuśpit Required...

WordPress Blocksy Theme <= 2.0.46 is vulnerable to Cross Site Scripting (XSS)

Software Blocksy Type Theme Vulnerable versions = 2.0.46 Fixed in 2.0.47 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4943 Patch priority Low CVSS severity Low 6.5 Developer Creative Themes PSID b3bc385251a5 Credits Ngô Thiên An ancorn Required...

WordPress Rank Math SEO Plugin <= 1.0.218 is vulnerable to Cross Site Scripting (XSS)

Software Rank Math SEO Type Plugin Vulnerable versions = 1.0.218 Fixed in 1.0.219-beta OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4617 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e1bcca408b13 Credits Ngô Thiên An anco...

WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.57 is vulnerable to PHP Object Injection

Software ShiftController Employee Shift Scheduling Type Plugin Vulnerable versions = 4.9.57 Fixed in 4.9.58 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-4733 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID c137dcbad43b Credits Peter...

WordPress Skyline WP Theme <= 1.0.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Skyline WP Type Theme Vulnerable versions = 1.0.10 Fixed in 1.0.11 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-34810 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e68045327895 Credits Dhabaleshwar Das Requir...

WordPress Form Maker by 10Web Plugin <= 1.15.24 is vulnerable to Cross Site Scripting (XSS)

Software Form Maker by 10Web Type Plugin Vulnerable versions = 1.15.24 Fixed in 1.15.25 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34437 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bccbcab6c64f Credits Huynh Tien Si Required privile...

WordPress One Click Demo Import Plugin <= 3.2.0 is vulnerable to PHP Object Injection

Software One Click Demo Import Type Plugin Vulnerable versions = 3.2.0 Fixed in 3.2.1 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-34433 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID a0133f0acd1f Credits ngductung Patchstack Alliance Requir...

WordPress EAN for WooCommerce Plugin <= 4.8.9 is vulnerable to Privilege Escalation

Software EAN for WooCommerce Type Plugin Vulnerable versions = 4.8.9 Fixed in 4.9.0 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-34370 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 628e44782b40 Credits...

WordPress WP Media Cleaner Plugin <= 6.7.2 is vulnerable to Sensitive Data Exposure

Software WP Media Cleaner Type Plugin Vulnerable versions = 6.7.2 Fixed in 6.7.3 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-33922 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 489615881bfc Credits Joshua Chan Required...

WordPress Directorist Plugin <= 7.8.6 is vulnerable to Broken Access Control

Software Directorist Type Plugin Vulnerable versions = 7.8.6 Fixed in 7.9.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33929 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4002917cae9a Credits Dhabaleshwar Das Required privile...

WordPress Smart Forms Plugin <= 2.6.91 is vulnerable to Broken Access Control

Software Smart Forms Type Plugin Vulnerable versions = 2.6.91 Fixed in 2.6.92 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33593 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 810e0b29d7f7 Credits Dhabaleshwar Das Required...

WordPress Client Dash Plugin <= 2.2.1 is vulnerable to Broken Access Control

Software Client Dash Type Plugin Vulnerable versions = 2.2.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33652 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 999732255bed Credits Skalucy Required privilege...

WordPress Elements kit Elementor addons Plugin <= 3.1.0 is vulnerable to Local File Inclusion

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.1.0 Fixed in 3.1.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3499 Patch priority Low CVSS severity Low 8.5 Developer Wpmet PSID 43728e112e86 Credits Webbernaut Required privilege Contribut...