49990 matches found
WordPress ProfileGrid Plugin <= 5.7.9 is vulnerable to Insecure Direct Object References (IDOR)
Software ProfileGrid Type Plugin Vulnerable versions = 5.7.9 Fixed in 5.8.0 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-32808 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID b60c26e035a2 Credits Kyle Sanchez...
WordPress ARForms Plugin <= 6.4 is vulnerable to Arbitrary File Deletion
Software ARForms Type Plugin Vulnerable versions = 6.4 Fixed in 6.4.1 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-32703 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 3d075249b9fb Credits Dave Jong Patchstack Required...
WordPress tagDiv Composer Plugin <= 4.8 is vulnerable to Local File Inclusion
Software tagDiv Composer Type Plugin Vulnerable versions = 4.8 Fixed in 4.9 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3813 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 5ffa96c3f191 Credits István Márton Required privilege Contributor...
WordPress Paid Memberships Pro Plugin <= 3.0.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Paid Memberships Pro Type Plugin Vulnerable versions = 3.0.1 Fixed in 3.0.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3215 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 707f90cd781b Credits Whit Taylor...
WordPress Simple Buttons Creator Plugin <= 1.04 is vulnerable to Cross Site Request Forgery (CSRF)
Software Simple Buttons Creator Type Plugin Vulnerable versions = 1.04 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2858 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bfe6a65231af Credits Bob Matyas...
WordPress Ultimate Member Plugin <= 2.8.4 is vulnerable to Cross Site Scripting (XSS)
Software Ultimate Member Type Plugin Vulnerable versions = 2.8.4 Fixed in 2.8.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2765 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4af1ffb7c063 Credits tiborisaak Require...
WordPress Libsyn Publisher Hub Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)
Software Libsyn Publisher Hub Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32141 Patch priority Low CVSS severity Low 4.3 Developer Libsyn PSID c755cb3750aa Credits Majed Refaea Required...
WordPress Extra Product Options Builder for WooCommerce Plugin <= 1.2.104 is vulnerable to Cross Site Request Forgery (CSRF)
Software Extra Product Options Builder for WooCommerce Type Plugin Vulnerable versions = 1.2.104 Fixed in 1.2.105 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31940 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...
WordPress Table & Contact Form 7 Database – Tablesome Plugin <= 1.0.25 is vulnerable to Cross Site Request Forgery (CSRF)
Software Table & Contact Form 7 Database – Tablesome Type Plugin Vulnerable versions = 1.0.25 Fixed in 1.0.26 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2024-31388 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...
WordPress Soledad Theme <= 8.4.5 is vulnerable to Broken Access Control
Software Soledad Type Theme Vulnerable versions = 8.4.5 Fixed in 8.4.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31367 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e4cc84a70d34 Credits Rafie Muhammad Patchstack Required...
WordPress Photo Gallery by 10Web Plugin <= 1.8.21 is vulnerable to Cross Site Scripting (XSS)
Software Photo Gallery by 10Web Type Plugin Vulnerable versions = 1.8.21 Fixed in 1.8.22 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2296 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID db9d53f79206 Credits Jobert Krohnen...
WordPress Gutenberg Blocks by Kadence Blocks Plugin < 3.2.26 is vulnerable to Cross Site Scripting (XSS)
Software Gutenberg Blocks by Kadence Blocks Type Plugin Vulnerable versions 3.2.26 Fixed in 3.2.26 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2509 Patch priority Low CVSS severity Low 6.5 Developer KadenceWP PSID 59ef6d666275 Credits Dmitrii...
WordPress Ecwid Shopping Cart Plugin <= 6.12.10 is vulnerable to Cross Site Scripting (XSS)
Software Ecwid Shopping Cart Type Plugin Vulnerable versions = 6.12.10 Fixed in 6.12.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2456 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 58dc51eadb76 Credits Krzysztof ZajÄ…c...
WordPress Contact Form 7 Newsletter Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)
Software Contact Form 7 Newsletter Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31110 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d60fc2231b4d Credits Dimas Maulana Required...
WordPress Web Icons Plugin <= 1.0.0.10 is vulnerable to Cross Site Scripting (XSS)
Software Web Icons Type Plugin Vulnerable versions = 1.0.0.10 Fixed in 1.0.0.11 OWASP Top 10 A4: Insecure Design Classification Cross Site Scripting XSS CVE CVE-2024-30445 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4f47e40e4725 Credits Steven Julian Required privilege...
WordPress Geo Controller Plugin <= 8.6.4 is vulnerable to Cross Site Scripting (XSS)
Software Geo Controller Type Plugin Vulnerable versions = 8.6.4 Fixed in 8.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30451 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e663f7c5a611 Credits LVT-tholv2k Required privilege...
WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS)
Software WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Type Plugin Vulnerable versions = 4.4.1 Fixed in 4.4.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0957 Patch priority Medium CVSS severity Medium 7.1 Developer...
WordPress Simple Job Board Plugin <= 2.11.0 is vulnerable to PHP Object Injection
Software Simple Job Board Type Plugin Vulnerable versions = 2.11.0 Fixed in 2.11.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-1813 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 0f7bf0484277 Credits Francesco Carlucci Required privilege...
WordPress WP Armour – Honeypot Anti Spam Plugin <= 2.1.13 is vulnerable to Cross Site Scripting (XSS)
Software WP Armour – Honeypot Anti Spam Type Plugin Vulnerable versions = 2.1.13 Fixed in 2.1.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29091 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0e1821a09d0d Credits Rafie Muhammad...
WordPress PropertyHive Plugin <= 2.0.9 is vulnerable to PHP Object Injection
Software PropertyHive Type Plugin Vulnerable versions = 2.0.9 Fixed in 2.0.10 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-27985 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 245763d3996e Credits CatFather Required privilege Subscribe...
WordPress Automatic Plugin <= 3.92.0 is vulnerable to SQL Injection
Software Automatic Type Plugin Vulnerable versions = 3.92.0 Fixed in 3.92.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-27956 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID aeab56860169 Credits Rafie Muhammad Patchstack Required privilege...
WordPress Calculated Fields Form Plugin 5.0.0-5.1.56 is vulnerable to Cross Site Scripting (XSS)
Software Calculated Fields Form Type Plugin Vulnerable versions 5.0.0-5.1.56 Fixed in 5.1.57 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2020 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID f60c98fd9fe8 Credits Asaf...
WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.41 is vulnerable to Broken Access Control
Software Contact Form builder with drag & drop - Kali Forms Type Plugin Vulnerable versions = 2.3.41 Fixed in 2.3.42 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1218 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5bcaca8f354c...
WordPress MasterStudy LMS Plugin <= 3.2.5 is vulnerable to SQL Injection
Software MasterStudy LMS Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.2.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-1512 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID e235479f4753 Credits Krzysztof ZajÄ…c Required privilege Unauthenticat...
WordPress Matomo Analytics Plugin <= 4.15.3 is vulnerable to Cross Site Scripting (XSS)
Software Matomo Analytics Type Plugin Vulnerable versions = 4.15.3 Fixed in 5.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6923 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d69c8015e6ca Credits Felipe Restrepo...
WordPress Total Upkeep Plugin <= 1.15.8 is vulnerable to Arbitrary File Download
Software Total Upkeep Type Plugin Vulnerable versions = 1.15.8 Fixed in 1.15.9 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-24869 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 7a4ce347d2cf Credits Yudistira Arya Required privileg...
WordPress is vulnerable to Arbitrary File Upload
Software WordPress Type WordPress Core Vulnerable versions 6.4.3 Fixed in 6.4.3 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2018-14028 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID 87a72ffd6c73 Credits Vinicius Marangoni Required privilege...
WordPress WordPress Toolbar Plugin <= 2.2.6 is vulnerable to Open Redirection
Software WordPress Toolbar Type Plugin Vulnerable versions = 2.2.6 Fixed in N/A OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2023-6389 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID ae5087bc3d96 Credits Daniel Ruf Required privilege Unauthenticated...
WordPress WP GDPR Compliance Plugin <= 2.0.22 is vulnerable to Broken Access Control
Software WP GDPR Compliance Type Plugin Vulnerable versions = 2.0.22 Fixed in 2.0.23 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-6700 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 6a981b3b2d5a Credits Lucio Sá Required...
WordPress Instant Images Plugin <= 6.1.0 is vulnerable to Broken Access Control
Software Instant Images Type Plugin Vulnerable versions = 6.1.0 Fixed in 6.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-0869 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 5f84c56450a0 Credits Sean Murphy Required...
WordPress Dragfy Addons for Elementor Plugin <= 8.3.1 is vulnerable to Cross Site Scripting (XSS)
Software Dragfy Addons for Elementor Type Plugin Vulnerable versions = 8.3.1 Fixed in 8.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0448 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 80155176471b Credits Webbernaut...
WordPress MaxButtons Plugin <= 9.7.6 is vulnerable to Cross Site Scripting (XSS)
Software MaxButtons Type Plugin Vulnerable versions = 9.7.6 Fixed in 9.7.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7029 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d11aac46fc3d Credits Webbernaut Required privilege...
WordPress Sticky Buttons Plugin <= 3.2.2 is vulnerable to Cross Site Scripting (XSS)
Software Sticky Buttons Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0703 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ba3529117da4 Credits Dipak Panchal th3.d1p4k...
WordPress WPvivid Backup and Migration Plugin <= 0.9.94 is vulnerable to Broken Access Control
Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.94 Fixed in 0.9.95 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4637 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 9fe28924b5f3 Credits Revan Arifio...
WordPress Stripe Payment Gateway for WooCommerce Plugin <= 3.7.9 is vulnerable to SQL Injection
Software Stripe Payment Gateway for WooCommerce Type Plugin Vulnerable versions = 3.7.9 Fixed in 3.8.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0705 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 8c922733cce2 Credits Francesco Carlucci Requir...
WordPress FluentForm Plugin <= 5.1.5 is vulnerable to Cross Site Scripting (XSS)
Software FluentForm Type Plugin Vulnerable versions = 5.1.5 Fixed in 5.1.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0618 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 0f6deb843ce1 Credits Akbar Kustirama Required...
WordPress Essential Addons for Elementor Plugin <= 5.9.4 is vulnerable to Cross Site Scripting (XSS)
Software Essential Addons for Elementor Type Plugin Vulnerable versions = 5.9.4 Fixed in 5.9.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0585 Patch priority Low CVSS severity Low 6.5 Developer WPDeveloper PSID 34afcc9985b8 Credits Webbernaut...
WordPress Elements kit Elementor addons Plugin <= 3.0.3 is vulnerable to Sensitive Data Exposure
Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.0.3 Fixed in 3.0.4 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-6582 Patch priority Low CVSS severity Low 5.3 Developer Wpmet PSID a4b7978812a7 Credits Nex Team Required...
WordPress Ajax Search Lite Plugin <= 4.11.4 is vulnerable to Cross Site Scripting (XSS)
Software Ajax Search Lite Type Plugin Vulnerable versions = 4.11.4 Fixed in 4.11.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-21752 Patch priority Medium CVSS severity Medium 7.1 Developer WPdreams PSID feaa068d0729 Credits Le Ngoc Anh Required privilege...
WordPress WP Adminify Plugin <= 3.1.6 is vulnerable to SQL Injection
Software WP Adminify Type Plugin Vulnerable versions = 3.1.6 Fixed in 3.1.7 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-52132 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 1e08f0f78327 Credits Muhammad Daffa Required privilege Administrator...
WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Open Redirection
Software Advanced Access Manager Type Plugin Vulnerable versions = 6.9.18 Fixed in 6.9.19 OWASP Top 10 A3: Injection Classification Open Redirection CVE CVE-2023-51675 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 56c8b177a6e3 Credits LVT-tholv2k Required privilege Autho...
WordPress Paid Memberships Pro Plugin <= 2.12.5 is vulnerable to Broken Access Control
Software Paid Memberships Pro Type Plugin Vulnerable versions = 2.12.5 Fixed in 2.12.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6855 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID fb6688b14c42 Credits Webbernaut Required...
WordPress Advanced Form Integration Plugin <= 1.75.0 is vulnerable to SQL Injection
Software Advanced Form Integration Type Plugin Vulnerable versions = 1.75.0 Fixed in 1.76.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-50853 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID b0d2ea2b120c Credits Muhammad Daffa Required privilege...
WordPress e2pdf Plugin <= 1.20.23 is vulnerable to SQL Injection
Software e2pdf Type Plugin Vulnerable versions = 1.20.23 Fixed in 1.20.24 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-50849 Patch priority Low CVSS severity Low 7.6 Developer E2Pdf.com PSID dd0c2ff3afc5 Credits Muhammad Daffa Required privilege Administrator Published 21...
WordPress Colibri Page Builder Plugin <= 1.0.246 is vulnerable to Cross Site Scripting (XSS)
Software Colibri Page Builder Type Plugin Vulnerable versions = 1.0.246 Fixed in 1.0.248 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50833 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1d11825976b2 Credits LVT-tholv2k Required privileg...
WordPress WP Project Manager Plugin < 2.6.9 is vulnerable to Cross Site Scripting (XSS)
Software WP Project Manager Type Plugin Vulnerable versions 2.6.9 Fixed in 2.6.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49860 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 61b36b2725ec Credits lttn Required privilege Subscriber...
WordPress Social Pug Plugin <= 1.30.0 is vulnerable to Broken Access Control
Software Social Pug Type Plugin Vulnerable versions = 1.30.0 Fixed in 1.30.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49193 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID eca440a51070 Credits Abdi Pranata Required...
WordPress PowerPack Pro for Elementor Plugin <= 2.9.23 is vulnerable to Cross Site Scripting (XSS)
Software PowerPack Pro for Elementor Type Plugin Vulnerable versions = 2.9.23 Fixed in 2.9.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49739 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2b872117ab59 Credits Rafie Muhammad...
WordPress JetThemeCore Plugin <= 2.1.2.1 is vulnerable to Broken Access Control
Software JetThemeCore Type Plugin Vulnerable versions = 2.1.2.1 Fixed in 2.1.2.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-48761 Patch priority Medium CVSS severity Medium 6.3 Developer Crocoblock PSID 81078e3aaad1 Credits Rafie Muhammad Patchstack...
WordPress JetBlocks For Elementor Plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS)
Software JetBlocks For Elementor Type Plugin Vulnerable versions = 1.3.8 Fixed in 1.3.8.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-48756 Patch priority Medium CVSS severity Medium 7.1 Developer Crocoblock PSID 64c07c24a704 Credits Rafie Muhammad Patchstack...