WordPress Prime Slider – Addons For Elementor Plugin <= 3.15.18 is vulnerable to Cross Site Scripting (XSS)

Software Prime Slider – Addons For Elementor Type Plugin Vulnerable versions = 3.15.18 Fixed in 3.15.19 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8442 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9f3bbb5e6b27 Credits...

WordPress Booking Calendar Plugin < 10.6.3 is vulnerable to Cross Site Scripting (XSS)

Software Booking Calendar Type Plugin Vulnerable versions 10.6.3 Fixed in 10.6.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10027 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 999b4bfc809b Credits Dmitrii Ignatyev...

WordPress Heateor Social Login Plugin <= 1.1.35 is vulnerable to Broken Authentication

Software Heateor Social Login Type Plugin Vulnerable versions = 1.1.35 Fixed in 1.1.36 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-10020 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 0cb2e3c4d2f1 Credits...

WordPress Table of Contents Plus Plugin <= 2411 is vulnerable to Cross Site Scripting (XSS)

Software Table of Contents Plus Type Plugin Vulnerable versions = 2411 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5578 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 487fd7341438 Credits Dmitrii Ignatyev...

WordPress Everest Backup Plugin <= 2.2.13 is vulnerable to Sensitive Data Exposure

Software Everest Backup Type Plugin Vulnerable versions = 2.2.13 Fixed in 2.2.14 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-10028 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID a89321fb2bfd Credits floerer Required privile...

WordPress Loginizer Plugin <= 1.9.2 is vulnerable to Broken Authentication

Software Loginizer Type Plugin Vulnerable versions = 1.9.2 Fixed in 1.9.3 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-10097 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 240cee809d7c Credits wesley wcraf...

WordPress WP Course Manager Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Course Manager Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-51658 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID fb5da93f1648 Credits SOPROBRO Required...

WordPress Multi Purpose Mail Form Plugin <= 1.0.2 is vulnerable to Arbitrary File Upload

Software Multi Purpose Mail Form Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50526 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 077c15d9e1a1 Credits stealthcopter Required privilege...

WordPress Woocommerce Product Design Plugin <= 1.0.0 is vulnerable to Arbitrary File Download

Software Woocommerce Product Design Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-50508 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 6ce68eabacf0 Credits ghsinfosec...

WordPress Multi Purpose Mail Form Plugin <= 1.0.2 is vulnerable to Arbitrary File Upload

Software Multi Purpose Mail Form Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-50484 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 3feda20596e4 Credits Bonds Required privilege...

WordPress WPS Telegram Chat Plugin <= 4.5.4 is vulnerable to Broken Access Control

Software WPS Telegram Chat Type Plugin Vulnerable versions = 4.5.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9630 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9cb16fad33b1 Credits István Márton Required privile...

WordPress WP Adminify Plugin <= 4.0.1.6 is vulnerable to Cross Site Scripting (XSS)

Software WP Adminify Type Plugin Vulnerable versions = 4.0.1.6 Fixed in 4.0.1.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8959 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a2bca67b8648 Credits Francesco Carlucci...

WordPress WooCommerce UPS Shipping – Live Rates and Access Points Plugin <= 2.3.11 is vulnerable to Broken Access Control

Software WooCommerce UPS Shipping – Live Rates and Access Points Type Plugin Vulnerable versions = 2.3.11 Fixed in 3.0.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9109 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID b3cccbff59...

WordPress WC Marketplace Plugin <= 4.2.4 is vulnerable to Broken Access Control

Software WC Marketplace Type Plugin Vulnerable versions = 4.2.4 Fixed in 4.2.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9531 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7dab4da2d17f Credits Tieu Pham Trong Nhan Required...

WordPress DearFlip Plugin <= 2.3.32 is vulnerable to Cross Site Scripting (XSS)

Software DearFlip Type Plugin Vulnerable versions = 2.3.32 Fixed in 2.3.42 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8717 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f4b31b90d091 Credits Noah Stead TurtleBurg...

WordPress WP RSS Aggregator Plugin <= 4.23.12 is vulnerable to Broken Access Control

Software WP RSS Aggregator Type Plugin Vulnerable versions = 4.23.12 Fixed in 4.23.13 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9583 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 83f2a48a109e Credits incognito Required...

WordPress News Kit Elementor Addons Plugin <= 1.2.1 is vulnerable to Sensitive Data Exposure

Software News Kit Elementor Addons Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-9541 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1aff69c2a359 Credits Nishiv Required...

WordPress 3D Work In Progress Plugin <= 1.0.3 is vulnerable to Arbitrary File Deletion

Software 3D Work In Progress Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2024-49657 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 209728d5f5a9 Credits stealthcopter Required privilege...

WordPress Click to Chat – WP Support All-in-One Floating Widget Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Click to Chat – WP Support All-in-One Floating Widget Type Plugin Vulnerable versions = 2.3.3 Fixed in 2.3.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10055 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID...

WordPress Photo Gallery Builder Plugin <= 3.0 is vulnerable to Broken Access Control

Software Photo Gallery Builder Type Plugin Vulnerable versions = 3.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-49325 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID db6c940f3de7 Credits Marek Mikita Required...

WordPress Cooked Pro Plugin < 1.8.0 is vulnerable to Arbitrary File Upload

Software Cooked Pro Type Plugin Vulnerable versions 1.8.0 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-49291 Patch priority High CVSS severity High 10 Developer Claim ownership PSID ca91d1c3c8bf Credits RE-ALTER Required privilege Unauthenticated...

WordPress File Manager Pro Plugin <= 8.3.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software File Manager Pro Type Plugin Vulnerable versions = 8.3.9 Fixed in 8.3.10 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8507 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID caf0adb29b86 Credits TANG Cheuk Hei...

WordPress ElementInvader Addons for Elementor Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)

Software ElementInvader Addons for Elementor Type Plugin Vulnerable versions = 1.2.8 Fixed in 1.2.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9888 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2293b37c11ea Credits Coli...

WordPress Primary Addon for Elementor Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)

Software Primary Addon for Elementor Type Plugin Vulnerable versions = 1.5.8 Fixed in 1.5.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49259 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c68882b5abc9 Credits João Pedro S Alcântara...

WordPress Wsify Widget Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Wsify Widget Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Request Forgery CSRF CVE CVE-2024-48048 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 8cbe83f02c6b Credits Joshua Chan Required privilege...

WordPress ImagePress Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software ImagePress Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9776 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 25140d2def61 Credits 家桥 王 Required privilege...

WordPress The Plus Addons for Elementor Page Builder Lite Plugin <= 5.6.11 is vulnerable to Sensitive Data Exposure

Software The Plus Addons for Elementor Page Builder Lite Type Plugin Vulnerable versions = 5.6.11 Fixed in 5.6.12 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-8913 Patch priority Low CVSS severity Low 6.5 Developer POSIMYTH Innovations PSID...

WordPress Telecash Ricaricaweb Plugin <= 2.2 is vulnerable to PHP Object Injection

Software Telecash Ricaricaweb Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-48030 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 7743976bb673 Credits LVT-tholv2k Required privilege...

WordPress Contact Form Widget Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Contact Form Widget Type Plugin Vulnerable versions = 1.4.2 Fixed in 1.4.3 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-48037 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5cb5ac9f9e50 Credits Abdi Pranata...

WordPress SB Random Posts Widget Plugin <= 1.0 is vulnerable to Local File Inclusion

Software SB Random Posts Widget Type Plugin Vulnerable versions = 1.0 Fixed in 1.1 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-48029 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 4e7fd324ea44 Credits João Pedro S Alcântara Kinorth Required...

WordPress Limit Login Attempts Plugin <= 5.3 is vulnerable to Bypass Vulnerability

Software Limit Login Attempts Type Plugin Vulnerable versions = 5.3 Fixed in 5.4 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2022-4534 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 03e4ff962fd9 Credits rezaduty Required privilege Publishe...

WordPress Display Medium Posts Plugin <= 5.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Display Medium Posts Type Plugin Vulnerable versions = 5.0.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9445 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 06e0b332337b Credits theviper17y Required...

WordPress Hello World Plugin <= 2.1.1 is vulnerable to Arbitrary File Download

Software Hello World Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-9224 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 936cc3342bfb Credits yudha Required privilege...

WordPress Loggedin Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Loggedin Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9228 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ab329401c416 Credits vgo0 Required privilege...

WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress Plugin <= 8.4.1 is vulnerable to Privilege Escalation

Software Affiliate Pro - Affiliate Program for WooCommerce & WordPress Type Plugin Vulnerable versions = 8.4.1 Fixed in 8.5.0 OWASP Top 10 A4: Insecure Design Classification Privilege Escalation CVE CVE-2024-9289 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID a5bcf0c87e...

WordPress GiveWP Plugin <= 3.16.2 is vulnerable to PHP Object Injection

Software GiveWP Type Plugin Vulnerable versions = 3.16.2 Fixed in 3.16.3 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-8353 Patch priority High CVSS severity High 10 Developer Liquid Web / StellarWP PSID ab27727ec281 Credits cuokon Required privilege Unauthenticated...

WordPress LiteSpeed Cache Plugin <= 6.5.0.2 is vulnerable to Cross Site Scripting (XSS)

Software LiteSpeed Cache Type Plugin Vulnerable versions = 6.5.0.2 Fixed in 6.5.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47374 Patch priority Medium CVSS severity Medium 7.1 Developer Hai Zheng / Lite Speed Cache PSID b2ad66b394ec Credits TaiYou Required...

WordPress BuddyForms Plugin <= 2.8.12 is vulnerable to Cross Site Scripting (XSS)

Software BuddyForms Type Plugin Vulnerable versions = 2.8.12 Fixed in 2.8.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47377 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9418faef5fbf Credits SOPROBRO Required privilege Editor...

WordPress Copyscape Premium Plugin <= 1.3.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software Copyscape Premium Type Plugin Vulnerable versions = 1.3.9 Fixed in 1.4.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-47644 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 44e490f9b2ae Credits Abdi Pranata...

WordPress JobSearch Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS)

Software JobSearch Type Plugin Vulnerable versions = 2.5.9 Fixed in 2.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47394 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2995ae22faae Credits Bonds Required privilege Unauthenticat...

WordPress Popup Maker Plugin <= 1.19.2 is vulnerable to Broken Access Control

Software Popup Maker Type Plugin Vulnerable versions = 1.19.2 Fixed in 1.20.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47358 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 050e5f472f00 Credits Rafie Muhammad Patchstack...

WordPress EventPrime Plugin <= 4.0.4.5 is vulnerable to Open Redirection

Software EventPrime Type Plugin Vulnerable versions = 4.0.4.5 Fixed in 4.0.4.6 OWASP Top 10 A3: Injection Classification Open Redirection CVE CVE-2024-47648 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 5cc95dc439ed Credits Muhamad Agil Fachrian Required privilege...

WordPress AI ChatBot with ChatGPT and Content Generator by AYS Plugin <= 2.0.9 is vulnerable to Sensitive Data Exposure

Software AI ChatBot with ChatGPT and Content Generator by AYS Type Plugin Vulnerable versions = 2.0.9 Fixed in 2.1.0 OWASP Top 10 A4: Insecure Design Classification Sensitive Data Exposure CVE CVE-2024-7713 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID 5f8161e14afa Credi...

WordPress ElementsReady Addons for Elementor Plugin <= 6.4.0 is vulnerable to Cross Site Scripting (XSS)

Software ElementsReady Addons for Elementor Type Plugin Vulnerable versions = 6.4.0 Fixed in 6.4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47329 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79bbffb3d8c7 Credits João Pedro S...

WordPress Elements kit Elementor addons Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8546 Patch priority Low CVSS severity Low 6.5 Developer Wpmet PSID 43112ffb0d64 Credits zer0gh0st Required...

WordPress ThemeHunk Plugin <= 1.0.9 is vulnerable to Broken Access Control

Software ThemeHunk Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.1.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8434 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 0bcea717beb5 Credits Lucio Sá Required privilege Subscrib...

WordPress WooCommerce Multilingual & Multicurrency Plugin <= 5.3.6 is vulnerable to Broken Access Control

Software WooCommerce Multilingual & Multicurrency Type Plugin Vulnerable versions = 5.3.6 Fixed in 5.3.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-44006 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5e4519a377a3 Credits Rafi...

WordPress Exit Notifier Plugin <= 1.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Exit Notifier Type Plugin Vulnerable versions = 1.9.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8730 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f179ddd5b3e3 Credits vgo0 Required privileg...

WordPress Starbox Plugin < 3.5.2 is vulnerable to Cross Site Scripting (XSS)

Software Starbox Type Plugin Vulnerable versions 3.5.2 Fixed in 3.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7955 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 8d336cf2178c Credits Krugov Artyom Required privilege...

WordPress WP-Recall Plugin <= 16.26.8 is vulnerable to Insecure Direct Object References (IDOR)

Software WP-Recall Type Plugin Vulnerable versions = 16.26.8 Fixed in 16.26.9 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-8292 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 49cff2ea1861 Credits wesley wcraft...