WordPress LiteSpeed Cache Plugin <= 6.5.0.2 is vulnerable to Cross Site Scripting (XSS)

Software LiteSpeed Cache Type Plugin Vulnerable versions = 6.5.0.2 Fixed in 6.5.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47374 Patch priority Medium CVSS severity Medium 7.1 Developer Hai Zheng / Lite Speed Cache PSID b2ad66b394ec Credits TaiYou Required...

WordPress GiveWP Plugin <= 3.16.2 is vulnerable to PHP Object Injection

Software GiveWP Type Plugin Vulnerable versions = 3.16.2 Fixed in 3.16.3 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-8353 Patch priority High CVSS severity High 10 Developer Liquid Web / StellarWP PSID ab27727ec281 Credits cuokon Required privilege Unauthenticated...

WordPress MaxSlider Plugin <= 1.2.3 is vulnerable to Local File Inclusion

Software MaxSlider Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.4 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-47351 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID f9c913e9044c Credits João Pedro S Alcântara Kinorth Required privileg...

WordPress Payflex Payment Gateway Plugin <= 2.6.1 is vulnerable to Open Redirection

Software Payflex Payment Gateway Type Plugin Vulnerable versions = 2.6.1 Fixed in 2.6.2 OWASP Top 10 A3: Injection Classification Open Redirection CVE CVE-2024-47646 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID ac682bcd42a4 Credits Muhamad Agil Fachrian Required privile...

WordPress JupiterX Core Plugin <= 4.6.5 is vulnerable to Arbitrary File Upload

Software JupiterX Core Type Plugin Vulnerable versions = 4.6.5 Fixed in 4.6.6 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7772 Patch priority High CVSS severity High 10 Developer Claim ownership PSID ab3838034ebf Credits Geo Void Required privilege Unauthenticated...

WordPress ThemeHunk Plugin <= 1.0.9 is vulnerable to Broken Access Control

Software ThemeHunk Type Plugin Vulnerable versions = 1.0.9 Fixed in 1.1.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8434 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 0bcea717beb5 Credits Lucio Sá Required privilege Subscrib...

WordPress MStore API Plugin <= 4.15.3 is vulnerable to Arbitrary File Upload

Software MStore API Type Plugin Vulnerable versions = 4.15.3 Fixed in 4.15.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-8242 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 5f5d39cca07a Credits stealthcopter Required privilege...

WordPress Exit Notifier Plugin <= 1.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Exit Notifier Type Plugin Vulnerable versions = 1.9.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8730 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f179ddd5b3e3 Credits vgo0 Required privileg...

WordPress Carousel Slider Plugin < 2.2.14 is vulnerable to Cross Site Scripting (XSS)

Software Carousel Slider Type Plugin Vulnerable versions 2.2.14 Fixed in 2.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6850 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 7f793427535a Credits Krugov Artyom Required...

WordPress Envira Photo Gallery Plugin < 1.8.15 is vulnerable to Cross Site Scripting (XSS)

Software Envira Photo Gallery Type Plugin Vulnerable versions 1.8.15 Fixed in 1.8.15 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3899 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 91d28b966c51 Credits Dmitrii Ignatyev...

WordPress Frontend Dashboard Plugin <= 2.2.4 is vulnerable to Arbitrary Code Execution

Software Frontend Dashboard Type Plugin Vulnerable versions = 2.2.4 Fixed in 2.2.5 OWASP Top 10 A3: Injection Classification Arbitrary Code Execution CVE CVE-2024-8268 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 9cb7568890b1 Credits Lucio Sá Required privilege...

WordPress Ninja Forms File Uploads Extension Plugin <= 3.3.16 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms File Uploads Extension Type Plugin Vulnerable versions = 3.3.16 Fixed in 3.3.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1596 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 261b89d2f6fa Credi...

WordPress Geo Controller Plugin <= 8.7.3 is vulnerable to Broken Access Control

Software Geo Controller Type Plugin Vulnerable versions = 8.7.3 Fixed in 8.7.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7380 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c241dd8210b8 Credits Lucio Sá Required privilege...

WordPress WP Accessibility Helper (WAH) Plugin <= 0.6.2.8 is vulnerable to Broken Access Control

Software WP Accessibility Helper WAH Type Plugin Vulnerable versions = 0.6.2.8 Fixed in 0.6.2.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5987 Patch priority Low CVSS severity Low 5.4 Developer Alexander Volkov PSID d7cc8b0ae32e Credits Lucio Sá...

WordPress WP Testimonial Widget Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Testimonial Widget Type Plugin Vulnerable versions = 3.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43967 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 886cd3de89e3 Credits hnwmn Required privilege Administrat...

WordPress YARPP Plugin <= 5.30.10 is vulnerable to Broken Access Control

Software YARPP Type Plugin Vulnerable versions = 5.30.10 Fixed in 5.30.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43919 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b08b40ebe1e3 Credits Rafie Muhammad Patchstack Required...

WordPress ReviewX Plugin <= 1.6.28 is vulnerable to Broken Access Control

Software ReviewX Type Plugin Vulnerable versions = 1.6.28 Fixed in 1.6.29 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43323 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID aac7e9823c91 Credits Manab Jyoti Dowarah Required...

WordPress WooCommerce Plugin <= 9.1.2 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Type Plugin Vulnerable versions = 9.1.2 Fixed in 9.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39666 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 4e41b7df57a0 Credits stealthcopter Required privilege...

WordPress EmbedPress Plugin <= 4.0.9 is vulnerable to Local File Inclusion

Software EmbedPress Type Plugin Vulnerable versions = 4.0.9 Fixed in 4.0.10 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-43328 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 8a6dffdf0163 Credits Rafie Muhammad Patchstack Required privilege...

WordPress Christmasify! Plugin <= 1.5.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Christmasify! Type Plugin Vulnerable versions = 1.5.5 Fixed in 1.5.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7574 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 1de3d7f2fe0e Credits vgo0 Required privileg...

WordPress Mediavine Control Panel Plugin <= 2.10.4 is vulnerable to Cross Site Scripting (XSS)

Software Mediavine Control Panel Type Plugin Vulnerable versions = 2.10.4 Fixed in 2.10.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43218 Patch priority Low CVSS severity Low 6.5 Developer Mediavine PSID 447650b29419 Credits LVT-tholv2k Required privilege...

WordPress Tutor LMS Plugin <= 2.7.3 is vulnerable to Broken Access Control

Software Tutor LMS Type Plugin Vulnerable versions = 2.7.3 Fixed in 2.7.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43142 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a337e912bf3f Credits justakazh Required privilege Tutor...

WordPress Masteriyo - LMS Plugin <= 1.11.4 is vulnerable to Broken Access Control

Software Masteriyo - LMS Type Plugin Vulnerable versions = 1.11.4 Fixed in 1.11.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43158 Patch priority Low CVSS severity Low 7.5 Developer Masteriyo PSID 9c29d6b5ac47 Credits Ananda Dhakal Patchstack Required...

WordPress WordPress File Upload Plugin < 4.24.8 is vulnerable to Cross Site Scripting (XSS)

Software WordPress File Upload Type Plugin Vulnerable versions 4.24.8 Fixed in 4.24.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6651 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f705fe24e0ac Credits Đức Tài...

WordPress CRM Perks Forms Plugin <= 1.1.3 is vulnerable to Arbitrary File Upload

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-7484 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID c7c64ee12633 Credits István Márton Required privilege...

WordPress Remote Content Shortcode Plugin <= 1.5 is vulnerable to Server Side Request Forgery (SSRF)

Software Remote Content Shortcode Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-2090 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID 1a39ce70a128 Credits Francesco Carlucci Require...

WordPress Royal Elementor Addons Plugin <= 1.3.980 is vulnerable to Cross Site Scripting (XSS)

Software Royal Elementor Addons Type Plugin Vulnerable versions = 1.3.980 Fixed in 1.3.981 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5818 Patch priority Low CVSS severity Low 6.5 Developer WProyal PSID 21750c8b6654 Credits Webbernaut Required...

WordPress Funnel Builder for WordPress by FunnelKit Plugin <= 3.4.6 is vulnerable to Broken Access Control

Software Funnel Builder for WordPress by FunnelKit Type Plugin Vulnerable versions = 3.4.6 Fixed in 3.4.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6836 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f7a411b5f336 Credits Luci...

WordPress MasterStudy LMS Plugin < 3.3.24 is vulnerable to Privilege Escalation

Software MasterStudy LMS Type Plugin Vulnerable versions 3.3.24 Fixed in 3.3.24 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-5973 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 2f024467e854 Credits Jaime F...

WordPress Himalayas Theme <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Software Himalayas Type Theme Vulnerable versions = 1.3.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39629 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a02569ebfb01 Credits Michael Required privilege Administrator...

WordPress Plum: Spin Wheel & Email Pop-up Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Plum: Spin Wheel & Email Pop-up Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38744 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 688ef82694b8 Credits Ananda Dhakal Patchstack...

WordPress SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer Plugin <= 3.10.8 is vulnerable to Full Path Disclosure (FPD)

Software SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer Type Plugin Vulnerable versions = 3.10.8 Fixed in 3.10.9 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-6556 Patch priority Low CVSS severity Low 5.3 Developer WPMU DEV PSID...

WordPress Power BI Embedded for WordPress Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

Software Power BI Embedded for WordPress Type Plugin Vulnerable versions = 1.1.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37959 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d71cfc52b95c Credits Joshua Chan Required...

WordPress Generate PDF using Contact Form 7 Plugin <= 4.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Generate PDF using Contact Form 7 Type Plugin Vulnerable versions = 4.1.2 Fixed in 4.1.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37555 Patch priority Low CVSS severity Low 9.6 Developer Claim ownership PSID 2989195e2c48 Credits...

WordPress Elegant Pink theme 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Elegant Pink versions = 1.3.0...

WordPress Featured Image from URL Plugin <= 4.8.1 is vulnerable to Broken Access Control

Software Featured Image from URL Type Plugin Vulnerable versions = 4.8.1 Fixed in 4.8.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37276 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID cc8f54a6d149 Credits Rafie Muhammad...

WordPress Elementor Website Builder Plugin <= 3.22.1 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.22.1 Fixed in 3.22.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37437 Patch priority Low CVSS severity Low 5.5 Developer Elementor PSID a41c27164cdd Credits stealthcopter Required privilege...

WordPress SEOPress Plugin < 7.8 is vulnerable to Cross Site Scripting (XSS)

Software SEOPress Type Plugin Vulnerable versions 7.8 Fixed in 7.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4899 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a4a83ee6addf Credits Dmirtii Ignatyev Required privilege...

WordPress WP 2FA Plugin <= 2.6.3 is vulnerable to Sensitive Data Exposure

Software WP 2FA Type Plugin Vulnerable versions = 2.6.3 Fixed in 2.6.4 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2022-44587 Patch priority Low CVSS severity Low 5.3 Developer Melapress PSID b28422640e7b Credits Snicco Required privilege Unauthenticate...

WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Arbitrary File Upload

Software Pexels: Free Stock Photos Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6132 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 042650894638 Credits István Márton Required...

WordPress WP Job Portal Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Job Portal Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35760 Patch priority Low CVSS severity Low 5.9 Developer Ahmad PSID 4b9d73fda6dd Credits LuxF0z Required privilege Administrator Published ...

WordPress Search & Replace Plugin < 3.2.2 is vulnerable to SQL Injection

Software Search & Replace Type Plugin Vulnerable versions 3.2.2 Fixed in 3.2.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-4145 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 279ec626c422 Credits Krugov Artyom Required privilege Administrator...

WordPress Email Subscribers & Newsletters Plugin <= 5.7.22 is vulnerable to SQL Injection

Software Email Subscribers & Newsletters Type Plugin Vulnerable versions = 5.7.22 Fixed in 5.7.23 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-4845 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 382e424feada Credits Arkadiusz Hydzik Required...

WordPress Futurio Extra Plugin <= 2.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Futurio Extra Type Plugin Vulnerable versions = 2.0.5 Fixed in 2.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5646 Patch priority Low CVSS severity Low 6.5 Developer FuturioWP PSID ebce01258690 Credits wesley wcraft Required privilege...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.109 is vulnerable to SQL Injection

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.109 Fixed in 1.5.110 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-5329 Patch priority Low CVSS severity Low 8.5 Developer Unlimited Elements PSID 733124c0042b...

WordPress WP Dark Mode Plugin <= 5.0.4 is vulnerable to Broken Access Control

Software WP Dark Mode Type Plugin Vulnerable versions = 5.0.4 Fixed in 5.0.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5449 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fcf51369e44e Credits Peter Thaleikis Required privileg...

WordPress WP Time Slots Booking Form Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)

Software WP Time Slots Booking Form Type Plugin Vulnerable versions = 1.2.10 Fixed in 1.2.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35734 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 153040c885cf Credits Manab Jyoti Dowarah...

WordPress GP Premium Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

Software GP Premium Type Plugin Vulnerable versions = 2.4.0 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3469 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID dbeca6e72752 Credits 1337Wannabe - home M.Aw...

WordPress Essential Real Estate Plugin <= 4.4.4 is vulnerable to Insecure Direct Object References (IDOR)

Software Essential Real Estate Type Plugin Vulnerable versions = 4.4.4 Fixed in 4.4.5 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-4274 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ccac1e739e5c Credits Lucio S...

WordPress Essential Addons for Elementor Plugin <= 5.9.21 is vulnerable to Cross Site Scripting (XSS)

Software Essential Addons for Elementor Type Plugin Vulnerable versions = 5.9.21 Fixed in 5.9.22 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5073 Patch priority Low CVSS severity Low 6.5 Developer WPDeveloper PSID bca3152f1888 Credits stealthcopt...