WordPress Hash Form Plugin <= 1.1.0 is vulnerable to PHP Object Injection

Software Hash Form Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-5085 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 96e7546828a2 Credits Francesco Carlucci Required privilege...

WordPress Memberpress Plugin <= 1.11.29 is vulnerable to Server Side Request Forgery (SSRF)

Software Memberpress Type Plugin Vulnerable versions = 1.11.29 Fixed in 1.11.30 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-5031 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID fdb3181ef572 Credits stealthcopter Required privileg...

WordPress NextScripts Plugin <= 4.4.3 is vulnerable to Cross Site Scripting (XSS)

Software NextScripts Type Plugin Vulnerable versions = 4.4.3 Fixed in 4.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1762 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2c09536c816a Credits Piotr Kuśpit Required...

WordPress Uber Menu Plugin <= 3.8.2 is vulnerable to Cross Site Scripting (XSS)

Software Uber Menu Type Plugin Vulnerable versions = 3.8.2 Fixed in 3.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4710 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 50d8afce240c Credits stealthcopter Required privile...

WordPress ShopLentor Plugin <= 2.8.7 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34767 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 98f1de88eaf5 Credits Ngô Thiên An ancorn from VNPT-VCI Required...

WordPress Magical Addons For Elementor Plugin <= 1.1.37 is vulnerable to Cross Site Scripting (XSS)

Software Magical Addons For Elementor Type Plugin Vulnerable versions = 1.1.37 Fixed in 1.1.38 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2923 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8f23618a4eb9 Credits João G...

WordPress Save as PDF plugin by Pdfcrowd Plugin < 3.2.0 is vulnerable to Cross Site Scripting (XSS)

Software Save as PDF plugin by Pdfcrowd Type Plugin Vulnerable versions 3.2.0 Fixed in 3.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5971 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a2f215ee118f Credits Avatar Mitu...

WordPress WP Fundraising Donation and Crowdfunding Platform Plugin <= 1.6.4 is vulnerable to Broken Access Control

Software WP Fundraising Donation and Crowdfunding Platform Type Plugin Vulnerable versions = 1.6.4 Fixed in 1.7.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-34758 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 115891fc59b1...

WordPress LearnPress Plugin <= 4.2.6.5 is vulnerable to Cross Site Scripting (XSS)

Software LearnPress Type Plugin Vulnerable versions = 4.2.6.5 Fixed in 4.2.6.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4277 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3ad5ee25dcd1 Credits stealthcopter Required...

WordPress LearnPress Plugin <= 4.2.6.5 is vulnerable to Arbitrary File Upload

Software LearnPress Type Plugin Vulnerable versions = 4.2.6.5 Fixed in 4.2.6.6 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-4397 Patch priority Medium CVSS severity Medium 9.1 Developer Claim ownership PSID e486f6c14d9b Credits JoanClarke2 Required privilege...

WordPress Porto Theme <= 7.1.0 is vulnerable to Local File Inclusion

Software Porto Type Theme Vulnerable versions = 7.1.0 Fixed in 7.1.1 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-3806 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 98785fd04b6f Credits István Márton Required privilege Unauthenticated...

WordPress Stockholm Core Plugin <= 2.4.1 is vulnerable to Local File Inclusion

Software Stockholm Core Type Plugin Vulnerable versions = 2.4.1 Fixed in 2.4.2 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-34554 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID f9aa82fd3a5e Credits Rafie Muhammad Patchstack Required privileg...

WordPress Contact Form by WPForms Plugin <= 1.8.7.2 is vulnerable to Broken Access Control

Software Contact Form by WPForms Type Plugin Vulnerable versions = 1.8.7.2 Fixed in 1.8.8.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-3649 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID f3183fdcee99 Credits Asaf Mozes Require...

WordPress Simple Image Popup Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

Software Simple Image Popup Type Plugin Vulnerable versions = 2.4.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-4433 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 884d37bdacd5 Credits Cronus Required privilege Administrato...

WordPress Realtyna Organic IDX plugin Plugin <= 4.14.4 is vulnerable to Cross Site Scripting (XSS)

Software Realtyna Organic IDX plugin Type Plugin Vulnerable versions = 4.14.4 Fixed in 4.14.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33924 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9af5852216f6 Credits Muhammad Daffa...

WordPress WTI Like Post Plugin <= 1.4.6 is vulnerable to Bypass Vulnerability

Software WTI Like Post Type Plugin Vulnerable versions = 1.4.6 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2024-33917 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 2def3782f557 Credits Mika Required privilege...

WordPress Democracy Poll Plugin <= 6.0.3 is vulnerable to Broken Access Control

Software Democracy Poll Type Plugin Vulnerable versions = 6.0.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33920 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 4ebe2afd67c8 Credits thiennv Required privilege...

WordPress Virtue Theme <= 3.4.8 is vulnerable to Cross Site Scripting (XSS)

Software Virtue Type Theme Vulnerable versions = 3.4.8 Fixed in 3.4.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4034 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ec8a02debee1 Credits stealthcopter Required privilege...

WordPress Pop-up Plugin <= 1.2.3 is vulnerable to Broken Access Control

Software Pop-up Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31435 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f2085d0cd912 Credits Dhabaleshwar Das Required privilege...

WordPress PopupAlly Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

Software PopupAlly Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33639 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ac9794d90ae4 Credits Manab Jyoti Dowarah Required privilege...

WordPress Five Star Restaurant Reservations Plugin <= 2.6.16 is vulnerable to Broken Access Control

Software Five Star Restaurant Reservations Type Plugin Vulnerable versions = 2.6.16 Fixed in 2.6.17 OWASP Top 10 A4: Insecure Design Classification Broken Access Control CVE CVE-2024-33596 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d75b86943c20 Credits Steven Julian...

WordPress Barcode Scanner with Inventory & Order Manager Plugin <= 1.5.3 is vulnerable to Broken Access Control

Software Barcode Scanner with Inventory & Order Manager Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-33565 Patch priority High CVSS severity High 9.1 Developer DMitry PSID 256e9c100507 Credits Rafie...

WordPress XStore Theme <= 9.3.8 is vulnerable to Cross Site Scripting (XSS)

Software XStore Type Theme Vulnerable versions = 9.3.8 Fixed in 9.3.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33562 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5d1626b7824f Credits Rafie Muhammad Patchstack Required privile...

WordPress StreamWeasels Twitch Integration plugin <= 1.7.8 - API Sensitive Data Exposure vulnerability

API Sensitive Data Exposure vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin StreamWeasels Twitch Integration versions = 1.7.8...

WordPress Conversational Forms for ChatBot Plugin <= 1.1.8 is vulnerable to Arbitrary File Download

Software Conversational Forms for ChatBot Type Plugin Vulnerable versions = 1.1.8 Fixed in 1.2.0 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-32729 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 27e83c0724e4 Credits Yudistira...

WordPress Advanced Testimonial Carousel for Elementor Plugin <= 3.0.0 is vulnerable to Broken Access Control

Software Advanced Testimonial Carousel for Elementor Type Plugin Vulnerable versions = 3.0.0 Fixed in 3.0.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32783 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 35c8e0e158f5 Credits...

WordPress Olive One Click Demo Import Plugin <= 1.1.1 is vulnerable to Arbitrary File Download

Software Olive One Click Demo Import Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-32715 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID a4c06fc8a3c4 Credits Yudistira Arya...

WordPress Ivory Search Plugin <= 5.5.5 is vulnerable to Broken Access Control

Software Ivory Search Type Plugin Vulnerable versions = 5.5.5 Fixed in 5.5.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3233 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5ff3a7d3e493 Credits Thura Moe Myint mgthuramoemyint...

WordPress WPBakery Page Builder Plugin <= 7.5 is vulnerable to Cross Site Scripting (XSS)

Software WPBakery Page Builder Type Plugin Vulnerable versions = 7.5 Fixed in 7.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1805 Patch priority Low CVSS severity Low 6.5 Developer WPBakery PSID 39eddcd5a992 Credits Nikolas Required privilege...

WordPress Legal Pages plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Legal Pages versions = 1.4.2...

WordPress Essential Grid Plugin <= 3.1.1 is vulnerable to Broken Access Control

Software Essential Grid Type Plugin Vulnerable versions = 3.1.1 Fixed in 3.1.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3235 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 597aadc22d06 Credits 1337Wannabe Required privilege...

WordPress Popup by Supsystic Plugin <= 1.10.27 is vulnerable to Broken Access Control

Software Popup by Supsystic Type Plugin Vulnerable versions = 1.10.27 Fixed in 1.10.28 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31421 Patch priority Low CVSS severity Low 4.3 Developer Supsystic PSID 5734d7bec770 Credits Steven Julian Required...

WordPress Redirect Redirection Plugin <= 1.1.9 is vulnerable to Broken Access Control

Software Redirect Redirection Type Plugin Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31435 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 083a31c079c9 Credits Dhabaleshwar Das Require...

WordPress Default Mag Theme <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Default Mag Type Theme Vulnerable versions = 1.3.5 Fixed in 1.3.6 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31386 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 38907f8269e6 Credits Dhabaleshwar Das Require...

WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin <= 4.4.2 is vulnerable to Broken Access Control

Software WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Type Plugin Vulnerable versions = 4.4.2 Fixed in 4.4.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3216 Patch priority Low CVSS severity Low 5.3 Developer Claim...

WordPress NextGEN Gallery Plugin <= 3.59 is vulnerable to Broken Access Control

Software NextGEN Gallery Type Plugin Vulnerable versions = 3.59 Fixed in 3.59.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3097 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 1d6376e4869c Credits Peng Zhou Required privilege...

WordPress WordPress Tooltips plugin <= 9.5.3 - Cross Site Request Forgery (CSRF) leading to Stored XSS vulnerability

Cross Site Request Forgery CSRF leading to Stored XSS vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin WordPress Tooltips versions = 9.5.3...

WordPress Tracking Code Manager Plugin <= 2.1.0 is vulnerable to Broken Access Control

Software Tracking Code Manager Type Plugin Vulnerable versions = 2.1.0 Fixed in 2.2.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31347 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 51665fb13771 Credits Abdi Pranata Required...

WordPress WordPress Backup & Migration Plugin <= 1.4.7 is vulnerable to Sensitive Data Exposure

Software WordPress Backup & Migration Type Plugin Vulnerable versions = 1.4.7 Fixed in 1.4.8 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-31254 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID aa1b650827bf...

WordPress is vulnerable to Sensitive Data Exposure

Software WordPress Type WordPress Core Vulnerable versions = 6.4.3 Fixed in 6.5 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-5692 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5d6f8d7b72aa Credits Francesco Carlucci Require...

WordPress Watu Quiz Plugin <= 3.4.1 is vulnerable to Sensitive Data Exposure

Software Watu Quiz Type Plugin Vulnerable versions = 3.4.1 Fixed in 3.4.1.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-0872 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 458d166de345 Credits Lucio Sá Required privilege...

WordPress Oxygen Builder Plugin <= 4.9 is vulnerable to Remote Code Execution (RCE)

Software Oxygen Builder Type Plugin Vulnerable versions = 4.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-31380 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 4b3933c6a6e8 Credits Snicco Required privilege Contributo...

WordPress Essential Addons for Elementor Plugin <= 5.9.13 is vulnerable to Sensitive Data Exposure

Software Essential Addons for Elementor Type Plugin Vulnerable versions = 5.9.13 Fixed in 5.9.14 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2974 Patch priority Low CVSS severity Low 5.3 Developer WPDeveloper PSID 724b318703c8 Credits Ankit Patel...

WordPress Elements kit Elementor addons Plugin <= 3.0.6 is vulnerable to Local File Inclusion

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.0.6 Fixed in 3.0.7 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-2047 Patch priority Low CVSS severity Low 8.5 Developer Wpmet PSID 9c94438e55c2 Credits wesley wcraft Required privilege...

WordPress DD Rating plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Cronus Patchstack Alliance in WordPress Plugin DD Rating versions = 1.7.1...

WordPress iFlyChat – WordPress Chat Plugin <= 4.7.2 is vulnerable to Cross Site Scripting (XSS)

Software iFlyChat – WordPress Chat Type Plugin Vulnerable versions = 4.7.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31108 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d092a7fe63ad Credits LVT-tholv2k Required privilege...

WordPress OSS Aliyun Plugin <= 1.4.10 is vulnerable to SQL Injection

Software OSS Aliyun Type Plugin Vulnerable versions = 1.4.10 Fixed in 1.4.11 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-30494 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID f4acc3b1af32 Credits Majed Refaea Required privilege Administrator...

WordPress Youzify Buddypress Moderation Plugin <= 1.2.5 is vulnerable to Cross Site Scripting (XSS)

Software Youzify Buddypress Moderation Type Plugin Vulnerable versions = 1.2.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-2864 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 8372e235157d Credits Esteban Segura Ripoll...

WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom WooCommerce Checkout Fields Editor Type Plugin Vulnerable versions = 1.3.1 Fixed in 1.3.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1697 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 655df2bce9e7...

WordPress BuddyForms Plugin <= 2.8.5 is vulnerable to Cross Site Scripting (XSS)

Software BuddyForms Type Plugin Vulnerable versions = 2.8.5 Fixed in 2.8.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-30198 Patch priority Low CVSS severity Low 5.8 Developer Claim ownership PSID f21da7d6bb61 Credits Dimas Maulana Required privilege...