WordPress Avada Theme <= 7.11.6 is vulnerable to SQL Injection

Software Avada Type Theme Vulnerable versions = 7.11.6 Fixed in 7.11.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-2344 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 15fee136284a Credits Muhammad Zeeshan Xib3rR4dAr Required privilege Administrato...

WordPress Backup Bolt Plugin <= 1.3.0 is vulnerable to Sensitive Data Exposure

Software Backup Bolt Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.4.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-7236 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID dd36f15c489e Credits Dmitrii Ignatyev Required...

WordPress PowerPack Lite for Beaver Builder Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software PowerPack Lite for Beaver Builder Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2289 Patch priority Low CVSS severity Low 6.5 Developer IdeaBox Creations PSID 9d2284f4a282 Credits...

WordPress Post SMTP Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

Software Post SMTP Type Plugin Vulnerable versions = 2.8.6 Fixed in 2.8.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29128 Patch priority Medium CVSS severity Medium 7.1 Developer WPExperts PSID d4415453cdb3 Credits Le Ngoc Anh Required privilege Unauthenticat...

WordPress WP Popups Plugin <= 2.1.5.5 is vulnerable to Cross Site Scripting (XSS)

Software WP Popups Type Plugin Vulnerable versions = 2.1.5.5 Fixed in 2.1.5.6 OWASP Top 10 A7: Identification and Authentication Failures Classification Cross Site Scripting XSS CVE CVE-2024-29105 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 35ef43496a84 Credits Huynh...

WordPress BuddyForms Plugin <= 2.8.7 is vulnerable to Broken Access Control

Software BuddyForms Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1158 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2d73d2a4cbed Credits Lucio Sá Required privilege...

WordPress Happy Addons for Elementor Plugin <= 3.10.3 is vulnerable to Cross Site Scripting (XSS)

Software Happy Addons for Elementor Type Plugin Vulnerable versions = 3.10.3 Fixed in 3.10.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1377 Patch priority Low CVSS severity Low 6.5 Developer Leevio PSID e141aaa43d8e Credits Nikolas Required...

WordPress BuddyForms Plugin <= 2.8.7 is vulnerable to Broken Access Control

Software BuddyForms Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1170 Patch priority High CVSS severity High 8.2 Developer Claim ownership PSID 07e9d4cd19c1 Credits Lucio Sá Required privilege...

WordPress Download Manager Plugin <= 3.2.84 is vulnerable to Broken Access Control

Software Download Manager Type Plugin Vulnerable versions = 3.2.84 Fixed in 3.2.85 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6785 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 049e661b5aa7 Credits wesley wcraft Required...

WordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File Upload

Software MoveTo Type Plugin Vulnerable versions = 6.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-25913 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 08fbe7e305e7 Credits Dave Jong Patchstack Required privilege Unauthenticat...

WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.5 is vulnerable to Cross Site Scripting (XSS)

Software NEX-Forms – Ultimate Form Builder Type Plugin Vulnerable versions = 8.5.5 Fixed in 8.5.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-25593 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 87e47cb4335f Credits Ngô Thiên An ancorn...

WordPress Shortcodes Ultimate Plugin <= 7.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Shortcodes Ultimate Type Plugin Vulnerable versions = 7.0.1 Fixed in 7.0.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0792 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 60b85feef073 Credits Webbernaut Required...

WordPress WP RSS Aggregator Plugin <= 4.23.5 is vulnerable to Server Side Request Forgery (SSRF)

Software WP RSS Aggregator Type Plugin Vulnerable versions = 4.23.5 Fixed in 4.23.6 OWASP Top 10 A1: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2024-0628 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID dd1943fc88ab Credits Colin Xu Requir...

WordPress Shareaholic Plugin <= 9.7.11 is vulnerable to Broken Access Control

Software Shareaholic Type Plugin Vulnerable versions = 9.7.11 Fixed in 9.7.12 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-24709 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID e941ba723f22 Credits Abdi Pranata Required...

WordPress Image Tag Manager Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)

Software Image Tag Manager Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A4: Insecure Design Classification Cross Site Scripting XSS CVE CVE-2024-22160 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 21a3315fa407 Credits Dimas Maulana Required...

WordPress CformsII Plugin <= 15.0.6 is vulnerable to Cross Site Scripting (XSS)

Software CformsII Type Plugin Vulnerable versions = 15.0.6 Fixed in 15.0.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22149 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2aac355b9ab7 Credits emad Required privilege Unauthenticat...

WordPress Wp Ultimate Review Plugin <= 2.3.5 is vulnerable to Bypass Vulnerability

Software Wp Ultimate Review Type Plugin Vulnerable versions = 2.3.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Bypass Vulnerability CVE CVE-2024-21746 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID a561906d804e Credits Mika Required privilege...

WordPress Happy Addons for Elementor Plugin <= 3.9.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Happy Addons for Elementor Type Plugin Vulnerable versions = 3.9.1.1 Fixed in 3.10.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6632 Patch priority Low CVSS severity Low 6.1 Developer Leevio PSID 55912c88d746 Credits xEHLE Required...

WordPress Depicter Slider Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Depicter Slider Type Plugin Vulnerable versions = 2.0.6 Fixed in 2.0.7 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6493 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 15e2f683e7f4 Credits Rafshanzani Suhada...

WordPress LearnPress Plugin <= 4.2.5.7 is vulnerable to Insecure Direct Object References (IDOR)

Software LearnPress Type Plugin Vulnerable versions = 4.2.5.7 Fixed in 4.2.5.8 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-6223 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d81a8f21bcf7 Credits lttn Required...

WordPress Product Feed Manager Plugin <= 7.3.15 is vulnerable to Directory Traversal

Software Product Feed Manager Type Plugin Vulnerable versions = 7.3.15 Fixed in 7.3.16 OWASP Top 10 A4: Insecure Design Classification Directory Traversal CVE CVE-2023-52144 Patch priority Low CVSS severity Low 5.5 Developer WPFunnels Team PSID 19683c0fecc1 Credits Muhammad Daffa Required privile...

WordPress Booster Elite for WooCommerce Plugin < 7.1.3 is vulnerable to Content Injection

Software Booster Elite for WooCommerce Type Plugin Vulnerable versions 7.1.3 Fixed in 7.1.3 OWASP Top 10 A1: Broken Access Control Classification Content Injection CVE CVE-2023-51511 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1e2bd30a7dcc Credits Dave Jong...

WordPress Build App Online Plugin <= 1.0.21 is vulnerable to Privilege Escalation

Software Build App Online Type Plugin Vulnerable versions = 1.0.21 Fixed in 1.0.22 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51478 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 30eb1e208be5 Credits Rafi...

WordPress Beaver Builder Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Beaver Builder Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50889 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c34e72dc456f Credits Rafie Muhammad Patchstack Required...

WordPress BookIt Plugin <= 2.4.3 is vulnerable to SQL Injection

Software BookIt Type Plugin Vulnerable versions = 2.4.3 Fixed in 2.4.4 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-50852 Patch priority Low CVSS severity Low 7.6 Developer Liquid Web / StellarWP PSID 93198e5bb403 Credits Muhammad Daffa Required privilege Administrator...

WordPress GeoDirectory Plugin <= 2.3.28 is vulnerable to SQL Injection

Software GeoDirectory Type Plugin Vulnerable versions = 2.3.28 Fixed in 2.3.29 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-50845 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID f05f7daa6d4b Credits Muhammad Daffa Required privilege Administrator...

WordPress Colibri Page Builder Plugin <= 1.0.246 is vulnerable to Cross Site Scripting (XSS)

Software Colibri Page Builder Type Plugin Vulnerable versions = 1.0.246 Fixed in 1.0.248 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50833 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 1d11825976b2 Credits LVT-tholv2k Required privileg...

WordPress Backup Migration Plugin <= 1.3.7 is vulnerable to Remote Code Execution (RCE)

Software Backup Migration Type Plugin Vulnerable versions = 1.3.7 Fixed in 1.3.8 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2023-6553 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 15fd093fe1d5 Credits N/A Required privilege...

WordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software WOOCS – WooCommerce Currency Switcher Type Plugin Vulnerable versions = 1.4.1.4 Fixed in 1.4.1.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49834 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dcb04c679c38...

WordPress Advanced Database Cleaner Plugin <= 3.1.2 is vulnerable to SQL Injection

Software Advanced Database Cleaner Type Plugin Vulnerable versions = 3.1.2 Fixed in 3.1.3 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-49764 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 18ca57291df6 Credits Mika Required privilege Administrator...

WordPress Couponis Demo Plugin < 2.2 is vulnerable to SQL Injection

Software Couponis Demo Type Plugin Vulnerable versions 2.2 Fixed in 2.2 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-49750 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 697cadbd26d0 Credits RE-ALTER Required privilege Unauthenticated Published 4...

WordPress JetWooBuilder Plugin <= 2.1.7.2 is vulnerable to Broken Access Control

Software JetWooBuilder Type Plugin Vulnerable versions = 2.1.7.2 Fixed in 2.1.7.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-48760 Patch priority Medium CVSS severity Medium 8.2 Developer Crocoblock PSID 8b8b6528e3fb Credits Rafie Muhammad Patchstack...

WordPress BigCommerce Plugin <= 5.1.1 is vulnerable to Sensitive Data Exposure

Software BigCommerce Type Plugin Vulnerable versions = 5.1.1 Fixed in N/A OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2023-49162 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e6538cb5a9be Credits Joshua Chan...

WordPress BookingPress Plugin <= 1.0.76 is vulnerable to Arbitrary File Upload

Software BookingPress Type Plugin Vulnerable versions = 1.0.76 Fixed in 1.0.77 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-6219 Patch priority Low CVSS severity Low 6.6 Developer Claim ownership PSID d9226b37951c Credits István Márton Required privilege...

WordPress Widgets for Wordpress Reviews Plugin <= 11.0.2 is vulnerable to Arbitrary File Upload

Software Widgets for Wordpress Reviews Type Plugin Vulnerable versions = 11.0.2 Fixed in 11.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-48275 Patch priority Medium CVSS severity Medium 8 Developer Claim ownership PSID 382b3841f916 Credits Rafie Muhammad Patchsta...

WordPress Shortcodes Ultimate Plugin <= 5.13.3 is vulnerable to Cross Site Scripting (XSS)

Software Shortcodes Ultimate Type Plugin Vulnerable versions = 5.13.3 Fixed in 7.0.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6225 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f77e11ca5365 Credits Francesco Carlucci...

WordPress Theme My Login 2FA Plugin < 1.2 is vulnerable to Bypass Vulnerability

Software Theme My Login 2FA Type Plugin Vulnerable versions 1.2 Fixed in 1.2 OWASP Top 10 A4: Insecure Design Classification Bypass Vulnerability CVE CVE-2023-6272 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 8ec60bf22c2e Credits Joost Grunwald Required privilege...

WordPress HUSKY Plugin <= 1.3.4.2 is vulnerable to SQL Injection

Software HUSKY Type Plugin Vulnerable versions = 1.3.4.2 Fixed in 1.3.4.3 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-40010 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 9191c9d76ec2 Credits Nguyen Anh Tien Required privilege Unauthenticated...

WordPress Export any WordPress data to XML/CSV Plugin < 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Export any WordPress data to XML/CSV Type Plugin Vulnerable versions 1.4.1 Fixed in 1.4.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-5886 Patch priority Low CVSS severity Low 9.6 Developer Claim ownership PSID e748bcffb3e2 Credits...

WordPress Bootstrap Shortcodes Ultimate Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS)

Software Bootstrap Shortcodes Ultimate Type Plugin Vulnerable versions = 4.3.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47851 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 29366c5c1adb Credits Ngô Thiên An ancorn from...

WordPress WooCommerce Blocks Plugin <= 11.1.1 is vulnerable to Cross Site Scripting (XSS)

Software WooCommerce Blocks Type Plugin Vulnerable versions = 11.1.1 Fixed in 11.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47777 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 99320ddb7175 Credits Rafie Muhammad Patchstack Require...

WordPress Forminator Plugin <= 1.27.0 is vulnerable to Arbitrary File Upload

Software Forminator Type Plugin Vulnerable versions = 1.27.0 Fixed in 1.28.0 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-6133 Patch priority Low CVSS severity Low 6.6 Developer WPMU DEV PSID e543496c8db2 Credits István Márton Required privilege Administrator...

WordPress Elementor Addon Elements Plugin <= 1.12.7 is vulnerable to Broken Access Control

Software Elementor Addon Elements Type Plugin Vulnerable versions = 1.12.7 Fixed in 1.12.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4723 Patch priority Low CVSS severity Low 5.3 Developer WPVibes PSID e7f9c7b2043a Credits WordFence Required privileg...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Broken Access Control

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46146 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID dba7a9d87836 Credits Rafie Muhammad Patchstack...

WordPress Ninja Forms Plugin < 3.6.34 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms Type Plugin Vulnerable versions 3.6.34 Fixed in 3.6.34 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5530 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a9b2d204bb4c Credits Jonathan Zamora Required...

WordPress URL Shortify Plugin < 1.7.9.1 is vulnerable to Cross Site Scripting (XSS)

Software URL Shortify Type Plugin Vulnerable versions 1.7.9.1 Fixed in 1.7.9.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5605 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 32b31c65bd12 Credits Bartlomiej Marek and Toma...

WordPress Star CloudPRNT for WooCommerce Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

Software Star CloudPRNT for WooCommerce Type Plugin Vulnerable versions = 2.0.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-47514 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0a1ab953b581 Credits Le...

WordPress Popup with fancybox Plugin <= 3.5 is vulnerable to SQL Injection

Software Popup with fancybox Type Plugin Vulnerable versions = 3.5 Fixed in 3.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5465 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 12bd56b92eb5 Credits István Márton Required privilege Contributor...

WordPress Image horizontal reel scroll slideshow Plugin <= 13.2 is vulnerable to SQL Injection

Software Image horizontal reel scroll slideshow Type Plugin Vulnerable versions = 13.2 Fixed in 13.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-5412 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 4f2c4949819b Credits István Márton Required...

WordPress Neon text Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Neon text Type Plugin Vulnerable versions = 1.1 Fixed in 1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5817 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3b1607d0a011 Credits Dmitrii Ignatyev Required privileg...