WordPress Enable Shortcodes inside Widgets,Comments and Experts Plugin <= 1.0.0 is vulnerable to Arbitrary Code Execution

Software Enable Shortcodes inside Widgets,Comments and Experts Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary Code Execution CVE CVE-2024-9846 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 5e00f716955b Credits...

WordPress Contact Form 7 Telegram Plugin <= 0.8.5 is vulnerable to Broken Access Control

Software Contact Form 7 Telegram Type Plugin Vulnerable versions = 0.8.5 Fixed in 0.8.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9629 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bc9031e15885 Credits István Márton Required...

WordPress League of Legends Shortcodes Plugin <= 1.0.1 is vulnerable to SQL Injection

Software League of Legends Shortcodes Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-10341 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID e710f3b6d815 Credits István Márton Required privilege...

WordPress WP Recipe Maker Plugin <= 9.6.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Recipe Maker Type Plugin Vulnerable versions = 9.6.1 Fixed in 9.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9650 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2a5bb74d98c6 Credits Webbernaut Required...

WordPress WPS Telegram Chat Plugin <= 4.5.4 is vulnerable to Broken Access Control

Software WPS Telegram Chat Type Plugin Vulnerable versions = 4.5.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9630 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9cb16fad33b1 Credits István Márton Required privile...

WordPress Premium SEO Pack Plugin <= 1.6.001 is vulnerable to SQL Injection

Software Premium SEO Pack Type Plugin Vulnerable versions = 1.6.001 Fixed in 1.6.002 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-50465 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 56b65671a73e Credits Hakiduck Required privilege Contributor...

WordPress WP Booking System Plugin <= 2.0.19.10 is vulnerable to Broken Access Control

Software WP Booking System Type Plugin Vulnerable versions = 2.0.19.10 Fixed in 2.0.19.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-50425 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID ad36b04a505d Credits Trương Hữu Phúc...

WordPress DearFlip Plugin <= 2.3.32 is vulnerable to Cross Site Scripting (XSS)

Software DearFlip Type Plugin Vulnerable versions = 2.3.32 Fixed in 2.3.42 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8717 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f4b31b90d091 Credits Noah Stead TurtleBurg...

WordPress Nioland Theme <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Nioland Type Theme Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10250 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b9c6b343d20f Credits sav4n Required privilege...

WordPress Todo Custom Field Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)

Software Todo Custom Field Type Plugin Vulnerable versions = 3.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49642 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 03eb6add369b Credits Mika Required privilege...

WordPress News Kit Elementor Addons Plugin <= 1.2.1 is vulnerable to Sensitive Data Exposure

Software News Kit Elementor Addons Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-9541 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1aff69c2a359 Credits Nishiv Required...

WordPress Backup and Staging by WP Time Capsule Plugin <= 1.22.21 is vulnerable to PHP Object Injection

Software Backup and Staging by WP Time Capsule Type Plugin Vulnerable versions = 1.22.21 Fixed in 1.22.22 OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-49684 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 72588c8fb912 Credits Hakiduck Require...

WordPress Photo Gallery Slideshow & Masonry Tiled Gallery Plugin <= 1.0.3 is vulnerable to SQL Injection

Software Photo Gallery Slideshow & Masonry Tiled Gallery Type Plugin Vulnerable versions = 1.0.3 Fixed in 1.0.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2019-25218 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 6b8bcb14a865 Credits Ala Arfaoui...

WordPress Miniorange OTP Verification with Firebase Plugin <= 3.6.0 is vulnerable to Broken Authentication

Software Miniorange OTP Verification with Firebase Type Plugin Vulnerable versions = 3.6.0 Fixed in 3.6.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9861 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID...

WordPress Miniorange OTP Verification with Firebase Plugin <= 3.6.0 is vulnerable to Privilege Escalation

Software Miniorange OTP Verification with Firebase Type Plugin Vulnerable versions = 3.6.0 Fixed in 3.6.1 OWASP Top 10 A5: Security Misconfiguration Classification Privilege Escalation CVE CVE-2024-9863 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 768f87fd904b Credits...

WordPress Smart Blocks Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Smart Blocks Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49270 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fc8a42cfb8ae Credits João Pedro S Alcântara Kinorth Required...

WordPress RS-Members Plugin <= 1.0.3 is vulnerable to Privilege Escalation

Software RS-Members Type Plugin Vulnerable versions = 1.0.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-49219 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 3db20a267888 Credits João Pedro S Alcântara Kinorth...

WordPress Analyse Uploads Plugin <= 0.5 is vulnerable to Arbitrary File Deletion

Software Analyse Uploads Type Plugin Vulnerable versions = 0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2024-49253 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 7d31a27cc3f2 Credits stealthcopter Required privilege...

WordPress Display Medium Posts Plugin <= 5.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Display Medium Posts Type Plugin Vulnerable versions = 5.0.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9445 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 06e0b332337b Credits theviper17y Required...

WordPress Smart Custom 404 Error Page Plugin <= 11.4.7 is vulnerable to Cross Site Scripting (XSS)

Software Smart Custom 404 Error Page Type Plugin Vulnerable versions = 11.4.7 Fixed in 11.4.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9204 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6f4afc297c2e Credits...

WordPress Product Delivery Date for WooCommerce – Lite Plugin <= 2.7.3 is vulnerable to Cross Site Scripting (XSS)

Software Product Delivery Date for WooCommerce – Lite Type Plugin Vulnerable versions = 2.7.3 Fixed in 2.7.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9345 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 44dcce7eec...

WordPress Hello World Plugin <= 2.1.1 is vulnerable to Arbitrary File Download

Software Hello World Type Plugin Vulnerable versions = 2.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-9224 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 936cc3342bfb Credits yudha Required privilege...

WordPress YellowPencil Visual CSS Style Editor Plugin <= 7.6.4 is vulnerable to Cross Site Scripting (XSS)

Software YellowPencil Visual CSS Style Editor Type Plugin Vulnerable versions = 7.6.4 Fixed in 7.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47348 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e58f30e6b0f0 Credits Dimas Maula...

WordPress EventPrime Plugin <= 4.0.4.5 is vulnerable to Open Redirection

Software EventPrime Type Plugin Vulnerable versions = 4.0.4.5 Fixed in 4.0.4.6 OWASP Top 10 A3: Injection Classification Open Redirection CVE CVE-2024-47648 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 5cc95dc439ed Credits Muhamad Agil Fachrian Required privilege...

WordPress Enter Addons Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

Software Enter Addons Type Plugin Vulnerable versions = 2.1.8 Fixed in 2.1.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47625 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0a331c0c111f Credits João Pedro S Alcântara Kinorth Required...

WordPress Bulk NoIndex & NoFollow Toolkit Plugin <= 2.15 is vulnerable to Cross Site Scripting (XSS)

Software Bulk NoIndex & NoFollow Toolkit Type Plugin Vulnerable versions = 2.15 Fixed in 2.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8803 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 78a9bff492c8 Credits vgo0...

WordPress ElementsReady Addons for Elementor Plugin <= 6.4.0 is vulnerable to Cross Site Scripting (XSS)

Software ElementsReady Addons for Elementor Type Plugin Vulnerable versions = 6.4.0 Fixed in 6.4.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47329 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 79bbffb3d8c7 Credits João Pedro S...

WordPress Classic Editor and Classic Widgets Plugin <= 1.4.1 is vulnerable to SQL Injection

Software Classic Editor and Classic Widgets Type Plugin Vulnerable versions = 1.4.1 Fixed in 1.4.2 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-47312 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID bea053e6b42c Credits Hakiduck Required privilege...

WordPress Elements kit Elementor addons Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8546 Patch priority Low CVSS severity Low 6.5 Developer Wpmet PSID 43112ffb0d64 Credits zer0gh0st Required...

WordPress Primary Addon for Elementor Plugin <= 1.5.7 is vulnerable to Cross Site Scripting (XSS)

Software Primary Addon for Elementor Type Plugin Vulnerable versions = 1.5.7 Fixed in 1.5.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44033 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8b7b50340583 Credits João Pedro S Alcântara...

WordPress Contact Form 7 Campaign Monitor Extension Plugin <= 0.4.67 is vulnerable to Broken Access Control

Software Contact Form 7 Campaign Monitor Extension Type Plugin Vulnerable versions = 0.4.67 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-44019 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 11a927ecc073 Credits Abdi...

WordPress BA Book Everything Plugin <= 1.6.20 is vulnerable to Cross Site Request Forgery (CSRF)

Software BA Book Everything Type Plugin Vulnerable versions = 1.6.20 Fixed in 1.6.21 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8795 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID ac1ae1bb0f23 Credits wesley wcraft...

WordPress REST API TO MiniProgram Plugin <= 4.7.1 is vulnerable to SQL Injection

Software REST API TO MiniProgram Type Plugin Vulnerable versions = 4.7.1 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-8484 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID a9593ec18e0a Credits wesley wcraft Required privilege...

WordPress Themify – WooCommerce Product Filter Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)

Software Themify – WooCommerce Product Filter Type Plugin Vulnerable versions = 1.5.1 Fixed in 1.5.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44046 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b38cdc945b73 Credits bugcraftx Require...

WordPress Team Showcase Plugin <= 1.22.25 is vulnerable to Cross Site Scripting (XSS)

Software Team Showcase Type Plugin Vulnerable versions = 1.22.25 Fixed in 1.22.26 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44002 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID aa646d7f4421 Credits Le Ngoc Anh Required privilege...

WordPress WooCommerce Multilingual & Multicurrency Plugin <= 5.3.6 is vulnerable to Broken Access Control

Software WooCommerce Multilingual & Multicurrency Type Plugin Vulnerable versions = 5.3.6 Fixed in 5.3.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-44006 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5e4519a377a3 Credits Rafi...

WordPress Backuply – Backup, Restore, Migrate and Clone Plugin <= 1.3.4 is vulnerable to SQL Injection

Software Backuply – Backup, Restore, Migrate and Clone Type Plugin Vulnerable versions = 1.3.4 Fixed in 1.3.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-8669 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID ca125ceee6e2 Credits bart Required...

WordPress WordPress Tag Cloud Plugin – Tag Groups Plugin <= 2.0.3 is vulnerable to Sensitive Data Exposure

Software WordPress Tag Cloud Plugin – Tag Groups Type Plugin Vulnerable versions = 2.0.3 Fixed in 2.0.4 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-43237 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d69c3848e4ee Credits Pen...

WordPress WP Delicious Plugin <= 1.6.9 is vulnerable to Arbitrary File Download

Software WP Delicious Type Plugin Vulnerable versions = 1.6.9 Fixed in 1.7.0 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-7626 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 044013a60ca3 Credits Connor Billings Required...

WordPress Popup Maker Plugin < 1.19.1 is vulnerable to Cross Site Scripting (XSS)

Software Popup Maker Type Plugin Vulnerable versions 1.19.1 Fixed in 1.19.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5561 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 28c13e8e0eab Credits Dmitrii Ignatyev Required...

WordPress Ninja Forms File Uploads Extension Plugin <= 3.3.16 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms File Uploads Extension Type Plugin Vulnerable versions = 3.3.16 Fixed in 3.3.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1596 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 261b89d2f6fa Credi...

WordPress RD Station Plugin <= 5.3.2 is vulnerable to Cross Site Scripting (XSS)

Software RD Station Type Plugin Vulnerable versions = 5.3.2 Fixed in 5.4.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6894 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 32a1d7bae015 Credits Webbernaut Required privilege...

WordPress GiveWP Plugin <= 3.15.1 is vulnerable to Sensitive Data Exposure

Software GiveWP Type Plugin Vulnerable versions = 3.15.1 Fixed in 3.16.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-6551 Patch priority Low CVSS severity Low 5.3 Developer Liquid Web / StellarWP PSID b91ec157138c Credits stealthcopter Required...

WordPress Popup Builder Plugin <= 4.3.4 is vulnerable to Sensitive Data Exposure

Software Popup Builder Type Plugin Vulnerable versions = 4.3.4 Fixed in N/A OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2541 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 6c83b1e3c00b Credits Tim Coen Required privilege...

WordPress Xpro Elementor Addons Plugin <= 1.4.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Xpro Elementor Addons Type Plugin Vulnerable versions = 1.4.4.3 Fixed in 1.4.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7791 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 93f87661de72 Credits WordFence...

WordPress Bit Form – Contact Form Plugin Plugin 2.0 - 2.13.9 is vulnerable to SQL Injection

Software Bit Form – Contact Form Plugin Type Plugin Vulnerable versions 2.0 - 2.13.9 Fixed in 2.13.10 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-7702 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 93a8a2a37fc7 Credits siunam Required privilege...

WordPress e2pdf Plugin <= 1.25.05 is vulnerable to Cross Site Scripting (XSS)

Software e2pdf Type Plugin Vulnerable versions = 1.25.05 Fixed in 1.25.11 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43318 Patch priority Low CVSS severity Low 6.5 Developer E2Pdf.com PSID 618e2ecf6073 Credits LVT-tholv2k Required privilege Contributor Publish...

WordPress WP User Manager Plugin <= 2.9.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP User Manager Type Plugin Vulnerable versions = 2.9.10 Fixed in 2.9.11 OWASP Top 10 A4: Insecure Design Classification Cross Site Request Forgery CSRF CVE CVE-2024-43336 Patch priority Low CVSS severity Low 4.3 Developer WP User Manager PSID 6918353ae071 Credits Ananda Dhakal Patchstac...

WordPress WordPress File Upload Plugin <= 4.24.8 is vulnerable to Cross Site Scripting (XSS)

Software WordPress File Upload Type Plugin Vulnerable versions = 4.24.8 Fixed in 4.24.9 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7301 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID a1f4d9ddbee7 Credits wesley wcraft...

WordPress Insert PHP Code Snippet Plugin <= 1.3.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software Insert PHP Code Snippet Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-43275 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID f6953adb666a Credits Rafie...