WordPress Himer Theme < 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Himer Type Theme Vulnerable versions 2.1.1 Fixed in 2.1.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2233 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 655236f18e54 Credits Sushmita Poudel Required privileg...

WordPress The Post Grid Plugin <= 7.7.1 is vulnerable to Cross Site Scripting (XSS)

Software The Post Grid Type Plugin Vulnerable versions = 7.7.1 Fixed in 7.7.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1427 Patch priority Low CVSS severity Low 6.5 Developer Mamunur Rashid PSID a5074a7894c0 Credits wesley wcraft Required...

WordPress LearnPress Plugin <= 4.2.6.8.1 is vulnerable to Broken Access Control

Software LearnPress Type Plugin Vulnerable versions = 4.2.6.8.1 Fixed in 4.2.6.8.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6088 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 437341849e3b Credits shaman0x01 Required privile...

WordPress LA-Studio Element Kit for Elementor Plugin <= 1.3.8.1 is vulnerable to Local File Inclusion

Software LA-Studio Element Kit for Elementor Type Plugin Vulnerable versions = 1.3.8.1 Fixed in 1.3.9 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-37479 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID ddb890f0e5f3 Credits João Pedro S Alcânta...

WordPress Beaver Builder Addons by WPZOOM Plugin <= 1.3.5 is vulnerable to Local File Inclusion

Software Beaver Builder Addons by WPZOOM Type Plugin Vulnerable versions = 1.3.5 Fixed in 1.3.6 OWASP Top 10 A5: Security Misconfiguration Classification Local File Inclusion CVE CVE-2024-37464 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID d25d4ebd9af1 Credits João Pedro...

WordPress CRM Perks Forms Plugin <= 1.1.5 is vulnerable to Broken Access Control

Software CRM Perks Forms Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37463 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 16266b67c664 Credits Manab Jyoti Dowarah Required...

WordPress Photo Gallery by Ays Plugin < 5.7.1 is vulnerable to Content Injection

Software Photo Gallery by Ays Type Plugin Vulnerable versions 5.7.1 Fixed in 5.7.1 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-37442 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID 76b249292f10 Credits Ibnu Ubaeydillah Required privilege...

WordPress Timetics Plugin <= 1.0.21 is vulnerable to Broken Access Control

Software Timetics Type Plugin Vulnerable versions = 1.0.21 Fixed in 1.0.22 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37427 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID d73e6a480d4b Credits Manab Jyoti Dowarah Required...

WordPress SEO SIMPLE PACK Plugin <= 3.2.1 is vulnerable to Sensitive Data Exposure

Software SEO SIMPLE PACK Type Plugin Vulnerable versions = 3.2.1 Fixed in 3.3.0 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-2795 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b6dc01036030 Credits Krzysztof Zając Required...

WordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.21 is vulnerable to Cross Site Scripting (XSS)

Software PDF Poster - PDF Embedder Plugin for WordPress Type Plugin Vulnerable versions = 2.1.21 Fixed in 2.1.22 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-4367 Patch priority Low CVSS severity Low 4 Developer Claim ownership PSID 9ee58daffa95 Credits Yudistir...

WordPress Elements kit Elementor addons Plugin <= 3.1.4 is vulnerable to Broken Access Control

Software Elements kit Elementor addons Type Plugin Vulnerable versions = 3.1.4 Fixed in 3.2.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37255 Patch priority Low CVSS severity Low 5.3 Developer Wpmet PSID b0cbfbfccc4f Credits Rafie Muhammad Patchstack...

WordPress Vandana Lite Theme <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software Vandana Lite Type Theme Vulnerable versions = 1.1.9 Fixed in 1.2.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37243 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6d4dd2dbf84c Credits Dhabaleshwar Das Requir...

WordPress Wheel of Life Plugin <= 1.1.7 is vulnerable to Broken Access Control

Software Wheel of Life Type Plugin Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3627 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 68abc18dc3c6 Credits Lucio Sá Required privilege...

WordPress Dashboard Widgets Suite Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)

Software Dashboard Widgets Suite Type Plugin Vulnerable versions = 3.4.3 Fixed in 3.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0979 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID ec515656a329 Credits Krzysztof...

WordPress InstaWP Connect Plugin <= 0.1.0.38 is vulnerable to Broken Access Control

Software InstaWP Connect Type Plugin Vulnerable versions = 0.1.0.38 Fixed in 0.1.0.39 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4898 Patch priority High CVSS severity High 9.8 Developer InstaWP PSID 3572e9bad95d Credits Truoc Phan Required privilege...

WordPress Futurio Extra Plugin <= 2.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Futurio Extra Type Plugin Vulnerable versions = 2.0.5 Fixed in 2.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5646 Patch priority Low CVSS severity Low 6.5 Developer FuturioWP PSID ebce01258690 Credits wesley wcraft Required privilege...

WordPress Essential Addons for Elementor Pro Plugin <= 5.8.15 is vulnerable to Cross Site Scripting (XSS)

Software Essential Addons for Elementor Pro Type Plugin Vulnerable versions = 5.8.15 Fixed in 5.8.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5612 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e15428c7c929 Credits...

WordPress Google CSE Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

Software Google CSE Type Plugin Vulnerable versions = 1.0.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4755 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bad36f3a4611 Credits Bob Matyas Required privilege...

WordPress Tickera Plugin <= 3.5.2.6 is vulnerable to Broken Access Control

Software Tickera Type Plugin Vulnerable versions = 3.5.2.6 Fixed in 3.5.2.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35729 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 41ad9b04a28b Credits Manab Jyoti Dowarah Required...

WordPress Sensei Pro (WC Paid Courses) Plugin <= 4.23.1.1.23.1 is vulnerable to Broken Access Control

Software Sensei Pro WC Paid Courses Type Plugin Vulnerable versions = 4.23.1.1.23.1 Fixed in 4.24.0.1.24.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35686 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5a225c011e38 Credits...

WordPress WP Time Slots Booking Form Plugin <= 1.2.11 is vulnerable to Broken Access Control

Software WP Time Slots Booking Form Type Plugin Vulnerable versions = 1.2.11 Fixed in 1.2.12 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35735 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 00d0e255c1a4 Credits Manab Jyoti...

WordPress Happy Addons for Elementor Plugin <= 3.10.9 is vulnerable to Cross Site Scripting (XSS)

Software Happy Addons for Elementor Type Plugin Vulnerable versions = 3.10.9 Fixed in 3.11.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5347 Patch priority Low CVSS severity Low 6.5 Developer Leevio PSID ebc3fed24a0c Credits wesley wcraft Requir...

WordPress AffiEasy Plugin <= 1.1.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software AffiEasy Type Plugin Vulnerable versions = 1.1.7 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-4218 Patch priority Low CVSS severity Low 6.5 Developer AffiEasy PSID 6a6d4298e483 Credits Benedictus Jovan aillesiM Required...

WordPress Pray For Me Plugin <= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Pray For Me Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3965 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 75aaa6747a5e Credits Bob Matyas Required...

WordPress LuckyWP Table of Contents Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)

Software LuckyWP Table of Contents Type Plugin Vulnerable versions = 2.1.5 Fixed in 2.1.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2218 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f253e02e4fa4 Credits Sławomir...

WordPress WP Go Maps Plugin <= 9.0.36 is vulnerable to Cross Site Scripting (XSS)

Software WP Go Maps Type Plugin Vulnerable versions = 9.0.36 Fixed in 9.0.37 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3557 Patch priority Low CVSS severity Low 6.5 Developer WP Go Maps PSID 5d4346327305 Credits Thanh Nam Tran Required privileg...

WordPress WP ViperGB Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP ViperGB Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-4409 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ce16817d4da2 Credits Benedictus Jovan aillesiM...

WordPress Element Pack Elementor Addons Plugin <= 5.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.6.1 Fixed in 5.6.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3926 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 244526e11219 Credits wesley...

WordPress Blocksy Theme <= 2.0.46 is vulnerable to Cross Site Scripting (XSS)

Software Blocksy Type Theme Vulnerable versions = 2.0.46 Fixed in 2.0.47 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4943 Patch priority Low CVSS severity Low 6.5 Developer Creative Themes PSID b3bc385251a5 Credits Ngô Thiên An ancorn Required...

WordPress ShopLentor Plugin <= 2.8.7 is vulnerable to Cross Site Scripting (XSS)

Software ShopLentor Type Plugin Vulnerable versions = 2.8.7 Fixed in 2.8.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34767 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 98f1de88eaf5 Credits Ngô Thiên An ancorn from VNPT-VCI Required...

WordPress Rank Math SEO Plugin <= 1.0.218 is vulnerable to Cross Site Scripting (XSS)

Software Rank Math SEO Type Plugin Vulnerable versions = 1.0.218 Fixed in 1.0.219-beta OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4617 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e1bcca408b13 Credits Ngô Thiên An anco...

WordPress Popup Builder Plugin <= 1.1.29 is vulnerable to Cross Site Scripting (XSS)

Software Popup Builder Type Plugin Vulnerable versions = 1.1.29 Fixed in 1.1.30 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34567 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 42654a589b9a Credits Rayhan Ramdhany Hanaputra Required...

WordPress Flo Forms Plugin <= 1.0.42 is vulnerable to Broken Access Control

Software Flo Forms Type Plugin Vulnerable versions = 1.0.42 Fixed in 1.0.43 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-35174 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5341640d4e58 Credits Dhabaleshwar Das Required privile...

WordPress Orders Tracking for WooCommerce Plugin <= 1.2.10 is vulnerable to Broken Access Control

Software Orders Tracking for WooCommerce Type Plugin Vulnerable versions = 1.2.10 Fixed in 1.2.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-4039 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID da05ab03734d Credits...

WordPress Meow Gallery Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)

Software Meow Gallery Type Plugin Vulnerable versions = 5.1.3 Fixed in 5.1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4386 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID ff273a246878 Credits Krzysztof Zając Required...

WordPress SSL Zen – Free SSL Certificate & HTTPS Redirect for WordPress Plugin <= 4.5.3 is vulnerable to Sensitive Data Exposure

Software SSL Zen – Free SSL Certificate & HTTPS Redirect for WordPress Type Plugin Vulnerable versions = 4.5.3 Fixed in 4.6.0 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-1076 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...

WordPress WOLF Plugin <=1.0.8.2 is vulnerable to Cross Site Scripting (XSS)

Software WOLF Type Plugin Vulnerable versions =1.0.8.2 Fixed in 1.0.8.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34558 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 75bcc909e11e Credits Elmini Required privilege Administrator...

WordPress Simple Image Popup Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

Software Simple Image Popup Type Plugin Vulnerable versions = 2.4.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-4433 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 884d37bdacd5 Credits Cronus Required privilege Administrato...

WordPress Float menu Plugin < 6.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Float menu Type Plugin Vulnerable versions 6.0.1 Fixed in 6.0.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-2405 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 80605a5ac1fe Credits Erwan LR WPScan Required...

WordPress Email Verification for WooCommerce Plugin <= 2.7.4 is vulnerable to Bypass Vulnerability

Software Email Verification for WooCommerce Type Plugin Vulnerable versions = 2.7.4 Fixed in 2.7.5 OWASP Top 10 A7: Identification and Authentication Failures Classification Bypass Vulnerability CVE CVE-2024-4185 Patch priority Low CVSS severity Low 5.6 Developer Claim ownership PSID 16dc89621743...

WordPress Realtyna Organic IDX plugin Plugin <= 4.14.4 is vulnerable to Cross Site Scripting (XSS)

Software Realtyna Organic IDX plugin Type Plugin Vulnerable versions = 4.14.4 Fixed in 4.14.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33924 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9af5852216f6 Credits Muhammad Daffa...

WordPress Pop-up Plugin <= 1.2.3 is vulnerable to Broken Access Control

Software Pop-up Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31435 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID f2085d0cd912 Credits Dhabaleshwar Das Required privilege...

WordPress WZone plugin < 14.1.00 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin WZone versions 14.1.00...

WordPress XStore Theme <= 9.3.8 is vulnerable to Local File Inclusion

Software XStore Type Theme Vulnerable versions = 9.3.8 Fixed in 9.3.9 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-33560 Patch priority High CVSS severity High 9 Developer Claim ownership PSID 6dff12fe54af Credits Rafie Muhammad Patchstack Required privilege...

WordPress Auto Featured Image (Auto Post Thumbnail) Plugin <= 4.1.3 is vulnerable to Server Side Request Forgery (SSRF)

Software Auto Featured Image Auto Post Thumbnail Type Plugin Vulnerable versions = 4.1.3 Fixed in 4.1.4 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-33629 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID...

WordPress WZone Plugin <= 14.0.33 is vulnerable to SQL Injection

Software WZone Type Plugin Vulnerable versions = 14.0.33 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-33546 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID 44537a1aade6 Credits Rafie Muhammad Patchstack Required privilege Subscriber...

WordPress ProfileGrid Plugin <= 5.7.9 is vulnerable to Insecure Direct Object References (IDOR)

Software ProfileGrid Type Plugin Vulnerable versions = 5.7.9 Fixed in 5.8.0 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-32772 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0b59bd9029de Credits Kyle Sanchez...

WordPress WP Club Manager Plugin <= 2.2.11 is vulnerable to Broken Access Control

Software WP Club Manager Type Plugin Vulnerable versions = 2.2.11 Fixed in 2.2.12 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-32719 Patch priority Low CVSS severity Low 5.3 Developer WP Club Manager PSID 9c15961e31ea Credits Mika Required privilege...

WordPress Royal Elementor Kit Theme <= 1.0.116 is vulnerable to Cross Site Request Forgery (CSRF)

Software Royal Elementor Kit Type Theme Vulnerable versions = 1.0.116 Fixed in 1.0.117 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32773 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4da5c371e0b8 Credits Dhabaleshwar...

WordPress Olive One Click Demo Import Plugin <= 1.1.1 is vulnerable to Arbitrary File Download

Software Olive One Click Demo Import Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-32715 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID a4c06fc8a3c4 Credits Yudistira Arya...