WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nixxies in WordPress Plugin Cooked versions = 1.16.0...

WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Booking Calendar versions = 11.7...

WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by asdqgggg in WordPress Plugin User Registration versions = 5.2.7...

WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by benzdeus in WordPress Plugin PublishPress Series versions = 3.1.3...

WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Matheo Beuve in WordPress Plugin Xagio SEO versions = 7.1.0.43...

WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by JunHee CHO in WordPress Plugin Geo Mashup versions = 1.13.21...

WordPress WPFunnels plugin <= 3.12.13 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Aditya Gurav in WordPress Plugin WPFunnels versions = 3.12.13...

WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by z3r0s in WordPress Plugin BerqWP versions = 4.1.15...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.9 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.9...

WordPress Paid Downloads plugin <= 3.15 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Spy0x7 in WordPress Plugin Paid Downloads versions = 3.15...

WordPress GiveWP plugin 4.16.6-4.16.8.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin GiveWP versions 4.16.6-4.16.8.0...

WordPress Ni WooCommerce Sales Report plugin < 4.2.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Ni WooCommerce Sales Report versions 4.2.0...

WordPress Tutor LMS plugin < 4.0.8 - Read-Only API Key Privilege Escalation vulnerability

Read-Only API Key Privilege Escalation vulnerability discovered by Charles Vosburgh in WordPress Plugin Tutor LMS versions 4.0.8...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin <= 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force vulnerability

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content - ProfilePress plugin = 4.17.1 - Unauthenticated Arbitrary Plugin Installation via Brute Force vulnerability discovered by Jon Bytyqi - Independent Security Researcher in WordPress...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Arbitrary Directory Deletion vulnerability

Authenticated Arbitrary Directory Deletion vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated RCE vulnerability

Authenticated RCE vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.34 - Authenticated RCE vulnerability

Authenticated RCE vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.34...

WordPress Eventin plugin < 4.1.24 - Contributor+ User Creation vulnerability

Contributor+ User Creation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Event Solution versions 4.1.24...

WordPress Royal Addons for Elementor plugin < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability

Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability discovered by Brian Willows in WordPress Plugin Royal Elementor Addons versions 1.7.1067...