WordPress Funnel Builder for WordPress by FunnelKit plugin <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG Upload vulnerability discovered by wesley wcraft in WordPress Plugin Funnel Builder by FunnelKit versions = 3.3.1...

WordPress The Plus Addons for Elementor plugin <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

WordPress The Plus Addons for Elementor plugin = 5.6.0- Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 5.6.0...

WordPress Orbit Fox by ThemeIsle plugin <= 2.10.34 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Orbit Fox by ThemeIsle versions = 2.10.34...

WordPress WP Blog Post Layouts plugin <= 1.1.3 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by stealthcopter in WordPress Plugin WP Blog Post Layouts versions = 1.1.3...

WordPress Media Library Assistant plugin <= 3.16 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin Media LIbrary Assistant versions = 3.16...

WordPress Depicter plugin <= 3.0.2 - Authenticated Arbitrary Nonce Generation vulnerability

Authenticated Arbitrary Nonce Generation vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Depicter Slider versions = 3.0.2...

WordPress WPZOOM Addons for Elementor plugin <= 1.1.38 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin WPZOOM Addons for Elementor versions = 1.1.38...

WordPress JetWidgets For Elementor plugin <= 1.0.17 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin JetWidgets For Elementor versions = 1.0.17...

WordPress Pexels: Free Stock Photos plugin <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Pexels: Free Stock Photos versions = 1.2.2...

WordPress Funnel Builder by CartFlows plugin <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin CartFlows versions = 2.0.7...

WordPress Robo Gallery plugin <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Image Title vulnerability discovered by Tim Coen in WordPress Plugin Robo Gallery versions = 3.2.19...

WordPress MIMO Woocommerce Order Tracking plugin <= 1.0.2 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Lucio Sá in WordPress Plugin MIMO Woocommerce Order Tracking versions = 1.0.2...

WordPress Universal Slider plugin <= 1.6.5 - Authenticated PHP Object Injection vulnerability

Authenticated PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Universal Slider versions = 1.6.5...

WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Lucio Sá in WordPress Plugin AliNext versions = 3.3.5...

WordPress PDF Viewer for Elementor plugin <= 2.9.3 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by WordFence in WordPress Plugin PDF Viewer for Elementor versions = 2.9.3...

WordPress Stratum – Elementor Widgets plugin <= 1.4.1 - Authenticated Stored Cross-Site Scripting via Countdown Widget vulnerability

Authenticated Stored Cross-Site Scripting via Countdown Widget vulnerability discovered by wesley wcraft in WordPress Plugin Stratum versions = 1.4.1...

WordPress Woody code snippets plugin <= 2.5.0 - Authenticated Remote Code Execution vulnerability

Authenticated Remote Code Execution vulnerability discovered by Webbernaut in WordPress Plugin Woody ad snippets versions = 2.5.0...

WordPress Shariff Wrapper plugin <= 4.6.13 - Authenticated Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Stored Cross-Site Scripting via Shortcode vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Shariff versions = 4.6.13...

Wordpress ElementsKit Pro plugin <= 3.6.2 - Authenticated (Contributor+) Server-Side Request Forgery vulnerability

Authenticated Contributor+ Server-Side Request Forgery vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin ElementsKit Pro versions = 3.6.2...

Comments – wpDiscuz < 7.6.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.6.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...