WordPress Gutenberg Blocks with AI by Kadence WP plugin <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Block Link vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.2.36...

WordPress Spectra Pro plugin <= 1.1.5 - Authenticated (Author+) Privilege Escalation vulnerability

Authenticated Author+ Privilege Escalation vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Spectra Pro versions = 1.1.5...

WordPress Porto theme <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta vulnerability

Authenticated Contributor+ Local File Inclusion via Post Meta vulnerability discovered by István Márton in WordPress Theme Porto versions = 7.1.0...

WordPress WP Latest Posts plugin <= 5.0.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by stealthcopter in WordPress Plugin WP Latest Posts versions = 5.0.7...

WordPress Mesmerize Companion plugin <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mesmerizecontactform Shortcode vulnerability discovered by stealthcopter in WordPress Plugin Mesmerize Companion versions = 1.6.148...

WordPress Ditty plugin <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Trinh Vu Sonicrrrr in WordPress Plugin Ditty versions = 3.1.38...

WordPress Prime Slider plugin <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Prime Slider – Addons For Elementor versions = 3.14.3...

Auto Affiliate Links < 6.4.4 - Authenticated (Editor+) SQL Injection

Description The Auto Affiliate Links plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.4.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

WordPress Blocksy theme <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Ngô Thiên An ancorn in WordPress Theme Blocksy versions = 2.0.42...

WordPress ConvertPlug plugin <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by 1337Wannabe in WordPress Plugin ConvertPlus versions = 3.5.25...

WordPress Elementor Pro plugin <= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Elementor Pro versions = 3.21.0...

WordPress Follow Us Badges plugin <= 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpsitefollowusbadges Shortcode vulnerability discovered by Lucio Sá in WordPress Plugin Follow Us Badges versions = 3.1.10...

WordPress Essential Addons for Elementor plugin <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Essential Addons for Elementor versions = 5.9.17...

WordPress Tabellen von faustball.com plugin <= 2.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Benedictus Jovan in WordPress Plugin Tabellen von faustball.com versions = 2.0.4...

WordPress Admin Page Spider plugin <= 3.31 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Dikshita Trivedi Cybersecdexter in WordPress Plugin Admin Page Spider versions = 3.31...

WordPress Shortcodes Ultimate plugin <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by stealthcopter in WordPress Plugin Shortcodes Ultimate versions = 7.1.2...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.6.18 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by WordFence in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.6.18...

WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.11 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin Timetable and Event Schedule versions = 2.4.11...

WordPress WP ULike plugin <= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin WP ULike versions = 4.6.9...

WordPress ElementsKit Pro plugin <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets vulnerability

Authenticated Contributor+ Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets vulnerability discovered by Webbernaut in WordPress Plugin ElementsKit Pro versions = 3.6.0...