WordPress Responsive Addons for Elementor plugin <= 1.6.8 - Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by wesley wcraft in WordPress Plugin Responsive Addons for Elementor versions = 1.6.8...

WordPress WordPress Importer plugin <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin WordPress Importer versions = 0.8.3...

WordPress Jobs for WordPress plugin <= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read vulnerability

Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Jobs for WordPress versions = 2.7.11...

WordPress Block Logic plugin <= 1.0.8 - Authenticated (Contributor+) Remote Code Execution vulnerability

Authenticated Contributor+ Remote Code Execution vulnerability discovered by Olly in WordPress Plugin Block Logic versions = 1.0.8...

WordPress HT Mega plugin <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Widgets vulnerability discovered by zer0gh0st in WordPress Plugin HT Mega versions = 2.8.3...

WordPress ShopLentor plugin <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module vulnerability discovered by Webbernaut in WordPress Plugin ShopLentor versions = 3.1.0...

WordPress Xpro Elementor Addons plugin <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Xpro Elementor Addons versions = 1.4.6.7...

WordPress Post SMTP plugin <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter vulnerability

Authenticated Administrator+ SQL Injection via columns Parameter vulnerability discovered by Nhien Pham nhienit in WordPress Plugin Post SMTP versions = 3.1.2...

WordPress CS Framework plugin <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Tonn in WordPress Plugin CS Framework versions = 7.0...

WordPress Flexmls® IDX plugin <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin Flexmls® IDX versions = 3.14.28...

WordPress Solace Extra plugin <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WordFence in WordPress Plugin Solace Extra versions = 1.3.0...

Drupal AI (Artificial Intelligence) module < 1.0.5 - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drew Webber mcdruid in WordPress Module AI Artificial Intelligence versions 1.0.5...

HEXAGreen CMS SQL Injection

HEXAGreen CMS suffers from a remote SQL injection vulnerability. This software does not offer any version associated with it. Title: HEXAGreen CMS - Authenticated SQLi Description: HEXAGreen CMS authenticated error-based sql injection Source URL: http://ezcode.pt/tests/hexagreen/admin/ Source...

WordPress VEDA theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection vulnerability

Authenticated Subscriber+ PHP Object Injection vulnerability discovered by Lucio Sá in WordPress Theme VEDA versions = 4.2...

WordPress Hero Mega Menu - Responsive WordPress Menu Plugin plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion vulnerability

WordPress Hero Mega Menu - Responsive WordPress Menu Plugin plugin = 1.16.5 - Missing Authorization to Authenticated Subscriber+ Arbitrary Directory Deletion vulnerability discovered by Lucio Sá in WordPress Plugin Hero Mega Menu - Responsive WordPress Menu Plugin versions = 1.16.5...

Teachers Record Management System 2.1 SQL Injection

Teachers Record Management System version 2.1 suffers from a remote SQL injection vulnerability. Exploit Title: Teachers Record Management System v2.1 | Authenticated Time-Based SQLi Date: 2025-03-04 Exploit Author: Mehmet Can Kadıoğlu a.k.a mao7un Vendor:...

WordPress Album Gallery – WordPress Gallery plugin <= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Meta vulnerability

Authenticated Editor+ PHP Object Injection via Gallery Meta vulnerability discovered by Francesco Carlucci in WordPress Plugin Album Gallery – WordPress Gallery versions = 1.6.3...

WordPress GenerateBlocks plugin <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description' vulnerability

Authenticated Contributor+ Sensitive Information Exposure via 'getimagedescription' vulnerability discovered by Nishiv in WordPress Plugin GenerateBlocks versions = 1.9.1...

WordPress Tabs for WooCommerce plugin <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs vulnerability

Authentiated Shop Manager+ PHP Object Injection in producthascustomtabs vulnerability discovered by Francesco Carlucci in WordPress Plugin Tabs for WooCommerce versions = 1.0.0...

WordPress WHMPress - WHMCS Client Area plugin <= 4.3-revision-3 - Authenticated (Subscriber+) Arbitrary Options Update vulnerability

WordPress WHMPress - WHMCS Client Area plugin = 4.3-revision-3 - Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Tonn in WordPress Plugin WHMCS Client Area for WordPress by WHMpress versions = 4.3-revision-3...