WordPress CM Registration Pro premium plugin <= 3.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by WPScan Team in WordPress CM Registration Pro premium plugin versions = 3.2.0. Solution Update the WordPress CM Registration Pro premium plugin to the latest available version at least 3.2.1...

WordPress Ultimate Addons for Elementor premium plugin <= 1.29.2 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities discovered by WordFence in WordPress Ultimate Addons for Elementor premium plugin versions = 1.29.2. Solution Update the WordPress Ultimate Addons for Elementor premium plugin to the latest available version at least 1.30.0...

WordPress Cooked Pro premium plugin <= 1.7.5.5 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Jinson Varghese Behanan in WordPress Cooked Pro premium plugin versions = 1.7.5.5. Solution Update the WordPress Cooked Pro premium plugin to the latest available version at least 1.7.5.6...

WordPress Thrive Ultimatum premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Ultimatum premium plugin versions = 2.3.9.3. Solution Update the WordPress Thrive Ultimatum premium plugin to the latest available version at least 2.3.9.4...

Thrive Apprentice premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in Thrive Apprentice premium plugin versions = 2.3.9.3. Solution Update the Thrive Apprentice premium plugin to the latest available version at least 2.3.9.4...

WordPress Directories Pro premium plugin <= 1.3.45 - Authenticated Self-Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Self-Reflected Cross-Site Scripting XSS vulnerability found by ack Misiura The Missing Link in WordPress Directories Pro premium plugin versions = 1.3.45. Solution Update the WordPress Directories Pro premium plugin to the latest available version at least 1.3.46...

WordPress eventON premium plugin <= 3.0.5 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Mustafa GUNDOGDU b3kc4t in WordPress eventON premium plugin versions = 3.0.5. Solution 2020-12-01 - we were unable to find a patched version of this plugin...

WordPress JobSearch premium plugin <= 1.5.2 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (profile pages)

Authenticated Persistent Cross-Site Scripting XSS vulnerability profile pages discovered by m0ze in WordPress JobSearch premium plugin versions = 1.5.2. Solution Update the WordPress JobSearch premium plugin to the latest available version at least 1.5.3...

WordPress JobSearch premium plugin <= 1.5.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress JobSearch premium plugin versions = 1.5.2. Solution Update the WordPress JobSearch premium plugin to the latest available version at least 1.5.3...

WordPress JobSearch premium plugin <= 1.5.0 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Daniel Ruf in WordPress JobSearch premium plugin versions = 1.5.0. Solution Update the WordPress JobSearch premium plugin to the latest available version at least 1.5.1...

WordPress WooCommerce Smart Coupons premium plugin <= 4.6.0 - Unauthenticated Coupon Creation vulnerability

Unauthenticated Coupon Creation vulnerability discovered by WordFence in WordPress WooCommerce Smart Coupons premium plugin versions = 4.6.0. Solution Update the WordPress WooCommerce Smart Coupons premium plugin to the latest available version at least 4.6.5...

WordPress Hero Maps Premium plugin <= 2.2.1 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability discovered by Hooper Labs in WordPress Hero Maps Premium plugin versions = 2.2.1. Solution Update the WordPress Hero Maps Premium plugin to the latest available version at least 2.2.3...

CVE-2016-10949

The CVE-2016-10949 entry concerns WordPress Relevanssi Premium plugin prior to version 1.14.6.1. The vulnerability is described as a SQL injection that enables unsafe unserialization, potentially affecting the plugin’s database handling. The available connected documents consistently identify the...

WordPress Live Chat Unlimited 2.8.3 Cross Site Scripting

Exploit Title: Live Chat Unlimited v2.8.3 Stored XSS Injection Google Dork: inurl:"wp-content/plugins/screets-lcx" Date: 2019/06/25 Exploit Author: m0ze Vendor Homepage: https://screets.com/ Software Link: https://codecanyon.net/item/wordpress-live-chat-plugin/3952877 Version: 2.8.3 Tested on:...

WordPress Plugin iLive 1.0.4 - Cross-Site Scripting

Exploit Title: iLive - Intelligent WordPress Live Chat Support Plugin v1.0.4 Stored XSS Injection Google Dork: - Date: 2019/06/25 Exploit Author: m0ze Vendor Homepage: http://www.ilive.wpapplab.com/ Software Link: https://codecanyon.net/item/ilive-wordpress-live-chat-support-plugin/20496563...

WordPress Image Intense premium plugin <= 3.2.5 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found in WordPress Image Intense premium plugin versions = 3.2.5. Solution 2018.09.05 - we were unable to find any information about the patched version of this plugin...

WordPress WP Simple Booking Calendar Premium plugin <= 6.0-6.1 - Unauthenticated Data leak

When you know the URL which the plugin uses to export iCal feed, then you can see the availability and booking notes via that feed. Solution Update the plugin to 6.2...

WordPress WP Simple Booking Calendar Premium plugin 5.0–5.4 <= Unauthenticated Data leak

The booking notes are shown in the source code of the page. Solution Update the plugin to 5.5 version...

WordPress FormCraft 3 premium plugin <=3.2.31 - Authenticated Stored Cross-site scripting (XSS) vulnerability

Authenticated Stored Cross-site scripting XSS vulnerability found by 8bitsec in WordPress FormCraft 3 premium plugin alternative name - FormCraft Premium WordPress Form Builder. Solution 2017.07.29 - we were unable to find any information about patched version of WordPress FormCraft 3 premium...

WordPress Task Manager Pro plugin <=1.3.1 - Multiple Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Cross-Site Scripting XSS vulnerabilities found in WordPress Task Manager Pro premium plugin version 1.3.1 and earlier versions by 8bitsec. Solution 2017.07.29 - We were unable to find information about patched release of WordPress Task Manager Pro plugin. The last record on...