WordPress E-cab taxi booking manager plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sharanabasappa Patchstack Alliance in WordPress Plugin Taxi Booking Manager for WooCommerce versions = 1.0.9...

WordPress Enhanced Search Box plugin <= 0.6.1 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin Enhanced Search Box versions = 0.6.1...

PT-2024-30777 · WordPress · Ti Woocommerce Wishlist

Name of the Vulnerable Software and Affected Versions: TI WooCommerce Wishlist versions n/a through 2.8.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This vulnerability affects over 100,000 sites...

WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Joel Indra Patchstack Alliance in WordPress Plugin Ninja Forms versions = 3.8.11...

WordPress FotaWP theme <= 1.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Fariq Fadillah Gusti Insani Patchstack Alliance in WordPress Theme Fota WP versions = 1.4.1...

WordPress Mollie Payments for WooCommerce plugin <= 7.7.0 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by stealthcopter in WordPress Plugin Mollie Payments for WooCommerce versions = 7.7.0...

WordPress ILC Thickbox plugin <= 1.0 - Settings update via CSRF vulnerability

Settings update via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin ILC Thickbox versions = 1.0...

PT-2024-37533 · WordPress · Funnelforms Free

Name of the Vulnerable Software and Affected Versions: Funnelforms Free plugin for WordPress versions up to, and including, 3.7.3.2 Description: The issue is related to arbitrary file deletion due to the plugin not properly validating a file or its path prior to deletion. This is made possible vi...

PT-2024-37875 · WordPress · Jeg Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.6.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

CVE-2024-43336

Cross-Site Request Forgery CSRF vulnerability in WP User Manager.This issue affects WP User Manager: from n/a through 2.9.10...

CVE-2024-43299

Cross-Site Request Forgery CSRF vulnerability in Softaculous Team SpeedyCache.This issue affects SpeedyCache: from n/a through 1.1.8...

CVE-2024-43265

Cross-Site Request Forgery CSRF vulnerability in Analytify.This issue affects Analytify: from n/a through 5.3.1...

CVE-2024-39628

Cross-Site Request Forgery CSRF vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6...

CVE-2024-39645

Cross-Site Request Forgery CSRF vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2...

WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SendGrid for WordPress versions = 1.4...

WordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 4rCanJ0x! Patchstack Alliance in WordPress Plugin Web and WooCommerce Addons for WPBakery Builder versions = 1.5...

WordPress MemberPress plugin <= 1.11.34 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MemberPress versions = 1.11.34...

WordPress SKT Blocks plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 4rCanJ0x! Patchstack Alliance in WordPress Plugin SKT Blocks versions = 1.6...

WordPress Propovoice Pro plugin <= 1.7.0.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Propovoice Pro versions = 1.7.0.3...

WordPress WP Delicious plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin WP Delicious versions = 1.6.7...