WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...

WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Steven Julian in WordPress Plugin Theme Test Drive versions = 2.9.1...

WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Vavo Core versions = 2.3.0...

WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hhhai in WordPress Plugin WP Sort Order versions = 1.3.5...

WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by DmTomHe in WordPress Plugin User Registration versions = 5.2.6...

WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin Site Reviews versions = 8.2.0...

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin GiveWP versions 4.16.6...

WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Templately versions = 3.7.1...

WordPress Epeken All Kurir plugin <= 2.1.2 - Unauthenticated Order Payment Confirmation Forgery vulnerability

Unauthenticated Order Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin Epeken All Kurir versions = 2.1.2...

WordPress Paymob for WooCommerce plugin < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability

Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability discovered by Artus KG in WordPress Plugin Paymob for WooCommerce versions 4.1.9...

WordPress Wishlist Member X plugin <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter vulnerability

Unauthenticated Account Takeover via 'mergewith' Parameter vulnerability discovered by bashu - VN in WordPress Plugin WishList Member X versions = 3.34.1...

WordPress Embed Google Photos Album Easily plugin <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute vulnerability

Contributor+ Stored XSS via link Shortcode Attribute vulnerability discovered by testoun in WordPress Plugin Embed Google Photos album versions = 2.2.1...

WordPress affiliate-toolkit plugin <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin affiliate-toolkit versions = 3.8.8...

WordPress KiviCare plugin < 4.5.2 - Unauthenticated Privilege Escalation via Registration vulnerability

Unauthenticated Privilege Escalation via Registration vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.2...

WordPress Amelia plugin < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR vulnerability

Provider+ Cross-Customer Appointment Data Disclosure via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Amelia versions 2.4.6...

WordPress Fluent Forms plugin <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability

Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values vulnerability discovered by Adrien Brunner in WordPress Plugin FluentForm versions = 6.2.11...

WordPress Prevent Direct Access - Protect WordPress Files plugin <= 2.8.8.8 - Unauthenticated Protected File Access vulnerability

WordPress Prevent Direct Access - Protect WordPress Files plugin = 2.8.8.8 - Unauthenticated Protected File Access vulnerability discovered by Lucas Montes NiRoX in WordPress Plugin Prevent Direct Access versions = 2.8.8.8...

WordPress Quick PayPal Payments plugin <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN vulnerability

Unauthenticated Payment Bypass via PayPal IPN vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Quick Paypal Payments versions = 5.7.50...

WordPress Welcart e-Commerce plugin < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability

Unauthenticated Payment Bypass via Forged Settlement Callback vulnerability discovered by Pedro Pinho in WordPress Plugin Welcart e-Commerce versions 2.11.33...

WordPress Wallet System for WooCommerce plugin < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability

Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount vulnerability discovered by takuma in WordPress Plugin Wallet System for WooCommerce versions 2.7.10...