WordPress Beaver Builder plugin <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via type Parameter vulnerability discovered by zer0gh0st in WordPress Plugin Beaver Builder versions = 2.8.3.5...

WordPress Front End Users plugin <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection vulnerability

Authenticated Contributor+ Time-Based SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Front End Users versions = 3.2.28...

WordPress Front End Users plugin <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Front End Users versions = 3.2.28...

Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck

CVE-2023-50564-pluck CVE-2023-50564 An arbitrary file upload v...

WordPress Orbit Fox by ThemeIsle plugin <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by wesley wcraft in WordPress Plugin Orbit Fox by ThemeIsle versions = 2.10.36...

WordPress BitForm plugin 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploads vulnerability

WordPress BitForm plugin 2.0 - 2.13.9 - Authenticated Administrator+ Arbitrary JavaScript File Uploads vulnerability discovered by siunam in WordPress Plugin Bit Form versions 2.0 - 2.13.9...

WordPress ElementsKit Pro plugin <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin ElementsKit Pro versions = 3.6.5...

WordPress Media Library Assistant plugin <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action vulnerability

Authenticated Author+ Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action vulnerability discovered by wesley wcraft in WordPress Plugin Media LIbrary Assistant versions = 3.18...

WordPress Opal Membership plugin <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure vulnerability

Authenticated Subscriber+ Information Disclosure vulnerability discovered by Karolina Jankowska in WordPress Plugin Opal Membership versions = 1.2.4...

WordPress Slider by 10Web plugin <= 1.2.57 - Authenticated (Contributor+) SQL Injection via id Parameter vulnerability

Authenticated Contributor+ SQL Injection via id Parameter vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Slider by 10Web versions = 1.2.57...

WordPress LearnPress plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter vulnerability

Authenticated Contributor+ SQL Injection via order Parameter vulnerability discovered by Lucio Sá in WordPress Plugin LearnPress versions = 4.2.6.9.3...

WordPress WPBakery plugin <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by João Pedro Soares de Alcântara in WordPress Plugin WPBakery Page Builder versions = 7.7...

WordPress File Manager Pro plugin <= 1.8.2 - Authenticated Plugin Settings Update vulnerability

Authenticated Plugin Settings Update vulnerability discovered by bart in WordPress Plugin File Manager Pro versions = 1.8.2...

WordPress LearnPress plugin <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by stealthcopter in WordPress Plugin LearnPress versions = 4.2.6.8.2...

WordPress Social Auto Poster plugin <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Social Auto Poster versions = 5.3.14...

WordPress Social Auto Poster plugin <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by István Márton in WordPress Plugin Social Auto Poster versions = 5.3.14...

CVE-2024-39963

AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered to contain an authenticated remote command execution RCE vulnerability via the macFilterType parameter at /goform/setMacFilterCfg...

WordPress Brizy – Page Builder plugin <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload vulnerability

Authenticated Contributor+ Arbitrary File Upload vulnerability discovered by stealthcopter in WordPress Plugin Brizy versions = 2.4.44...

WordPress BookingPress Appointment Booking plugin <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation vulnerability

Authenticated Subscriber+ Arbitrary File Read to Arbitrary File Creation vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin BookingPress versions = 1.1.5...

WordPress PowerPress Podcasting plugin by Blubrry plugin <= 11.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mediaurl Parameter vulnerability discovered by Webbernaut in WordPress Plugin PowerPress Podcasting versions = 11.9.10...