WordPress Flexmls® IDX plugin <= 3.14.27 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin Flexmls® IDX versions = 3.14.28...

WordPress Solace Extra plugin <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WordFence in WordPress Plugin Solace Extra versions = 1.3.0...

HEXAGreen CMS SQL Injection

HEXAGreen CMS suffers from a remote SQL injection vulnerability. This software does not offer any version associated with it. Title: HEXAGreen CMS - Authenticated SQLi Description: HEXAGreen CMS authenticated error-based sql injection Source URL: http://ezcode.pt/tests/hexagreen/admin/ Source...

Drupal AI (Artificial Intelligence) module < 1.0.5 - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drew Webber mcdruid in WordPress Module AI Artificial Intelligence versions 1.0.5...

WordPress VEDA theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection vulnerability

Authenticated Subscriber+ PHP Object Injection vulnerability discovered by Lucio Sá in WordPress Theme VEDA versions = 4.2...

WordPress Hero Mega Menu - Responsive WordPress Menu Plugin plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion vulnerability

WordPress Hero Mega Menu - Responsive WordPress Menu Plugin plugin = 1.16.5 - Missing Authorization to Authenticated Subscriber+ Arbitrary Directory Deletion vulnerability discovered by Lucio Sá in WordPress Plugin Hero Mega Menu - Responsive WordPress Menu Plugin versions = 1.16.5...

Teachers Record Management System 2.1 SQL Injection

Teachers Record Management System version 2.1 suffers from a remote SQL injection vulnerability. Exploit Title: Teachers Record Management System v2.1 | Authenticated Time-Based SQLi Date: 2025-03-04 Exploit Author: Mehmet Can Kadıoğlu a.k.a mao7un Vendor:...

WordPress Album Gallery – WordPress Gallery plugin <= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Meta vulnerability

Authenticated Editor+ PHP Object Injection via Gallery Meta vulnerability discovered by Francesco Carlucci in WordPress Plugin Album Gallery – WordPress Gallery versions = 1.6.3...

WordPress GenerateBlocks plugin <= 1.9.1 - Authenticated (Contributor+) Sensitive Information Exposure via 'get_image_description' vulnerability

Authenticated Contributor+ Sensitive Information Exposure via 'getimagedescription' vulnerability discovered by Nishiv in WordPress Plugin GenerateBlocks versions = 1.9.1...

WordPress Tabs for WooCommerce plugin <= 1.0.0 - Authentiated (Shop Manager+) PHP Object Injection in product_has_custom_tabs vulnerability

Authentiated Shop Manager+ PHP Object Injection in producthascustomtabs vulnerability discovered by Francesco Carlucci in WordPress Plugin Tabs for WooCommerce versions = 1.0.0...

WordPress WHMPress - WHMCS Client Area plugin <= 4.3-revision-3 - Authenticated (Subscriber+) Arbitrary Options Update vulnerability

WordPress WHMPress - WHMCS Client Area plugin = 4.3-revision-3 - Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Tonn in WordPress Plugin WHMCS Client Area for WordPress by WHMpress versions = 4.3-revision-3...

WordPress MK Google Directions plugin <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin MK Google Directions versions = 3.1...

WordPress Jeg Elementor Kit plugin <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas vulnerability

Authenticated Contributor+ Sensitive Information Exposure via Countdown and Off-Canvas vulnerability discovered by Ankit Patel in WordPress Plugin Jeg Elementor Kit versions = 2.6.11...

WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Image Photo Gallery Final Tiles Grid versions = 3.6.0...

WordPress Carousel, Slider, Gallery by WP Carousel plugin <= 2.6.8 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Carousel, Slider, Gallery by WP Carousel versions = 2.6.8...

WordPress Rife Elementor Extensions & Templates plugin <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Writing Effect Headline Shortcode vulnerability discovered by zer0gh0st in WordPress Plugin Rife Elementor Extensions & Templates versions = 1.2.5...

WordPress Frontend Content Forms for User Submissions (UGC) plugin <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'buddyformsnav' Shortcode vulnerability discovered by Max Boll b0lli in WordPress Plugin BuddyForms versions = 2.8.15...

WordPress Ultimate Member plugin <= 2.9.2 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability discovered by tiborisaak in WordPress Plugin Ultimate Member versions = 2.9.2...

WordPress Ziggeo plugin <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Ziggeo versions = 3.1...

WordPress Mini Course Generator plugin <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Mini Course Generator versions = 1.0.5...