WordPress Marketplace Items plugin <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by zaim in WordPress Plugin Marketplace Items versions = 1.5.5...

WordPress RightMessage WP plugin <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin RightMessage WP versions = 0.9.7...

WordPress Chatroll Live Chat plugin <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Chatroll Live Chat versions = 2.5.0...

WordPress Sellsy plugin <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Sellsy versions = 2.3.3...

ABB Cylon Aspect 3.08.03 (MapServicesHandler) Authenticated Reflected XSS

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an authenticated reflected...

WordPress Dynamics 365 Integration plugin <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection vulnerability

Authenticated Contributor+ Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Dynamics 365 Integration versions = 1.3.23...

ABB Cylon Aspect 3.08.03 MapServicesHandler Cross Site Scripting Vulnerability

ABB Cylon Aspect version 3.08.03 suffers from an authenticated reflected cross site scripting vulnerability. Input passed to the GET parameters name and id is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser...

WordPress Avada Builder plugin <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure vulnerability

Authenticated Contributor+ Protected Post Disclosure vulnerability discovered by Webbernaut in WordPress Plugin Fusion Builder versions = 3.11.12...

WordPress WP Travel Engine plugin <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by Webbernaut in WordPress Plugin WP Travel Engine versions = 1.3.7...

WordPress Booking Calendar plugin <= 3.2.19 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.19...

WordPress Loan Comparison plugin <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Loan Comparison versions = 2.0...

WordPress WordPress Simple Shopping Cart plugin <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin Simple Shopping Cart versions = 5.0.7...

WordPress Optio Dentistry plugin <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin Optio Dentistry versions = 2.1...

WordPress Custom Product Tabs For WooCommerce plugin <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection vulnerability

Authenticated Shop Manager+ PHP Object Injection vulnerability discovered by Francesco Carlucci in WordPress Plugin Custom Product Tabs For WooCommerce versions = 1.2.4...

WordPress NACC WordPress Plugin plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin NACC WordPress Plugin versions = 4.1.0...

Reolink Multiple IP Cameras OS Command Injection Vulnerability

Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root...

WordPress Animation Addons for Elementor plugin <= 1.1.6 - Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template vulnerability

Authenticated Contributor+ Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template vulnerability discovered by Ankit Patel in WordPress Plugin Animation Addons for Elementor versions = 1.1.6...

WordPress Video Share VOD plugin <= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Video Share VOD versions = 2.6.30...

WordPress Philantro – Donations and Donor Management plugin <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by yudha in WordPress Plugin Philantro versions = 5.2...

WordPress IDer Login for WordPress plugin <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin IDer Login versions = 2.1...