WordPress MP3 Sticky Player plugin <= 8.0 - Unauthenticated Arbitrary File Read/Download vulnerability

Unauthenticated Arbitrary File Read/Download vulnerability discovered by Tonn in WordPress Plugin MP3 Sticky Player versions = 8.0...

WordPress 우커머스 네이버페이 plugin <= 3.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mnppurchase Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin 우커머스 네이버페이 versions = 3.3.7...

WordPress Custom CSS, JS & PHP plugin <= 2.3.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Custom CSS, JS & PHP versions = 2.3.0...

WordPress Social Login plugin <= 5.9.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by wesley wcraft in WordPress Plugin Social Login versions = 5.9.0...

WordPress RealtyCandy IDX Broker Extended plugin <= 1.5.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin RealtyCandy IDX Broker Extended versions = 1.5.1...

WordPress Theater for WordPress plugin <= 0.18.6.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Theater for WordPress versions = 0.18.6.2...

WordPress Subaccounts for WooCommerce plugin <= 1.6.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Subaccounts for WooCommerce versions = 1.6.0...

WordPress Grip theme <= 1.0.9 - Arbitrary Plugin Activation/Deactivation to RCE vulnerability

Arbitrary Plugin Activation/Deactivation to RCE vulnerability discovered by Mika Patchstack Alliance in WordPress Theme Grip versions = 1.0.9...

WordPress Ashe theme <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter vulnerability

Reflected Cross-Site Scripting via addqueryarg Parameter vulnerability discovered by vgo0 in WordPress Theme Ashe versions = 2.243...

WordPress Explara Events plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Explara Events versions = 0.1.3...

CVE-2024-51051

CVE-2024-51051 affects AVSCMS v8.2.0, where the Administrator account is exposed by weak default credentials. The vulnerability is documented across multiple feeds (NVD/Red Hat/CNNVD/CVE catalogs) confirming the same issue: weak default admin credentials in AVSCMS 8.2.0. The provided metrics indi...

WordPress Shipping with Venipak for WooCommerce plugin <= 1.22.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by thiennv in WordPress Plugin Shipping with Venipak for WooCommerce versions = 1.22.3...

WordPress Blogger 301 Redirect plugin <= 2.5.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by kr0d in WordPress Plugin Blogger 301 Redirect versions = 2.5.3...

WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin My Geo Posts Free versions = 1.2...

WordPress DK White Label plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin DK White Label versions = 1.0...

CVE-2024-9693

Removed by vendor...

WordPress Debug Tool plugin <= 2.2 - Remote Code Execution vulnerability

Remote Code Execution vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Debug Tool versions = 2.2...

WordPress WDES Responsive Mobile Menu plugin <= 5.3.18 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WDES Responsive Mobile Menu versions = 5.3.18...

WordPress DigiPass plugin <= 0.3.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin DigiPass versions = 0.3.0...

WordPress Boat Rental Plugin for WordPress plugin <= 1.0.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Plugin Boat Rental Plugin for WordPress versions = 1.0.1...