WordPress ACF: Google Font Selector plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin ACF: Google Font Selector versions = 3.0.1...

WordPress Anything Popup plugin <= 7.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Anything Popup versions = 7.3...

WordPress Download Manager plugin <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletion vulnerability

Authenticated Author+ Arbitrary File Deletion vulnerability discovered by WordFence in WordPress Plugin Download Manager versions = 3.3.12...

CVE-2025-24054 Under Active Attack—Steals NTLM Credentials on File Download

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a medium-severity security flaw impacting Microsoft Windows to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation in the wild. The vulnerability, assigned the CVE identifier...

WordPress Coupon Affiliates plugin <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter vulnerability

Reflected Cross-Site Scripting via 'commissionsummary' Parameter vulnerability discovered by wesley wcraft in WordPress Plugin Coupon Affiliates versions = 6.3.0...

WordPress WPAMS plugin <= 44.0 (17-08-2023) - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jingle Bells in WordPress Plugin WPAMS versions = 44.0 17-08-2023...

WordPress Memberpress plugin < 1.12.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin MemberPress versions 1.12.0...

WordPress WordPress Video Robot - The Ultimate Video Importer plugin <= 1.20.0 - Reflected Cross Site Scripting (XSS) vulnerability

WordPress WordPress Video Robot - The Ultimate Video Importer plugin = 1.20.0 - Reflected Cross Site Scripting XSS vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin WordPress Video Robot - The Ultimate Video Importer versions = 1.20.0...

WordPress Booster Plus for WooCommerce plugin <= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Booster Plus for WooCommerce versions = 7.2.4...

WordPress AdminQuickbar plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin AdminQuickbar versions = 1.9.1...

WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by johska Patchstack Alliance in WordPress Plugin I Draw versions = 1.0...

WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh in WordPress Plugin Arigato Autoresponder and Newsletter versions = 2.7.2.4...

WordPress BERTHA AI plugin <= 1.12.10.2 - Arbitrary Content Deletion Vulnerability

Arbitrary Content Deletion Vulnerability discovered by theviper17 in WordPress Plugin BERTHA AI versions = 1.12.10.2...

WordPress Web Directory Free plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by astra.r3verii in WordPress Plugin Web Directory Free versions = 1.7.8...

WordPress Debug Log Manager plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Martino Spagnuolo in WordPress Plugin Debug Log Manager versions = 2.3.4...

WordPress Target Video Easy Publish plugin <= 3.8.9 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Phan Trong Quan - VNPT Cyber Immunity in WordPress Plugin Target Video Easy Publish versions = 3.8.9...

WordPress Vitepos plugin <= 3.1.7 - Broken Authentication Vulnerability

Broken Authentication Vulnerability discovered by astra.r3verii in WordPress Plugin Vitepos versions = 3.1.7...

WordPress Dashi plugin <= 3.1.8 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Dashi versions = 3.1.8...

WordPress Contact Form vCard Generator plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Contact Form vCard Generator versions = 2.4...

WordPress Modal Survey plugin <= 2.0.2.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Modal Survey versions = 2.0.2.0.1...