WordPress Supreme Addons for Beaver Builder plugin <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via autoqrcodesabb Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Supreme Addons for Beaver Builder versions = 1.0.9...

WordPress hiWeb Export Posts plugin <= 0.9.0.0 - Cross-Site Request Forgery to Arbitrary File Deletion vulnerability

Cross-Site Request Forgery to Arbitrary File Deletion vulnerability discovered by johska in WordPress Plugin hiWeb Export Posts versions = 0.9.0.0...

WordPress Taeggie Feed plugin <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via name Attribute vulnerability discovered by Gilang in WordPress Plugin Taeggie Feed versions = 0.1.10...

WordPress iThoughts Advanced Code Editor plugin <= 1.2.10 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Nabil Irawan in WordPress Plugin iThoughts Advanced Code Editor versions = 1.2.10...

WordPress muse.ai video embedding plugin <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via muse-ai Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via muse-ai Shortcode vulnerability discovered by Gilang in WordPress Plugin muse.ai video embedding versions = 0.4...

WordPress ONLYOFFICE Docs plugin 1.1.0-2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function

Missing Authorization to Unauthenticated Privilege Escalation via callback Function vulnerability discovered by kr0d in WordPress Plugin ONLYOFFICE versions 1.1.0-2.2.0...

WordPress WP Applink plugin <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via title Parameter vulnerability discovered by Gilang in WordPress Plugin WP Applink versions = 0.4.1...

WordPress WebinarIgnition plugin <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass vulnerability

Unauthenticated Login Token Generation to Authentication Bypass vulnerability discovered by kr0d in WordPress Plugin WebinarIgnition versions = 4.03.32...

WordPress WP Get The Table plugin <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via url Parameter vulnerability discovered by Gilang in WordPress Plugin WP Get The Table versions = 1.5...

WordPress Get Youtube Subs plugin <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att Function vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via subscribelinkatt Function vulnerability discovered by Peter Thaleikis in WordPress Plugin Get Youtube Subs versions = 3.5...

WordPress WP Wallcreeper plugin <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable vulnerability

Missing Authorization to Authenticated Susbcriber+ Cache Enable/Disable vulnerability discovered by ch4r0n in WordPress Plugin WP Wallcreeper versions = 1.6.1...

WordPress Station Pro plugin <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parameters vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via width and height Parameters vulnerability discovered by Peter Thaleikis in WordPress Plugin Station Pro versions = 2.4.2...

WordPress Voltax Video Player plugin <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via id Parameter vulnerability discovered by Gilang in WordPress Plugin Voltax Video Player versions = 1.6.5...

WordPress Mine CloudVod plugin <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via audio Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Mine CloudVod versions = 2.1.10...

WordPress Structured Content plugin <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via scfslocalbusiness Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Structured Content versions = 1.6.4...

WordPress Ai Engine plugin <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions vulnerability

Missing URL Scheme Validation to Authenticated Subscriber+ Arbitrary File Read via simpleTranscribeAudio and getaudio Functions vulnerability discovered by ISMAILSHADOW in WordPress Plugin AI Engine versions = 2.9.4...

WordPress Security Ninja plugin 5.201-5.242 - Authenticated (Administrator+) Arbitrary File Read vulnerability

Authenticated Administrator+ Arbitrary File Read vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Security Ninja – Secure Firewall & Secure Malware Scanner versions 5.201-5.242...

WordPress Ebook Store plugin <= 5.8012 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by mikemyers in WordPress Plugin Ebook Store versions = 5.8012...

WordPress WPBookit plugin <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function vulnerability

Unauthenticated Arbitrary File Upload via imageuploadhandle Function vulnerability discovered by theviper17y in WordPress Plugin WPBookit versions = 1.0.6...

WordPress WPBakery Page Builder plugin <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Page Builder Elements vulnerability discovered by zer0gh0st in WordPress Plugin WPBakery Page Builder versions = 8.4.1...