WordPress VG WORT METIS plugin <= 2.0.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin VG WORT METIS versions = 2.0.1...

WordPress Royal Elementor Addons plugin <= 1.7.1024 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via Multiple Widgets vulnerability discovered by Asaf Mozes in WordPress Plugin Royal Elementor Addons versions = 1.7.1024...

WordPress Ultra Addons for Contact Form 7 plugin 3.5.11-3.5.19 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sy5temFr4cture in WordPress Plugin Ultimate Addons for Contact Form 7 versions 3.5.11-3.5.19...

WordPress Modern Design Library plugin <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via class Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Modern Design Library versions = 1.1.4...

WordPress Drive Folder Embedder plugin <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via tablecssclass Parameter vulnerability discovered by Gilang in WordPress Plugin Drive Folder Embedder versions = 1.1.0...

WordPress Charitable plugin <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Plugin's Privacy Settings vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Charitable versions = 1.8.6.1...

WordPress web-cam plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via slug Parameter vulnerability discovered by Gilang in WordPress Plugin web-cam versions = 1.0...

WordPress Namasha By Mdesign plugin <= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via playicontitle Parameter vulnerability discovered by Gilang in WordPress Plugin Namasha By Mdesign versions = 1.2.00...

WordPress Homerunner plugin <= 1.0.30 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Homerunner versions = 1.0.30...

WordPress The Countdown plugin <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via clientId Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin The Countdown – Block Countdown Timer versions = 2.0.1...

WordPress Post Rating and Review plugin <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via class Parameter vulnerability discovered by Gilang in WordPress Plugin Post Rating and Review versions = 1.3.4...

WordPress WP-PhotoNav plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photonav Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via photonav Shortcode vulnerability discovered by Gilang in WordPress Plugin WP-PhotoNav versions = 1.2.2...

WordPress GC Social wall plugin <= 1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin GC Social Wall versions = 1.15...

WordPress Event RSVP and Simple Event Management Plugin plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Event RSVP and Simple Event Management Plugin versions = 4.1.0...

WordPress WP SoundSystem plugin <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpsstm-track Shortcode vulnerability discovered by Gilang in WordPress Plugin WP SoundSystem versions = 3.4.2...

WordPress Tournament Bracket Generator plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via bracket Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via bracket Shortcode vulnerability discovered by Gilang in WordPress Plugin Tournament Bracket Generator versions = 1.0.0...

WordPress Responsive Food and Drink Menu plugin <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via displaypdfmenus Shortcode vulnerability discovered by Gilang in WordPress Plugin Responsive Food and Drink Menu versions = 2.3...

WordPress Post Carousel Slider for Elementor plugin <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function vulnerability

Authenticated Subscriber+ Missing Authorization via processwbelpspromoform Function vulnerability discovered by Peter Thaleikis in WordPress Plugin Post Carousel Slider for Elementor versions = 1.6.0...

WordPress Red Art Theme <= 3.7 is vulnerable to PHP Object Injection

Software Red Art Type Theme Vulnerable versions = 3.7 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-52828 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 443adc1cb34f Credits Frank Required privilege Subscriber Published 26 June...

WordPress DWT - Directory & Listing Theme <= 3.3.6 is vulnerable to Privilege Escalation

Software DWT - Directory & Listing Type Theme Vulnerable versions = 3.3.6 Fixed in 3.3.7 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-12827 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID c0ebe5820838 Credit...