WordPress ApplyOnline – Application Form Builder and Manager plugin < 2.6.3 - Unauthenticated Application File Access vulnerability

Unauthenticated Application File Access vulnerability discovered by Arian Mosallah in WordPress Plugin ApplyOnline versions 2.6.3...

WordPress Jetpack plugin < 13.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Marc Montpas in WordPress Plugin Jetpack versions 13.8...

WordPress Jetpack plugin < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution vulnerability

Unauthenticated Arbitrary Block & Shortcode Execution vulnerability discovered by Marc Montpas in WordPress Plugin Jetpack versions 13.8...

WordPress Happyforms plugin < 1.26.3 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Happyforms versions 1.26.3...

WordPress User Activity Tracking and Log plugin < 4.1.4 - IP Spoofing vulnerability

IP Spoofing vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin User Activity Tracking and Log versions 4.1.4...

WordPress TwitterPosts plugin <= 1.0.2 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin TwitterPosts versions = 1.0.2...

WordPress illi Link Party! plugin <= 1.0 - Admin+ Stored Cross-Site Scripting vulnerability

Admin+ Stored Cross-Site Scripting vulnerability discovered by Bob Matyas in WordPress Plugin illi Link Party! versions = 1.0...

WordPress Payment Gateway for Telcell plugin < 2.0.4 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by Enrico Marcolini, Claudio Marchesini in WordPress Plugin Payment Gateway for Telcell versions 2.0.4...

WordPress WolfNet IDX for WordPress plugin <= 1.19.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Ma Long in WordPress Plugin WolfNet IDX versions = 1.19.1...

WordPress LogDash Activity Log plugin < 1.1.4 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Nicolas Surribas in WordPress Plugin LogDash Activity Log versions 1.1.4...

WordPress Jupiterx Core plugin <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Inline SVG vulnerability discovered by stealthcopter in WordPress Plugin JupiterX Core versions = 4.8.12...

WordPress EventON plugin <= 4.9.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Nguyễn Trung Kiên in WordPress Plugin EventON versions = 4.9.6...

WordPress Wholesale Market plugin < 2.2.2 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by WPScan in WordPress Plugin Wholesale Market versions 2.2.2...

WordPress Booking Calendar plugin <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpbc Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Booking Calendar versions = 10.11.1...

WordPress WP-Members plugin <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpmemusermemberships Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin WP-Members versions = 3.5.2...

WordPress WPBot Pro Wordpress Chatbot plugin <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WPBot Pro Wordpress Chatbot versions = 13.6.2...

WordPress Crawlomatic Multipage Scraper Post Generator plugin <= 2.6.8.1 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin Crawlomatic Multisite Scraper Post Generator versions = 2.6.8.1...

WordPress Echo RSS Feed Post Generator plugin <= 5.4.8.1 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin Echo RSS Feed Post Generator Plugin for WordPress versions = 5.4.8.1...

WordPress AlT Monitoring plugin <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin AlT Monitoring versions = 1.0.3...

WordPress Audio Comments Plugin plugin <= 1.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Audio Comments versions = 1.0.4...