PT-2025-3241

Name of the Vulnerable Software and Affected Versions WP Ultimate Exporter versions prior to 2.9.2 Description The issue is related to improper control of code generation, allowing PHP remote file inclusion. This can be exploited due to a 'code injection' vulnerability in the WP Ultimate Exporter...

WordPress plugin WP Ultimate Exporter 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

WordPress Hero Banner Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Hero Banner Ultimate versions = 1.4.4...

WordPress Indeed Ultimate Learning Pro plugin <= 3.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Pham Van Tam Patchstack Alliance in WordPress Plugin Ultimate Learning Pro versions = 3.9...

WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Webula Patchstack Alliance in WordPress Plugin WP Ultimate Exporter versions = 2.9.1...

CVE-2024-37543

Cross-Site Request Forgery CSRF vulnerability in Nitesh Ultimate Auction ultimate-auction allows Cross Site Request Forgery.This issue affects Ultimate Auction : from n/a through = 4.2.5...

CVE-2023-47693

Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through = 3.2.6...

CVE-2024-37543 WordPress Ultimate Auction plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Nitesh Ultimate Auction ultimate-auction allows Cross Site Request Forgery.This issue affects Ultimate Auction : from n/a through = 4.2.5...

CVE-2024-37543

CVE-2024-37543 corresponds to a CSRF vulnerability in the WordPress plugin Ultimate Auction (by Nitesh Singh) affecting versions up to 4.2.5. Public sources confirm this is a Cross-Site Request Forgery issue used to perform unauthorized actions on a user’s account. The CVE’s CVSSv3.1 base score i...

CVE-2024-37543 WordPress Ultimate Auction plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Nitesh Ultimate Auction ultimate-auction allows Cross Site Request Forgery.This issue affects Ultimate Auction : from n/a through = 4.2.5...

WordPress plugin Ultimate Addons for Contact Form 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exis...

CVE-2023-46605: Missing Authorization

Missing Authorization vulnerability in Ruslan Suhar Convertful – Your Ultimate On-Site Conversion Tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Convertful – Your Ultimate On-Site Conversion Tool: from n/a through 2.5...

PT-2025-1546 · WordPress · Themefic Ultimate Addons For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Themefic Ultimate Addons for Contact Form 7 versions 3.2.6 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations:...

CVE-2024-37543: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Nitesh Ultimate Auction ultimate-auction allows Cross Site Request Forgery.This issue affects Ultimate Auction : from n/a through = 4.2.5...

CVE-2023-47693: Missing Authorization

Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through = 3.2.6...

WordPress plugin Ultimate Auction 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2024-10862: Improper Neutralization of Special Elements used in an SQL Command

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'searchparams' parameter in all versions up to, and including, 8.7.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2024-12413: Missing Authorization

The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions like 'marketkingdeleteteammember', 'marketkingrejectuser', 'marketkingsaveprofilesettings', and many more in all...

CVE-2024-12032: Improper Neutralization of Special Elements used in an SQL Command

The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiryid' parameter of the 'tfenquiryreplyemailcallback' function in all versions up to, and including, 2.15.3 due to...

WordPress Elementor Header & Footer Builder plugin <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Page Title Widget vulnerability discovered by wesley wcraft in WordPress Plugin Ultimate Addons for Elementor - Lite versions = 1.6.46...