WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.2 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WooCommerce Multivendor Marketplace – REST API versions = 1.6.2...

CVE-2024-11300

CVE-2024-11300 affects lunary-ai/lunary prior to version 1.6.3, via improper access control that lets a user view another user’s prompt data. The issue is triggered by accessing specific URLs (notably /prompts/prompt_id) and impacts 1.6.2 and the main branch. Documented characteristics: unauthori...

CVE-2024-12824 Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it...

WordPress plugin Nokri 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin SKU Generator for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

WordPress Nokri theme <= 1.6.2 - Unauthenticated Arbitrary Password Change vulnerability

Unauthenticated Arbitrary Password Change vulnerability discovered by Lucio Sá in WordPress Theme Nokri versions = 1.6.2...

CVE-2025-26760

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Wow-Company Calculator Builder calculator-builder allows PHP Local File Inclusion.This issue affects Calculator Builder: from n/a through = 1.6.2...

CVE-2025-26760 WordPress Calculator Builder plugin <= 1.6.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Wow-Company Calculator Builder calculator-builder allows PHP Local File Inclusion.This issue affects Calculator Builder: from n/a through = 1.6.2...

CVE-2025-26760

CVE-2025-26760: WordPress Calculator Builder plugin

CVE-2025-26760 WordPress Calculator Builder plugin <= 1.6.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Wow-Company Calculator Builder calculator-builder allows PHP Local File Inclusion.This issue affects Calculator Builder: from n/a through = 1.6.2...

WordPress plugin Calculator Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-1736 · WordPress · Medical Addon For Elementor

Name of the Vulnerable Software and Affected Versions: Medical Addon for Elementor plugin for WordPress versions up to, and including, 1.6.2 Description: The issue allows authenticated attackers with Contributor-level access and above to read the content of draft, pending, and private posts due t...

WordPress Medical Addon for Elementor plugin <= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Exposure via Shortcode vulnerability discovered by Francesco Carlucci in WordPress Plugin Medical Addon for Elementor versions = 1.6.2...

CVE-2025-0939

The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke tho...

CVE-2025-0939

CVE-2025-0939 concerns the WordPress plugin MagicForm (WordPress Form Builder) up to version 1.6.2, due to a missing capability check in its AJAX actions. According to Wordfence, authenticated attackers with Subscriber-level access or higher can invoke those AJAX actions to delete or view logs, a...

WordPress plugin MagicForm 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress MagicForm - WordPress Form Builder plugin <= 1.6.2 - Missing Authorization vulnerability

WordPress MagicForm - WordPress Form Builder plugin = 1.6.2 - Missing Authorization vulnerability discovered by Lucio Sá in WordPress Plugin MagicForm versions = 1.6.2...

WordPress YOGO Booking plugin <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin YOGO Booking versions = 1.6.2...

CVE-2024-12462 YOGO Booking <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The YOGO Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'yogo-calendar' shortcode in all versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

PT-2025-1856 · WordPress · Yogo Booking

Name of the Vulnerable Software and Affected Versions: YOGO Booking plugin for WordPress versions up to, and including, 1.6.2 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the yogo-calenda...