WordPress TrueBooker plugin <= 1.0.2 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin TrueBooker versions = 1.0.2...

WordPress Timeline and History slider plugin <= 2.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Timeline and History slider versions = 2.3...

WordPress Kodex Posts likes plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Dmitriy Prokhorov Patchstack Alliance in WordPress Plugin Kodex Posts likes versions = 2.5.0...

WordPress Unite Gallery Lite plugin <= 1.7.62 - SQL Injection vulnerability

SQL Injection vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Unite Gallery Lite versions = 1.7.62...

WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin WpEvently versions = 4.2.1...

WordPress Media.net Ads Manager plugin <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by István Márton in WordPress Plugin Media.net Ads Manager versions = 2.10.13...

WordPress BookingPress plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update and Arbitrary File Upload vulnerability discovered by shaman0x01 in WordPress Plugin BookingPress versions = 1.1.5...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Microsoft

Collateral Damage Collateral Damage is a kernel exploit for Xb...

WordPress Modern Events Calendar Lite plugin <= 7.11.0 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin Modern Events Calendar Lite versions = 7.11.0...

WordPress Elementor Addons by Livemesh plugin <= 8.4.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin Livemesh Addons for Elementor versions = 8.4.0...

WordPress Ideaplus plugin <= 1.0.5 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Ideaplus versions = 1.0.5...

WordPress YAHMAN Add-ons plugin <= 0.9.28 - Malicious Polyfill.io Embed vulnerability

Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin YAHMAN Add-ons versions = 0.9.28...

WordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Cowidgets – Elementor Addons versions = 1.1.1...

WordPress Core < 6.5.5 - Cross Site Scripting (XSS) via template-part vulnerability

Cross Site Scripting XSS via template-part vulnerability discovered by Rafie Muhammad Patchstack in WordPress core versions 6.5.5...

WordPress SiteGuard WP plugin <= 1.7.6 - Login Page Disclosure vulnerability

Login Page Disclosure vulnerability discovered by Yuuta Watanabe in WordPress Plugin SiteGuard WP Plugin versions = 1.7.6...

WordPress Interface theme <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Interface versions = 3.1.0...

Telerik Report Server Authentication Bypass / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule 'Telerik Report Server Auth Bypass and Deserialization RCE', 'Description' = %q This module chains an authentication bypass...

WordPress Weather Widget Pro plugin <= 1.1.40 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Weather Widget Pro versions = 1.1.40...

WordPress Photo Gallery by 10Web plugin <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function vulnerability

Authenticated Contributor+ Path Traversal via escdir Function vulnerability discovered by Tobias Weißhaar kun19 in WordPress Plugin Photo Gallery by 10Web versions = 1.8.23...

WordPress WooCommerce Tools plugin <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Module Deactivation vulnerability discovered by Lucio Sá in WordPress Plugin WooCommerce Tools versions = 1.2.9...