WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...

WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Verdure Core versions = 1.2...

WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability

SQL Injection vulnerability discovered by arrester in WordPress Plugin Locatoraid Store Locator versions = 3.9.72...

WordPress TranslatePress - Translate Multilingual sites with AI Translation plugin <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

WordPress TranslatePress - Translate Multilingual sites with AI Translation plugin = 3.2.5 - Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin TranslatePress versions = 3.2.5...

WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Austin Ginder in WordPress Plugin Abandoned Cart Pro for WooCommerce versions = 10.4.0...

WordPress EWWW Image Optimizer plugin <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content vulnerability discovered by UKO - Korea univ. in WordPress Plugin EWWW Image Optimizer versions = 8.7.3...

WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin NotificationX Pro versions = 3.1.4...

WordPress BookingPress Appointment Booking Pro plugin <= 6.0.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin BookingPress Appointment Booking Pro versions = 6.0.6...

WordPress Atarim plugin <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta vulnerability

Authenticated Author+ Arbitrary File Deletion via 'wpattachedfile' Meta vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Atarim versions = 5.1.1...

WordPress TrueBooker plugin <= 1.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter vulnerability

Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebookerwpuserid' Parameter vulnerability discovered by Décio Brandão in WordPress Plugin TrueBooker versions = 1.2.6...

WordPress PPWP: Password Protect Pages, Posts & Full or Partial Content plugin <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure vulnerability

Improper Authorization To Authenticated Contributor+ Master Password Exposure vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin PPWP versions = 1.9.15...

WordPress Vitepos plugin < 3.6.0 - Outlet Manager+ Privilege Escalation vulnerability

Outlet Manager+ Privilege Escalation vulnerability discovered by RealKingEngine ISAL FRAMEWORK in WordPress Plugin Vitepos versions 3.6.0...

WordPress AutoNetTV Relay plugin < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron vulnerability

Unauthenticated Privilege Escalation via Scheduled Sync Cron vulnerability discovered by moonge in WordPress Plugin AutoNetTV Relay versions 3.0.14...

WordPress HT Contact Form plugin < 2.9.3 - Unauthenticated Saved Form Draft Data Disclosure vulnerability

Unauthenticated Saved Form Draft Data Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin HT Contact Form 7 versions 2.9.3...

WordPress WC Buckaroo BPE Gateway plugin < 4.9.0 - Subscriber+ Unauthorized Order Refund vulnerability

Subscriber+ Unauthorized Order Refund vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Buckaroo Woocommerce Payments Plugin versions 4.9.0...

WordPress Essential Blocks plugin < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint vulnerability

Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Essential Blocks for Gutenberg versions 6.4.0...

WordPress LearnPress plugin < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature vulnerability

Instructor+ Server-Side Request Forgery via openaiapplyimagefeature vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin LearnPress versions 4.4.4...

WordPress wpForo Forum plugin < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment vulnerability

Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass Assignment vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin wpForo Forum versions 3.1.3...

WordPress Payment Gateway for Redsys & WooCommerce Lite plugin < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay Callback vulnerability

Unauthenticated Payment Confirmation via Unverified Inespay Callback vulnerability discovered by Shivamani Vastrala in WordPress Plugin Redsys for WooCommerce Light versions 7.0.2...

WordPress Builderall for WordPress plugin < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes vulnerability

Unauthenticated OAuth Access Token Poisoning via Public REST Routes vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin Builderall Builder for WordPress versions 3.0.2...