100146 matches found
WordPress Forminator Forms plugin <= 1.56.1 - Unauth. Arbitrary File Upload
Unauth. Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...
WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Gravity Booster Styles & Layouts for Gravity Forms versions = 6.1...
WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin RomethemeForm For Elementor versions = 1.2.6...
WordPress WP Table Builder plugin <= 2.2.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Table Builder versions = 2.2.1...
WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery versions = 1.16.20...
WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...
600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin
On July 14th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Forminator Forms, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...
WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability
Remote File Inclusion vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions 1.14.2...
WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Chaty Pro versions = 3.5.8...
WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Subscribe2 versions = 10.46...
WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by 20kilograma in WordPress Plugin ThumbPress versions 6.5...
WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by VanTastic in WordPress Plugin Modern Events Calendar versions 7.35.0...
WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Aotuman Grab WeChat Articles versions = 2.0.1...
WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Nabil Irawan in WordPress Plugin Sync Post With Other Site versions = 1.9.3...
WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by johska in WordPress Plugin Cwicly versions = 1.4.4...
WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Mayosis Core versions = 5.4.7...
WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Doan Dinh Van in WordPress Plugin FormyChat versions = 2.15.7...
WordPress TrueBooker plugin <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter vulnerability
Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebookerwpuserid' Parameter vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin TrueBooker versions = 1.2.6...
WordPress Groundhogg plugin <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter vulnerability
Authenticated Vendor+ SQL Injection via 'tagquery' Parameter vulnerability discovered by Jonathan Dersch - Jonathan Dersch - Bug Bounty in WordPress Plugin Groundhogg versions = 4.5.14...
WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability discovered by Ivaylo in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...