88913 matches found
WordPress Forminator Forms plugin <= 1.56.1 - Unauth. Arbitrary File Upload
Unauth. Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...
WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Gravity Booster Styles & Layouts for Gravity Forms versions = 6.1...
WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin RomethemeForm For Elementor versions = 1.2.6...
WordPress WP Table Builder plugin <= 2.2.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Table Builder versions = 2.2.1...
WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery versions = 1.16.20...
WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...
600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin
On July 14th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Forminator Forms, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...
WordPress TrueBooker plugin <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter vulnerability
Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebookerwpuserid' Parameter vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin TrueBooker versions = 1.2.6...
WordPress Groundhogg plugin <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter vulnerability
Authenticated Vendor+ SQL Injection via 'tagquery' Parameter vulnerability discovered by Jonathan Dersch - Jonathan Dersch - Bug Bounty in WordPress Plugin Groundhogg versions = 4.5.14...
WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability discovered by Ivaylo in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...
WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter vulnerability
Authenticated Editor+ SQL Injection via 'key' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...
WordPress Hydra Booking plugin <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter vulnerability
Authenticated Host+ Stored Cross-Site Scripting via 'firstname' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Hydra Booking versions = 1.2.2...
WordPress Beaver Builder Page Builder plugin <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter vulnerability
Authenticated Author+ Stored Cross-Site Scripting via Button Module 'button' Parameter vulnerability discovered by a1batr0ss in WordPress Plugin Beaver Builder versions = 2.10.2.2...
WordPress Image Uploader for Welcart plugin <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter vulnerability
Authenticated Author+ SQL Injection via Attachment 'posttitle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Image Uploader for Welcart versions = 1.4.6...
WordPress Pinpoint Booking System plugin <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter vulnerability
Unauthenticated Improper Input Validation to Price Manipulation via 'cartdata' Parameter vulnerability discovered by WordFence in WordPress Plugin Pinpoint Booking System versions = 2.9.9.6.8...
WordPress Propovoice: All-in-One Client Management System plugin <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter vulnerability
Authenticated ndpvmanager+ Privilege Escalation via 'role' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Propovoice CRM versions = 1.7.8...
WordPress MaxUpload plugin <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability
Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability discovered by JIWOONG LEE kimchunbok - Hyundai Red Team in WordPress Plugin MaxUpload versions = 1.4.0...
WordPress User Profile Builder plugin <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability
Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Profile Builder versions = 3.16.4...
WordPress 6Storage Rentals plugin <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter vulnerability
Unauthenticated Account Takeover via 'email' Parameter vulnerability discovered by WordFence in WordPress Plugin 6Storage Rentals versions = 2.27.0...
WordPress bLoyal: Loyalty & Promotions by bLoyal plugin <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings vulnerability
Authenticated Subscriber+ Privilege Escalation via Unprotected AJAX API URL Settings vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin bLoyal versions = 3.1.611.78...