WordPress Freeton WP plugin <= 1.0.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Freeton WP versions = 1.0.0...

WordPress Mindstien Quick Login plugin <= 1.0 - Unauthenticated Administrator Account Takeover vulnerability

Unauthenticated Administrator Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Mindstien Quick Login versions = 1.0...

WordPress click5 CRM add-on to Ninja Forms plugin <= 1.0.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Ninja Forms versions = 1.0.1...

WordPress Envira Gallery plugin < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability

Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Envira Photo Gallery versions 1.16.2...

WordPress Mobile builder plugin <= 1.4.2 - Subscriber+ Privilege Escalation to Admin vulnerability

Subscriber+ Privilege Escalation to Admin vulnerability discovered by Raphael P. Cigana in WordPress Plugin Mobile builder versions = 1.4.2...

WordPress Mobile builder plugin <= 1.4.2 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Raphael P. Cigana in WordPress Plugin Mobile builder versions = 1.4.2...

WordPress Prenotazioni plugin <= 1.7.5 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Prenotazioni versions = 1.7.5...

WordPress LTL Freight Quotes plugin 4.2.11-4.2.18 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by achmad sonif in WordPress Plugin LTL Freight Quotes – Old Dominion Edition versions 4.2.11-4.2.18...

WordPress Contest Gallery plugin < 33.0.1 - Unauthenticated Email Verification Bypass vulnerability

Unauthenticated Email Verification Bypass vulnerability discovered by Akshat Parikh SN1PER in WordPress Plugin Contest Gallery versions 33.0.1...

CVE-2019-11223

CVE-2019-11223 Arbitrary File Upload in Wordpress Plugin SupportCandy Version 2.0 Below https://cert.kalasag.com.ph/news/research/vulnerable-wordpress-plugin-lets-you-take-over-websites/ https://wordpress.org/plugins/supportcandy/developers...

WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetEngine versions = 3.8.16...

WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Push Notification for Post and BuddyPress versions = 3.23...

WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin Auction Nudge – Your eBay on Your Site versions = 8.4.0...

WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mor Golan in WordPress Plugin Easy Property Listings versions = 3.5.25...

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Paid Videochat Turnkey Site versions = 7.5.12...

WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by AndrewN in WordPress Plugin Affiliates versions = 7.0.1...

WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Bus Ticket Booking with Seat Reservation versions = 5.9.7...

WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by jydae in WordPress Plugin JetProductTables versions = 1.2.4...

WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

Session Hijacking vulnerability discovered by Peter Tang in WordPress Plugin Broadcast Live Video versions = 7.3.2...

WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Đỗ Trung Kiên in WordPress Plugin Frontend Dashboard versions = 3.0.7...