WordPress Pay for Payment for WooCommerce authorization issue vulnerability

WordPress Pay for Payment in WooCommerce 3.0.1 and earlier versions has an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks, which may allow attackers to exploit improperly configured access control levels...

WordPress Disable Users plugin <= 1.0.5 - Disabled Account Authentication Bypass vulnerability

Disabled Account Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Disable Users versions = 1.0.5...

WordPress SmugMug Embed plugin <= 3.13 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin SmugMug Embed versions = 3.13...

WordPress Adwised Web Push Notification plugin <= 2.5.7 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Adwised Web Push Notification versions = 2.5.7...

WordPress Web Vitals Tracking plugin <= 5.4.2 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Web Vitals Tracking versions = 5.4.2...

WordPress HootBoard plugin <= 3.1.4 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin HootBoard versions = 3.1.4...

WordPress Insurify plugin <= 1.0 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Insurify versions = 1.0...

WordPress Crowdfundly plugin <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation vulnerability

Crowdfundly Manager+ Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Crowdfundly versions = 2.2.2...

WordPress Insurify plugin <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite vulnerability

Unauthenticated Arbitrary Option Creation and Overwrite vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Insurify versions = 1.0...

WordPress AI Content Generator Marketing plugin <= 1.0.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin AI Content Generator Marketing versions = 1.0.0...

WordPress Freeton WP plugin <= 1.0.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Freeton WP versions = 1.0.0...

WordPress Mindstien Quick Login plugin <= 1.0 - Unauthenticated Administrator Account Takeover vulnerability

Unauthenticated Administrator Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Mindstien Quick Login versions = 1.0...

WordPress click5 CRM add-on to Ninja Forms plugin <= 1.0.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Ninja Forms versions = 1.0.1...

WordPress Envira Gallery plugin < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability

Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Envira Photo Gallery versions 1.16.2...

WordPress Mobile builder plugin <= 1.4.2 - Subscriber+ Privilege Escalation to Admin vulnerability

Subscriber+ Privilege Escalation to Admin vulnerability discovered by Raphael P. Cigana in WordPress Plugin Mobile builder versions = 1.4.2...

WordPress Mobile builder plugin <= 1.4.2 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Raphael P. Cigana in WordPress Plugin Mobile builder versions = 1.4.2...

WordPress Prenotazioni plugin <= 1.7.5 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Prenotazioni versions = 1.7.5...

WordPress LTL Freight Quotes plugin 4.2.11-4.2.18 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by achmad sonif in WordPress Plugin LTL Freight Quotes – Old Dominion Edition versions 4.2.11-4.2.18...

WordPress Contest Gallery plugin < 33.0.1 - Unauthenticated Email Verification Bypass vulnerability

Unauthenticated Email Verification Bypass vulnerability discovered by Akshat Parikh SN1PER in WordPress Plugin Contest Gallery versions 33.0.1...

CVE-2019-11223

CVE-2019-11223 Arbitrary File Upload in Wordpress Plugin SupportCandy Version 2.0 Below https://cert.kalasag.com.ph/news/research/vulnerable-wordpress-plugin-lets-you-take-over-websites/ https://wordpress.org/plugins/supportcandy/developers...