WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...

600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin

On July 14th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Forminator Forms, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...

WordPress TrueBooker plugin <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter vulnerability

Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebookerwpuserid' Parameter vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin TrueBooker versions = 1.2.6...

WordPress Wholesale Market plugin <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via 'rolerequired' Parameter vulnerability discovered by SEONGWON CHO - Chung-ang University in WordPress Plugin Wholesale Market versions = 2.2.2...

WordPress Groundhogg plugin <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter vulnerability

Authenticated Vendor+ SQL Injection via 'tagquery' Parameter vulnerability discovered by Jonathan Dersch - Jonathan Dersch - Bug Bounty in WordPress Plugin Groundhogg versions = 4.5.14...

WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability discovered by Ivaylo in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...

WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter vulnerability

Authenticated Editor+ SQL Injection via 'key' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...

WordPress Hydra Booking plugin <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter vulnerability

Authenticated Host+ Stored Cross-Site Scripting via 'firstname' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Hydra Booking versions = 1.2.2...

WordPress Contest Gallery plugin <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' vulnerability

Authenticated Author+ Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Contest Gallery versions = 30.0.7...

WordPress Beaver Builder Page Builder plugin <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Button Module 'button' Parameter vulnerability discovered by a1batr0ss in WordPress Plugin Beaver Builder versions = 2.10.2.2...

WordPress Image Uploader for Welcart plugin <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter vulnerability

Authenticated Author+ SQL Injection via Attachment 'posttitle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Image Uploader for Welcart versions = 1.4.6...

WordPress Pinpoint Booking System plugin <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter vulnerability

Unauthenticated Improper Input Validation to Price Manipulation via 'cartdata' Parameter vulnerability discovered by WordFence in WordPress Plugin Pinpoint Booking System versions = 2.9.9.6.8...

WordPress Propovoice: All-in-One Client Management System plugin <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter vulnerability

Authenticated ndpvmanager+ Privilege Escalation via 'role' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Propovoice CRM versions = 1.7.8...

WordPress MaxUpload plugin <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability discovered by JIWOONG LEE kimchunbok - Hyundai Red Team in WordPress Plugin MaxUpload versions = 1.4.0...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via REST API 'businessid' Parameter vulnerability discovered by MatilJ in WordPress Plugin Online Booking & Scheduling Calendar for WordPress by vcita versions = 4.6.0...

WordPress User Profile Builder plugin <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability

Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Profile Builder versions = 3.16.4...

WordPress Object Sync for Salesforce plugin <= 2.2.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Object Sync for Salesforce versions = 2.2.13...

WordPress 6Storage Rentals plugin <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter vulnerability

Unauthenticated Account Takeover via 'email' Parameter vulnerability discovered by WordFence in WordPress Plugin 6Storage Rentals versions = 2.27.0...

WordPress bLoyal: Loyalty & Promotions by bLoyal plugin <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings vulnerability

Authenticated Subscriber+ Privilege Escalation via Unprotected AJAX API URL Settings vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin bLoyal versions = 3.1.611.78...

WordPress RapiSafe plugin <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters vulnerability

Unauthenticated Arbitrary File Deletion via 'rsmfcf7session' and 'filename' Parameters vulnerability discovered by Spy0x7 in WordPress Plugin RapiSafe – Secure Multi File Upload for Contact Form 7 versions = 1.0.4...