WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability

Direct static code injection vulnerability discovered by changsheng in WordPress Plugin Classified Listing versions = 6.1.5...

WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mor Golan in WordPress Plugin Surfer versions = 1.8.0.744...

WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by V1T in WordPress Plugin WP Mailster versions = 1.9.1.0...

WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ratchanon Chamnankit in WordPress Plugin YITH WooCommerce Product Bundles versions = 2.29.0...

WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by dzaku in WordPress Plugin Event Tickets versions = 5.30.1...

WordPress Salon Booking System plugin < 10.31.11 - Salon Staff+ Administrator Role Demotion vulnerability

Salon Staff+ Administrator Role Demotion vulnerability discovered by Utkarsh Choudhary in WordPress Plugin Salon booking system versions 10.31.11...

WordPress Salon Booking System plugin 10.17-10.31.10 - Salon Staff+ Privilege Escalation to Administrator vulnerability

Salon Staff+ Privilege Escalation to Administrator vulnerability discovered by RIA Labs in WordPress Plugin Salon booking system versions 10.17-10.31.10...

WordPress ThirstyAffiliates plugin < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection vulnerability

Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection vulnerability discovered by Usama Arshad in WordPress Plugin ThirstyAffiliates versions 3.12.1...

WordPress Modern Event Calendar Pro plugin < 7.37.0 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Modern Events Calendar versions 7.37.0...

WordPress Modern Events Calendar Lite plugin < 7.37.0 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Modern Events Calendar Lite versions 7.37.0...

WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by fcc in WordPress Plugin FluentForm versions = 6.2.15...

WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Hamza Tlili in WordPress Plugin FluentCommunity versions = 2.11.0...

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by MD Mahmidul Hasan in WordPress Plugin LearnPress versions = 4.4.10...

WordPress Contact Form 7 Signature Addon plugin <= 4.2.2 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Kiran Krishnakumar in WordPress Plugin Contact Form 7 Signature Addon versions = 4.2.2...

WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.4...

WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin e2pdf versions = 1.32.57...

WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Broadcast Live Video versions = 7.3.7...

WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin YITH WooCommerce Wishlist versions = 4.18.1...

WordPress Choose User Role at Registration plugin < 1.3.3 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Choose User Role at Registration versions 1.3.3...

WordPress App Builder plugin 3.8.4-5.7.0 - Unauthenticated Option Write and Redirect vulnerability

Unauthenticated Option Write and Redirect vulnerability discovered by RIA Labs in WordPress Plugin App Builder versions 3.8.4-5.7.0...

WordPress Snap Finance plugin 1.0.8-3.11.0 - Unauthenticated Arbitrary Order Status Change vulnerability

Unauthenticated Arbitrary Order Status Change vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Snap Finance versions 1.0.8-3.11.0...

WordPress TrueBooker plugin 1.1.9-1.2.9 - Unauthenticated Service and Category Creation and Modification vulnerability

Unauthenticated Service and Category Creation and Modification vulnerability discovered by Ashok Chapagai in WordPress Plugin TrueBooker versions 1.1.9-1.2.9...

WordPress TrueBooker plugin 1.1.9-1.2.9 - Unauthenticated Booking Creation with Arbitrary Price vulnerability

Unauthenticated Booking Creation with Arbitrary Price vulnerability discovered by Amity Gilmour in WordPress Plugin TrueBooker versions 1.1.9-1.2.9...

WordPress TrueBooker plugin 1.1.9-1.2.9 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin TrueBooker versions 1.1.9-1.2.9...

WordPress Subscribe to Comments plugin < 2.3.3 - Author+ Email Header Injection vulnerability

Author+ Email Header Injection vulnerability discovered by Het Kalariya in WordPress Plugin Subscribe to Comments versions 2.3.3...

WordPress TrueBooker plugin 1.1.9-1.2.9 - Unauthenticated Plugin Settings Overwrite vulnerability

Unauthenticated Plugin Settings Overwrite vulnerability discovered by Mikica Ivosevic in WordPress Plugin TrueBooker versions 1.1.9-1.2.9...

WordPress iPOSpays Payment Gateway for WooCommerce plugin < 1.4.7 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin iPOSpays Gateways WC versions 1.4.7...

WordPress Document Gallery plugin 4.0-5.1.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Document Gallery versions 4.0-5.1.1...

WordPress Salon Booking System plugin < 10.31.11 - Unauthenticated Negative Booking Total vulnerability

Unauthenticated Negative Booking Total vulnerability discovered by vuxvinh in WordPress Plugin Salon booking system versions 10.31.11...

WordPress Snap Finance plugin <= 3.11.0 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Ryan Fabella in WordPress Plugin Snap Finance versions = 3.12.0...

WordPress ElementsReady Addons for Elementor plugin <= 6.7.2 - Unauthenticated Paid Download Access Bypass vulnerability

Unauthenticated Paid Download Access Bypass vulnerability discovered by ryan fabella in WordPress Plugin ElementsReady Addons for Elementor versions = 6.7.2...

WordPress ElementsReady Addons for Elementor plugin <= 6.7.2 - Subscriber+ Plugin Settings Overwrite vulnerability

Subscriber+ Plugin Settings Overwrite vulnerability discovered by Stefan Spasic in WordPress Plugin ElementsReady Addons for Elementor versions = 6.7.2...

WordPress Blaze Demo Importer plugin < 1.0.17 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Luis Schlegel in WordPress Plugin Blaze Demo Importer versions 1.0.17...

WordPress FormFlow for GoHighLevel (GHL) plugin <= 1.0.0 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Ehab M.Kandah in WordPress Plugin FormFlow for GoHighLevel GHL versions = 1.0.0...

WordPress Gateway for Vantiv on WC plugin <= 1.0.1 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Gateway for Vantiv on WC versions = 1.0.1...

WordPress ActiveTrail for WooCommerce plugin <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation vulnerability

Unauthenticated Arbitrary Coupon Creation vulnerability discovered by Ryan Fabella in WordPress Plugin ActiveTrail for WooCommerce versions = 1.2.6...

WordPress Modern Events Calendar Lite plugin < 7.37.0 - Subscriber+ Sensitive Data Disclosure vulnerability

Subscriber+ Sensitive Data Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Modern Events Calendar Lite versions 7.37.0...

WordPress AI Engine plugin < 3.7.9 - Editor+ Arbitrary Post Deletion vulnerability

Editor+ Arbitrary Post Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin AI Engine versions 3.7.9...

WordPress AI Engine plugin < 3.7.9 - Editor+ Arbitrary Post Modification vulnerability

Editor+ Arbitrary Post Modification vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin AI Engine versions 3.7.9...

WordPress Salon Booking System plugin < 10.31.11 - Subscriber+ Coupon Code Disclosure vulnerability

Subscriber+ Coupon Code Disclosure vulnerability discovered by Andy Urlep in WordPress Plugin Salon booking system versions 10.31.11...

WordPress Salon Booking System plugin < 10.31.11 - Salon Staff+ Stored XSS and SSRF vulnerability

Salon Staff+ Stored XSS and SSRF vulnerability discovered by vuxvinh in WordPress Plugin Salon booking system versions 10.31.11...

WordPress Tasty Recipes Lite plugin 1.2-1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion vulnerability

Contributor+ Taxonomy Term Creation, Renaming and Deletion vulnerability discovered by Usama Arshad in WordPress Plugin Tasty Recipes Lite versions 1.2-1.2.10...

WordPress PickPlugins Product Designer for WooCommerce plugin <= 1.0.40 - Unauthenticated Design Template Data Injection vulnerability

Unauthenticated Design Template Data Injection vulnerability discovered by Valida Abdullayeva in WordPress Plugin Product Designer versions = 1.0.40...

WordPress Otter Blocks plugin < 3.2.3 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by John Ryan Albon in WordPress Plugin Otter - Gutenberg Block versions 3.2.3...

WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by AndrewN in WordPress Plugin HivePress versions = 1.7.32...

WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by hhhai in WordPress Plugin MapSVG versions = 8.16.1...

WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin Essential Addons for Elementor versions = 6.8.5...

WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by jydae in WordPress Plugin Tutor LMS versions = 4.1.2...

WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ihsan Saddan in WordPress Plugin Quiz And Survey Master versions = 11.2.7...

WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Taegyeong Yun in WordPress Plugin Quiz Maker versions = 6.7.1.91...