WordPress miniOrange Discord Integration plugin <= 2.1.5 - Authenticated App Disabling vulnerability

Authenticated App Disabling vulnerability discovered by Lana Codes in WordPress miniOrange Discord Integration plugin versions = 2.1.5. Solution Update the WordPress miniOrange Discord Integration plugin to the latest available version at least 2.1.6...

WordPress Export Post Info plugin <= 1.1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Export Post Info plugin versions = 1.1.0. Solution Update the WordPress Export Post Info plugin to the latest available version at least 1.2.0...

WordPress WP Popup Builder plugin <= 1.2.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WP Popup Builder plugin versions = 1.2.8. Solution Update the WordPress WP Popup Builder plugin to the latest available version at least 1.2.9...

WordPress <= 6.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by John Blackbourn in WordPress versions = 6.0.1 Solution Update the WordPress to the latest available version at least 6.0.2 or another patched version...

WordPress WPide plugin <= 2.6 - Authenticated Arbitrary File Edit/Upload vulnerability

Authenticated Arbitrary File Edit/Upload vulnerability discovered by Vlad Vector Patchstack in WordPress WPide plugin versions = 2.6. Solution Update the WordPress WPIDE – File Manager & Code Editor plugin to the latest available version at least 3.0...

WordPress WPIDE – File Manager & Code Editor plugin <= 2.6 - Authenticated Local File Inclusion (LFI) vulnerability

Authenticated Local File Inclusion LFI vulnerability discovered by Raad Haddad in WordPress WPIDE – File Manager & Code Editor plugin versions = 2.6. Solution Update the WordPress WPIDE – File Manager & Code Editor plugin to the latest available version at least 3.0...

WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Muhammad Daffa Patchstack Alliance in WordPress Button Plugin MaxButtons plugin versions = 9.2. Solution Update the WordPress MaxButtons plugin to the latest available version at least 9.3...

WordPress Social Share Buttons by Supsystic plugin <= 2.2.3 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability was discovered by Rasi Afeef Patchstack Alliance in the WordPress Social Share Buttons by Supsystic plugin versions = 2.2.3. Solution Update the WordPress Social Share Buttons by Supsystic plugin to the latest available version at least 2.2.4...

WordPress Metform Elementor Contact Form Builder plugin <= 2.1.3 - Unauthenticated API keys and Secrets Disclosure vulnerability

Unauthenticated API keys and Secrets Disclosure vulnerability discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress Metform Elementor Contact Form Builder plugin versions = 2.1.3. Solution Update the WordPress Metform Elementor Contact Form Builder plugin to the latest available version at least...

WordPress Simple Ajax Chat plugin <= 20220115 - Multiple Cross-Site Request Forgery (CSRF) vulnerability

Multiple Cross-Site Request Forgery CSRF vulnerability discovered by Ex.Mi Patchstack in WordPress Simple Ajax Chat plugin versions = 20220115. Solution Update the WordPress Simple Ajax Chat plugin to the latest available version at least 20220216...

WordPress Adrotate plugin <= 5.8.22 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered by Muhamad Hidayat in WordPress Adrotate plugin versions = 5.8.22. Solution Update the WordPress Adrotate plugin to the latest available version at least 5.8.23...

WordPress Mycred plugin <= 2.4.4 - User E-mail Addresses Disclosure vulnerability

User E-mail Addresses Disclosure vulnerability discovered by Krzysztof Zając in WordPress Mycred plugin versions = 2.4.4. Solution Update the WordPress Mycred plugin to the latest available version at least 2.4.4.1...

WordPress English WordPress Admin plugin <= 1.5.1 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by Krzysztof Zając in WordPress English WordPress Admin plugin versions = 1.5.1. Solution Update the WordPress English WordPress Admin plugin to the latest available version at least 1.5.2...

WordPress myCred plugin <= 2.4.3 - Import/Export to Email Address Disclosure vulnerability

Import/Export to Email Address Disclosure vulnerability discovered by David Hamann in WordPress myCred plugin versions = 2.4.3. Solution Update the WordPress myCred plugin to the latest available version at least 2.4.4...

WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability

Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability discovered by Dave Jong Patchstack in WordPress Responsive Menu plugin versions = 4.1.7. Solution Update the WordPress Responsive Menu plugin to the latest available version at least 4.1.8...

WordPress Super Socializer plugin <= 7.13.29 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Super Socializer plugin versions = 7.13.29. Solution Update the WordPress Super Socializer plugin to the latest available version at least 7.13.30...

WordPress Ninja Forms File Uploads Extension premium plugin <= 3.3.12 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Nuno Correia Blaze Security in WordPress Ninja Forms File Uploads Extension premium plugin versions = 3.3.12. Solution Update the WordPress Ninja Forms File Uploads Extension premium plugin to the latest available version at least...

WordPress Widget Detector for Elementor plugin < 1.2.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Widget Detector for Elementor plugin versions 1.2.0. Solution Update the WordPress Widget Detector for Elementor plugin to the latest available version at least 1.2.0...

WordPress WP Statistics plugin <= 13.1.5 - Unauthenticated Blind SQL Injection (SQLi) vulnerability

Unauthenticated Blind SQL Injection SQLi vulnerability via currentpageid discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress WP Statistics plugin versions = 13.1.5. Solution Update the WordPress WP Statistics plugin to the latest available version at least 13.1.6...

WordPress File Upload Pro premium plugin <= 4.16.2 - Stored Cross-Site Scripting (XSS) via Malicious SVG vulnerability

Stored Cross-Site Scripting XSS via Malicious SVG vulnerability discovered by apple502j in WordPress File Upload Pro premium plugin versions = 4.16.2. Solution Update the WordPress File Upload Pro premium plugin to the latest available version at least 4.16.3...

WordPress MOLIE plugin <= 0.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Jeremie Amsellem in WordPress MOLIE plugin versions = 0.5. Solution Deactivate and delete. This plugin has been closed as of November 29, 2021 and is not available for download. Reason: Security Issue...

WordPress Accesspress Mag theme <= 2.6.5 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Lenon Leite Patchstack Red Team project WordPress Accesspress Mag theme versions = 2.6.5. This theme uses a vulnerable piece of code related to previously identified vulnerability - CVE-2021-39317. Solution Deactivate and delete. The vendor ignore...

WordPress Meta Data and Taxonomies Filter (MDTF) plugin <= 1.2.7.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Ryoma Nishioka in WordPress Meta Data and Taxonomies Filter MDTF plugin versions = 1.2.7.2. Solution Update the WordPress Meta Data and Taxonomies Filter MDTF plugin to the latest available version at least 1.2.8...

WordPress W3 Total Cache plugin <= 2.1.3 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by renniepak in WordPress W3 Total Cache plugin versions = 2.1.3. Solution Update the WordPress W3 Total Cache plugin to the latest available version at least 2.1.4...

WordPress Jannah premium theme <= 5.4.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Truoc Phan in WordPress Jannah premium theme versions = 5.4.4. Solution Update the WordPress Jannah premium theme to the latest available version at least 5.4.5...

WordPress WP Super Cache plugin <= 1.7.2 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress WP Super Cache plugin versions = 1.7.2. Solution Update the WordPress WP Super Cache plugin to the latest available version at least 1.7.3...

WordPress Advanced Custom Fields PRO plugin <= 5.9.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Juan David Ordoñez Noriega in WordPress Advanced Custom Fields PRO plugin versions = 5.9.0. Solution Update the WordPress Advanced Custom Fields PRO plugin to the latest available version at least 5.9.1...

WordPress Content Timeline plugin <=4.4.2 - Multiple Blind SQL Injection vulnerabilities

Multiple Blind SQL Injection vulnerabilities found by Jeroen ITNerdbox in premium WordPress plugin - Content Timeline =4.4.2 . It is possible to execute arbitrary SQL commands via the id parameter contenttimelineclass.php, contenttimelineedit.php, contenttimelineindex.php. Solution We were unable...

WordPress Mail Masta plugin <= 1.0 - Local File Inclusion (LFI) vulnerability

A Local File Inclusion vulnerability exists in WordPress Mail Masta Plugin 1.0 plugin. This vulnerability allows remote attackers to include arbitrary files on the server by "dynamic file inclusion" mechanism in Mail Masta Plugin. Solution This plugin has been closed and is no longer available fo...

WordPress W3 Total Cache Plugin <= 0.9.4 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments. Solution Update the plugin...

WordPress MaxButtons Plugin <= 1.26.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "id" parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation page. Solution Update the plugin...

WordPress Polylang Plugin <= 1.5.1 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via vectors related to a user description. Solution Update the plugin...

WordPress VideoWhisper Live Streaming Integration Plugin <= 4.29.4 - Multiple Directory Traversal

Because of these vulnerabilities, the attackers can delete arbitrary files in the "s" parameter to ls/rtmplogout.php or read arbitrary files in the "s" parameter to ls/rtmplogin.php. Solution Update the plugin...

WordPress <= 3.5.0 - SSRF

Because of The XMLRPC API, the attackers can send HTTP requests to intranet servers. Also, they can conduct port-scanning attacks by specifying a crafted source URL for a pingback. Solution Update WordPress...

WordPress REST API | Custom API Generator For Cross Platform And Import Export In WP plugin <= 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function vulnerability

Missing Authorization to Unauthenticated Privilege Escalation via processhandler Function vulnerability discovered by kr0d in WordPress Plugin REST API | Custom API Generator For Cross Platform And Import Export In WP versions = 2.0.3...

WordPress LiteSpeed Cache Plugin <= 6.5.1 is vulnerable to Privilege Escalation

Software LiteSpeed Cache Type Plugin Vulnerable versions = 6.5.1 Fixed in 6.5.2 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-50550 Patch priority High CVSS severity High 8.1 Developer Hai Zheng / Lite Speed Cache PSID a12edc6aefb8...

WordPress Jetpack Plugin < 13.9.1 is vulnerable to Broken Access Control

Software Jetpack Type Plugin Vulnerable versions 13.9.1 Fixed in 13.9.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9926 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 675e1d99d774 Credits Marc Montpas Required privilege...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.121 is vulnerable to Remote Code Execution (RCE)

Software Unlimited Elements For Elementor Free Widgets, Addons, Templates Type Plugin Vulnerable versions = 1.5.121 Fixed in 1.5.122 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-49271 Patch priority High CVSS severity High 9.1 Developer Unlimited Elements PSID...

WordPress The Events Calendar Plugin <= 6.6.4 is vulnerable to SQL Injection

Software The Events Calendar Type Plugin Vulnerable versions = 6.6.4 Fixed in 6.6.4.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-8275 Patch priority High CVSS severity High 9.3 Developer Liquid Web / StellarWP PSID fcc27b88891b Credits Foxyyy Required privilege...

WordPress Phlox PRO Theme <= 5.16.4 is vulnerable to Cross Site Scripting (XSS)

Software Phlox PRO Type Theme Vulnerable versions = 5.16.4 Fixed in 5.16.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6339 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 1d783a1b1dee Credits kauenavarro Required...

WordPress Contact Form 7 Plugin < 5.9.5 is vulnerable to Open Redirection

Software Contact Form 7 Type Plugin Vulnerable versions 5.9.5 Fixed in 5.9.5 OWASP Top 10 A1: Injection Classification Open Redirection CVE CVE-2024-4704 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 0480ce1a1ef4 Credits William Bastos - cHoR4o Required privilege...

WordPress WPS Hide Login Plugin <= 1.9.15.2 is vulnerable to Bypass Vulnerability

Software WPS Hide Login Type Plugin Vulnerable versions = 1.9.15.2 Fixed in 1.9.16 OWASP Top 10 A1: Broken Access Control Classification Bypass Vulnerability CVE CVE-2024-2473 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 6dff27358fc5 Credits Nicholas Mun Required...

WordPress WPBakery Page Builder Plugin <= 7.5 is vulnerable to Cross Site Scripting (XSS)

Software WPBakery Page Builder Type Plugin Vulnerable versions = 7.5 Fixed in 7.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1840 Patch priority Low CVSS severity Low 6.5 Developer WPBakery PSID 519a2ab9e5cd Credits Nikolas Required privilege...

WordPress Networker Theme <= 1.1.9 is vulnerable to Broken Access Control

Software Networker Type Theme Vulnerable versions = 1.1.9 Fixed in 1.1.10 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-2962 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c70a9d136cac Credits Muhammad Zeeshan Xib3rR4dAr Required...

WordPress Export any WordPress data to XML/CSV Plugin < 1.4.0 is vulnerable to Remote Code Execution (RCE)

Software Export any WordPress data to XML/CSV Type Plugin Vulnerable versions 1.4.0 Fixed in 1.4.0 OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2023-4724 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 6a309d1d1825 Credits Francesco Marano...

WordPress Activello theme <= 1.4.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability

Auth. Reflected Cross-Site Scripting XSS vulnerability in the ajax action 'activellodismissrequiredaction' discovered by Brandon Roldan Patchstack Alliance in WordPress Activello theme versions = 1.4.4. Solution No patched version available...

WordPress Smart Slider 3 plugin <= 3.5.1.9 - Auth. PHP Object Injection vulnerability

Auth. PHP Object Injection vulnerability discovered by Dave Jong Patchstack in WordPress Smart Slider 3 plugin versions = 3.5.1.9. Solution Update the WordPress Smart Slider 3 plugin to the latest available version at least 3.5.1.11...

WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to plugin settings reset discovered by Muhammad Daffa Patchstack Alliance in the WordPress Creative Mail plugin versions = 1.5.4. Solution Update the WordPress Creative Mail plugin to the latest available version at least 1.6.0...

WordPress 3com – Asesor de Cookies plugin <= 3.4.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by ptsfence Patchstack Alliance in WordPress 3com – Asesor de Cookies plugin versions = 3.4.3. Solution No patched version is available. No reply from the vendor...

WordPress WP Word Count plugin <= 3.2.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by lucy in the WordPress WP Word Count plugin versions = 3.2.3. Solution Deactivate and delete. This plugin has been closed as of October 6, 2022 and is not available for download. This closure is temporary, pending a full...