WordPress WP Word Count plugin <= 3.2.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by lucy in the WordPress WP Word Count plugin versions = 3.2.3. Solution Deactivate and delete. This plugin has been closed as of October 6, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress WP ALL Export Pro premium plugin <= 1.7.8 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Sanjay Das in WordPress WP ALL Export Pro premium plugin versions = 1.7.8. Solution Update the WordPress WP ALL Export Pro plugin to the latest available version at least 1.7.9...

WordPress <= 6.0.1 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability discovered by Khalilov Moe in WordPress = 6.0.1 Solution Update the WordPress to the latest available version at least 6.0.2 or another patched version...

WordPress Restricted Site Access plugin <= 7.3.1 - Access Bypass via IP Spoofing vulnerability

Access Bypass via IP Spoofing vulnerability discovered by Daniel Ruf in WordPress Restricted Site Access plugin versions = 7.3.1. Solution Update the WordPress Restricted Site Access plugin to the latest available version at least 7.3.2...

WordPress Advanced Custom Fields PRO premium plugin <= 5.12.2 - Unauthenticated File Upload vulnerability

Unauthenticated File Upload vulnerability discovered by James Golovich in WordPress Advanced Custom Fields PRO premium plugin versions = 5.12.2. Solution Update the WordPress Advanced Custom Fields PRO plugin to the latest available version at least 5.12.3...

WordPress Flipbox plugin <= 2.6.0 - Authenticated WordPress Options Change vulnerability

Authenticated WordPress Options Change vulnerability discovered by m0ze Patchstack in WordPress Flipbox plugin versions = 2.6.0. Solution Update the WordPress Flipbox plugin to the latest available version at least 2.6.1...

WordPress Advanced WordPress Reset plugin <= 1.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by ZhongFu Su aka JrXnm WuHan University in WordPress Advanced WordPress Reset plugin versions = 1.5. Solution Update the WordPress Advanced WordPress Reset plugin to the latest available version at least 1.6...

WordPress eaSYNC plugin <= 1.1.15 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by cydave in WordPress eaSYNC plugin versions = 1.1.15. Solution Update the WordPress eaSYNC plugin to the latest available version at least 1.1.16...

WordPress Easy SVG Support plugin <= 3.2.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via SVG

Authenticated Stored Cross-Site Scripting XSS vulnerability via SVG discovered by Luan Pedersini in WordPress Easy SVG Support plugin versions = 3.2.0. Solution Update the WordPress Easy SVG Support plugin to the latest available version at least 3.3.0...

WordPress Andrea Pernici News Sitemap for Google plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by John Castro aka mirphak Pagely in WordPress Andrea Pernici News Sitemap for Google plugin versions = 1.0.16. Solution No patched version is available...

WordPress XML Sitemap Generator for Google plugin <= 2.0.3 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress XML Sitemap Generator for Google plugin versions = 2.0.3. Solution Update the WordPress XML Sitemap Generator for Google plugin to the latest available version at least 2.0.4...

WordPress External Media without Import plugin <= 1.1.2 - Server-Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability discovered by Luan Pedersini in WordPress External Media without Import plugin versions = 1.1.2. Solution Deactivate and delete. This plugin has been closed as of March 28, 2022 and is not available for download. This closure is temporary, pending a...

WordPress Sitemap by click5 plugin <= 1.0.35 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by cydave in WordPress Sitemap by click5 plugin versions = 1.0.35. Solution Update the WordPress Sitemap by click5 plugin to the latest available version at least 1.0.36...

WordPress Visual Form Builder plugin <= 3.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Entries Deletion/Restoration

Cross-Site Request Forgery CSRF vulnerability leading to Entries Deletion/Restoration discovered by Vishnupriya Ilango in WordPress Visual Form Builder plugin versions = 3.0.7. Solution Update the WordPress Visual Form Builder plugin to the latest available version at least 3.0.8...

WordPress Library File Manager plugin <= 5.2.2 - Arbitrary File Creation/Upload/Deletion vulnerability

Arbitrary File Creation/Upload/Deletion vulnerability discovered by Luan Pedersni in WordPress Library File Manager plugin versions = 5.2.2. Solution Update the WordPress Library File Manager plugin to the latest available version at least 5.2.3...

WordPress Bank Mellat plugin <= 1.3.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Bank Mellat plugin versions = 1.3.7. Solution Deactivate and delete. This plugin has been closed as of February 16, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress AP Pricing Tables Lite plugin <= 1.1.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress AP Pricing Tables Lite plugin versions = 1.1.4. Solution Update the WordPress AP Pricing Tables Lite plugin to the latest available version at least 1.1.5...

WordPress UpdraftPlus plugin <= 1.22.1 - Arbitrary Backup Downloads vulnerability

Arbitrary Backup Downloads vulnerability discovered by Marc-Alexandre Montpas Automattic in WordPress UpdraftPlus plugin versions = 1.22.1. Solution Update the WordPress UpdraftPlus plugin to the latest available version at least 1.22.3...

WordPress [GWA] AutoResponder plugin <= 2.3 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by Lenon Leite Patchstack Red Team project in WordPress GWA AutoResponder plugin versions = 2.3. Solution Deactivate and delete. This plugin has been closed as of August 30, 2019 and is not available for download. Reason: Guideline...

WordPress Ibtana plugin <= 1.1.4.8 - Plugin Settings Update vulnerability leading to Stored Cross-Site Scripting (XSS)

Plugin Settings Update vulnerability leading to Stored Cross-Site Scripting XSS discovered by Krzysztof Zając in WordPress Ibtana plugin versions = 1.1.4.8. Solution Update the WordPress Ibtana plugin to the latest available version at least 1.1.4.9...

WordPress SupportCandy plugin <= 2.2.6 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Cross-Site Scripting XSS discovered by apple502j in WordPress SupportCandy plugin versions = 2.2.6. Solution Update the WordPress SupportCandy plugin to the latest available version at least 2.2.7...

WordPress Custom Dashboard & Login Page – AGCA plugin <= 6.9.5 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by 0ppr2s in WordPress Custom Dashboard & Login Page – AGCA plugin versions = 6.9.5. Solution Update the WordPress Custom Dashboard & Login Page – AGCA plugin to the latest available version at least 7.0...

WordPress JobBoardWP – Job Board Listings and Submissions plugin <= 1.0.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Thinkland Security Team in WordPress JobBoardWP – Job Board Listings and Submissions plugin versions = 1.0.7. Solution Update the WordPress JobBoardWP – Job Board Listings and Submissions plugin to the latest available...

WordPress SP Project & Document Manager plugin <= 4.21 - Authenticated Shell Upload vulnerability

Authenticated Shell Upload discovered by Viktor Markopoulos vict0ni in WordPress SP Project & Document Manager plugin versions = 4.21. Solution Update the WordPress SP Project & Document Manager plugin to the latest available version at least 4.22...

WordPress LearnDash LMS premium plugin <= 3.1.5 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered in WordPress LearnDash LMS premium plugin versions = 3.1.5. Solution Update the WordPress LearnDash LMS premium plugin to the latest available version at least 3.1.6...

WordPress LearnPress plugin <= 3.2.6.7 - Authenticated Time Based Blind SQL Injection (SQLi) vulnerability

Authenticated Time Based Blind SQL Injection SQLi vulnerability discovered in WordPress LearnPress plugin versions = 3.2.6.7. Solution Update the WordPress LearnPress plugin to the latest available version at least 3.2.6.8...

WordPress Font Awesome plugin 4.0.0-RC15 - 4.0.0-RC16 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Font Awesome plugin versions 4.0.0-RC15 - 4.0.0-RC16. Solution Update the WordPress Font Awesome plugin to the latest available version at least 4.0.0-RC17...

WordPress <=4.0.1 - Denial of Service Attacks

WordPress 4.0.1 is prone to a denial of service vulnerability that allows an attacker to send specially crafted requests. These requests resulting in CPU and memory exhaustion and in that way the site becomes unavailable. Solution Update WordPress...

WordPress VideoWhisper Live Streaming Integration Plugin <= 4.29.4 - Multiple Vulnerabilities

The error-handling feature in ls/rtmp.inc.php, videowhisperstreaming.php or bp.php allows the attackers to obtain sensitive information via a direct request, which reveals the full path in an error message. Solution Update the plugin...

WordPress SWFUpload Plugin <= 2.2.0.1 - XSS #1

Because of this vulnerability in swfupload.swf, the attackers can inject arbitrary web script or HTML via the "movieName" parameter. Solution Update the plugin...

WordPress WP Forum Server Plugin <= 2.3 - Multiple SQL Injection

Because of these vulnerabilities, the attackers can execute arbitrary SQL commands. Solution Update the plugin...

NPM: websocket-driver: Resource limit bypass via message compression

NPM: websocket-driver: Resource limit bypass via message compression vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...

NPM: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

NPM: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message vulnerability discovered by ? in WordPress Npm nodemailer versions = 9.0.0...

WordPress SePay Gateway plugin <= 1.1.20 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by ParkHyunWoo in WordPress Plugin SePay Gateway versions = 1.1.20...

WordPress EMI Calculator plugin <= 1.1 - Settings Change vulnerability

Settings Change vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin EMI Calculator versions = 1.1...

WordPress Elementor Website Builder Plugin <= 3.25.7 is vulnerable to Cross Site Scripting (XSS)

Software Elementor Website Builder Type Plugin Vulnerable versions = 3.25.7 Fixed in 3.25.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8236 Patch priority Low CVSS severity Low 6.5 Developer Elementor PSID 7daadbd579b8 Credits wesley wcraft...

WordPress Extensions for Elementor Plugin <= 2.0.40 is vulnerable to Cross Site Scripting (XSS)

Software Extensions for Elementor Type Plugin Vulnerable versions = 2.0.40 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-52471 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 37895dfd43f1 Credits Le Ngoc Anh Required...

WordPress Bit File Manager Plugin <= 6.5.7 is vulnerable to Arbitrary File Upload

Software Bit File Manager Type Plugin Vulnerable versions = 6.5.7 Fixed in 6.5.8 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-8743 Patch priority High CVSS severity High 6.8 Developer Claim ownership PSID c3b2ce42763f Credits TANG Cheuk Hei siunam Required privileg...

WordPress Web and WooCommerce Addons for WPBakery Builder Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)

Software Web and WooCommerce Addons for WPBakery Builder Type Plugin Vulnerable versions = 1.4.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43960 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c3f6a64bbac8 Credits 4rCanJ0x...

WordPress Essential Addons for Elementor Plugin <= 5.9.20 is vulnerable to Cross Site Scripting (XSS)

Software Essential Addons for Elementor Type Plugin Vulnerable versions = 5.9.20 Fixed in 5.9.21 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4624 Patch priority Low CVSS severity Low 6.5 Developer WPDeveloper PSID 3528751a7ce0 Credits wesley wcra...

WordPress JetSmartFilters Plugin <= 3.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software JetSmartFilters Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.2.2.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48762 Patch priority Low CVSS severity Low 6.3 Developer Crocoblock PSID cc4e59f9bb8e Credits Rafie Muhammad...

WordPress OPcache Dashboard Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS)

Software OPcache Dashboard Type Plugin Vulnerable versions = 0.3.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-45064 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 88a7f0a12d7e Credits LEE SE HYOUNG...

WordPress Contact Form Email Plugin <= 1.3.31 is vulnerable to Other Vulnerability Type

Software Contact Form Email Type Plugin Vulnerable versions = 1.3.31 Fixed in 1.3.32 OWASP Top 10 A5: Broken Access Control Classification Other Vulnerability Type CVE CVE-2023-28494 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1b66482cfee4 Credits István Márton Require...

WordPress Pagination Styler for WooCommerce Plugin <= 3.5.7.6 is vulnerable to Broken Access Control

Software Pagination Styler for WooCommerce Type Plugin Vulnerable versions = 3.5.7.6 Fixed in 3.5.7.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-45813 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9700cfe7197b Credits István...

WordPress Videojs HTML5 Player plugin <= 1.1.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Lana Codes in WordPress Videojs HTML5 Player plugin versions = 1.1.8. Solution Update the WordPress Videojs HTML5 Player plugin to the latest available version at least 1.1.9...

WordPress Simple SEO plugin <= 1.8.12 - Broken Access Control vulnerability

Broken Access Control vulnerability leading to Sitemap Deletion/Creation discovered by Mika Patchstack Alliance in WordPress Simple SEO plugin versions = 1.8.12. Solution Update the WordPress Simple SEO plugin to the latest available version at least 1.8.13...

WordPress core <= 6.0.2 - Open redirect vulnerability

Open redirect vulnerability in wpnonceays discovered by devrayn in WordPress core versions = 6.0.2 Solution Update the WordPress to the latest available version at least 6.0.3...

WordPress Analytify plugin <= 4.2.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to Cache Deletion discovered by Muhammad Daffa Patchstack Alliance in WordPress Analytify plugin versions = 4.2.2 Solution Update the WordPress Analytify plugin to the latest available version at least 4.2.3...

WordPress SEO Redirection plugin <= 8.9 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to deletion of 404 errors and redirection history was discovered by Muhammad Daffa Patchstack Alliance in the WordPress SEO Redirection plugin versions = 8.9. Solution Update the WordPress SEO Redirection plugin to the latest available version...

WordPress YDS Support Ticket System plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by ptsfence Patchstack Alliance in WordPress YDS Support Ticket System plugin versions = 1.0. Solution No patched version is available. No reply from the vendor...