WordPress Grid Kit Portfolio plugin <= 2.0.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Grid Kit Portfolio plugin versions = 2.0.0. Solution Update the WordPress Grid Kit Portfolio plugin to the latest available version at least 2.1.0...

WordPress Profile Builder plugin <= 3.6.7 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Abhinav Porwal in WordPress Profile Builder plugin versions = 3.6.7. Solution Update the WordPress Profile Builder plugin to the latest available version at least 3.6.8...

WordPress Ninja Forms File Uploads Extension premium plugin <= 3.3.12 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Nuno Correia Blaze Security in WordPress Ninja Forms File Uploads Extension premium plugin versions = 3.3.12. Solution Update the WordPress Ninja Forms File Uploads Extension premium plugin to the latest available version at least...

WordPress Pz-LinkCard plugin <= 2.4.5.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Pz-LinkCard plugin versions = 2.4.5.2. Solution Update the WordPress Pz-LinkCard plugin to the latest available version at least 2.4.5.3...

WordPress Header Footer Code Manager plugin <= 1.1.16 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ramuel Gall in WordPress Header Footer Code Manager plugin versions = 1.1.16. Solution Update the WordPress Header Footer Code Manager plugin to the latest available version at least 1.1.17...

WordPress TI WooCommerce Wishlist premium plugin <= 1.40.0 - Unauthenticated Blind SQL Injection (SQLi) vulnerability

Unauthenticated Blind SQL Injection SQLi vulnerability discovered by Krzysztof Zając in WordPress TI WooCommerce Wishlist premium plugin versions = 1.40.0. Solution Update the WordPress TI WooCommerce Wishlist premium plugin to the latest available version at least 1.40.1...

WordPress Logo Showcase with Slick Slider plugin <= 2.0 - Arbitrary Media Title/Description/Alt Text/URL Update via CSRF vulnerability

Arbitrary Media Title/Description/Alt Text/URL Update via CSRF vulnerability discovered by apple502j in WordPress Logo Showcase with Slick Slider plugin versions = 2.0. Solution Update the WordPress Logo Showcase with Slick Slider plugin to the latest available version at least 2.0.1...

WordPress Grand FlaGallery plugin <= 6.1.2 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Tyler Miller in WordPress Grand FlaGallery plugin versions = 6.1.2. Solution Deactivate and delete. This plugin has been closed as of November 12, 2021 and is not available for download. Reason: Security Issue...

WordPress Ibtana plugin <= 1.1.4.8 - Plugin Settings Update vulnerability leading to Stored Cross-Site Scripting (XSS)

Plugin Settings Update vulnerability leading to Stored Cross-Site Scripting XSS discovered by Krzysztof Zając in WordPress Ibtana plugin versions = 1.1.4.8. Solution Update the WordPress Ibtana plugin to the latest available version at least 1.1.4.9...

WordPress WordPress Download Manager plugin <= 3.1.24 - Authenticated Directory Traversal vulnerability

Authenticated Directory Traversal vulnerability discovered by Ramuel Gall WordFence in WordPress WordPress Download Manager plugin versions = 3.1.24. Solution Update the WordPress WordPress Download Manager plugin to the latest available version at least 3.1.25...

WordPress Newspaper premium theme <= 10.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Truoc Phan in WordPress Newspaper premium theme versions = 10.4. Solution Update the WordPress Newspaper premium theme to the latest available version at least 11,...

WordPress Contact Form 7 plugin <= 5.3.1 - Unrestricted File Upload vulnerability

Unrestricted File Upload vulnerability found by Jinson Varghese Behanan in WordPress Contact Form 7 plugin versions = 5.3.1. Solution Update the WordPress Contact Form 7 plugin to the latest available version at least 5.3.2...

WordPress File Manager plugin <= 6.4 - Backup File Directory Listing vulnerability

Backup File Directory Listing vulnerability found by zerodetail & ratherbland in WordPress File Manager plugin versions = 6.4. Solution Update the WordPress File Manager plugin to the latest available version at least 6.5...

WordPress Ultimate Addons for Elementor plugin <= 1.24.1 - Registration Bypass vulnerability

Registration Bypass vulnerability discovered by WordFence in WordPress Ultimate Addons for Elementor plugin versions = 1.24.1. Solution Update the WordPress Ultimate Addons for Elementor plugin to the latest available version at least 1.24.2...

WordPress <= 5.0 - Authenticated Post Type Bypass vulnerability

Authenticated Post Type Bypass vulnerability found by RIPS Technologies in WordPress versions = 5.0. Solution Update WordPress to the latest available version at least 5.0.1...

WordPress Multi Step Form plugin <= 1.2.5 - Multiple Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerabilities

Multiple Unauthenticated Reflected Cross-Site Scripting XSS vulnerabilities found by Javier Olmedo in WordPress Multi Step Form plugin versions = 1.2.5. Solution Update the plugin WordPress Multi Step Form plugin to the latest available version at least 1.2.6...

WordPress Content Timeline plugin <=4.4.2 - Multiple Blind SQL Injection vulnerabilities

Multiple Blind SQL Injection vulnerabilities found by Jeroen ITNerdbox in premium WordPress plugin - Content Timeline =4.4.2 . It is possible to execute arbitrary SQL commands via the id parameter contenttimelineclass.php, contenttimelineedit.php, contenttimelineindex.php. Solution We were unable...

WordPress Mail Masta plugin <= 1.0 - Local File Inclusion (LFI) vulnerability

A Local File Inclusion vulnerability exists in WordPress Mail Masta Plugin 1.0 plugin. This vulnerability allows remote attackers to include arbitrary files on the server by "dynamic file inclusion" mechanism in Mail Masta Plugin. Solution This plugin has been closed and is no longer available fo...

WordPress WooCommerce Plugin <= 2.3.5 - SQL Injection

Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...

WordPress XCloner Plugin 3.1.0 - CSRF

XCloner plugin is prone to a cross-site request forgery vulnerability that exists because of insufficient verification of HTTP request origin. The attackers can trick a logged-in administrator to visit a specially crafted webpage and create a website backup. Solution Update to XCloner 3.1.1...

WordPress WPStoreCart Plugin 2.5.27 - 2.5.29 - Arbitrary File Upload

WPStoreCart plugin is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also possible. Solutio...

WordPress Spreadsheet Plugin <= 0.6 - SQL Injection

Because of this vulnerability in ssload.php, the attackers can execute arbitrary SQL commands via the "ssid"parameter. Solution Update the plugin...

WordPress <= 2.0.6 - Full Path disclosure

Because of this vulnerability, the attackers can obtain sensitive information via an invalid m parameter. Solution Update the WordPress to the latest available version at least 2.0.7...

WordPress < 7.0.3 - SSRF vulnerability

SSRF vulnerability discovered by Andrew Mohawk in WordPress core versions 7.0.3...

NPM: websocket-driver: Resource limit bypass via message compression

NPM: websocket-driver: Resource limit bypass via message compression vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by suyoung kimAhnLab - AhnLab in WordPress Plugin Ninja Forms versions = 3.14.1...

WordPress Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by se1en in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.5...

WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin FluentForm versions = 6.2.1...

WordPress WP to LinkedIn Auto Publish plugin <= 1.9.8 - Reflected Cross-Site Scripting via PostMessage vulnerability

Reflected Cross-Site Scripting via PostMessage vulnerability discovered by Nicolai Hellesnes nico in WordPress Plugin WP to LinkedIn Auto Publish versions = 1.9.8...

WordPress Welcome Popup plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pham Van Tam in WordPress Plugin Welcome Popup versions = 1.0.10...

WordPress Shipmondo – A complete shipping solution for WooCommerce plugin <= 5.0.3 - Authenticated Arbitrary WordPress Option Disclosure vulnerability

Authenticated Arbitrary WordPress Option Disclosure vulnerability discovered by Psai Patchstack in WordPress Plugin Shipmondo – A complete shipping solution for WooCommerce versions = 5.0.3...

WordPress Web and WooCommerce Addons for WPBakery Builder Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)

Software Web and WooCommerce Addons for WPBakery Builder Type Plugin Vulnerable versions = 1.4.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43960 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c3f6a64bbac8 Credits 4rCanJ0x...

WordPress Multilingual CMS Plugin <= 4.6.12 is vulnerable to Remote Code Execution (RCE)

Software Multilingual CMS Type Plugin Vulnerable versions = 4.6.12 Fixed in 4.6.13 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2024-6386 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 31c994cd7315 Credits stealthcopter Required...

WordPress WooCommerce Customers Manager Plugin < 29.7 is vulnerable to SQL Injection

Software WooCommerce Customers Manager Type Plugin Vulnerable versions 29.7 Fixed in 29.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0399 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 3c8fe0630d48 Credits Ivan Spiridonov Required privilege...

WordPress Payment Forms for Paystack Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Payment Forms for Paystack Type Plugin Vulnerable versions = 4.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32130 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID bdaaf2a9d240 Credits Ngô Thiên An ancorn from...

WordPress JetSmartFilters Plugin <= 3.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software JetSmartFilters Type Plugin Vulnerable versions = 3.2.2 Fixed in 3.2.2.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48762 Patch priority Low CVSS severity Low 6.3 Developer Crocoblock PSID cc4e59f9bb8e Credits Rafie Muhammad...

WordPress ChatBot Plugin <= 4.8.9 is vulnerable to Arbitrary File Deletion

Software ChatBot Type Plugin Vulnerable versions = 4.8.9 Fixed in 4.9.1 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Deletion CVE CVE-2023-5212 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID cac6c246df55 Credits Marco Wotschka Chloe Chamberland Require...

WordPress Contact Form Email Plugin <= 1.3.31 is vulnerable to Other Vulnerability Type

Software Contact Form Email Type Plugin Vulnerable versions = 1.3.31 Fixed in 1.3.32 OWASP Top 10 A5: Broken Access Control Classification Other Vulnerability Type CVE CVE-2023-28494 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1b66482cfee4 Credits István Márton Require...

WordPress Image Map Pro premium plugin <= 5.5.0 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS discovered by Dave Jong Patchstack in the WordPress Image Map Pro premium plugin versions = 5.5.0. Solution No patched version is available. No reply from the vendor for a long time...

WordPress Videojs HTML5 Player plugin <= 1.1.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Lana Codes in WordPress Videojs HTML5 Player plugin versions = 1.1.8. Solution Update the WordPress Videojs HTML5 Player plugin to the latest available version at least 1.1.9...

WordPress Awesome Support plugin <= 6.1.1 - Auth. Arbitrary Exported Tickets Download vulnerability

Auth. Arbitrary Exported Tickets Download vulnerability discovered by dc11 in WordPress Awesome Support plugin versions = 6.1.1. Solution Update the WordPress Awesome Support plugin to the latest available version at least 6.1.2...

WordPress Font Awesome 4 Menus plugin <= 4.7.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by zhangyunpei in WordPress Font Awesome 4 Menus plugin versions = 4.7.0. Solution Deactivate and delete. This plugin has been closed as of November 2, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress Booster for WooCommerce plugin <= 5.6.6 - Auth. Arbitrary File Download vulnerability

Auth. Arbitrary File Download vulnerability discovered by WPScan in WordPress Booster for WooCommerce plugin versions = 5.6.6. Solution Update the WordPress Booster for WooCommerce plugin to the latest available version at least 5.6.7...

WordPress WP Word Count plugin <= 3.2.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by lucy in the WordPress WP Word Count plugin versions = 3.2.3. Solution Deactivate and delete. This plugin has been closed as of October 6, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress Blog2Social plugin <= 6.9.9 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Sakri Rafael Koskimies in WordPress Blog2Social plugin versions = 6.9.9. Solution Update the WordPress Blog2Social plugin to the latest available version at least 6.9.10...

WordPress WP Cerber Security plugin <= 9.0 - User Enumeration Bypass vulnerability

User Enumeration Bypass vulnerability discovered by Margaux DABERT Intrinsec in WordPress WP Cerber Security plugin versions = 9.0. Solution Update the WordPress to the latest available version at least 9.1...

WordPress Beaver Builder plugin <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Text Editor

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Zhouyuan Yang in WordPress Beaver Builder plugin versions = 2.5.5.2. Solution Update the WordPress Beaver Builder plugin to the latest available version at least 2.5.5.3...

WordPress About Me plugin <= 1.0.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ptsfence Patchstack Alliance in WordPress About Me plugin versions = 1.0.12. Solution Deactivate and delete. This plugin has been closed as of August 24, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Download Manager plugin <= 3.2.48 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to template status change discovered by Muhammad Daffa Patchstack Alliance in WordPress Download Manager plugin versions = 3.2.48. Solution Update the WordPress Download Manager plugin to the latest available version at least 3.2.49...

WordPress Banner Cycler plugin <= 1.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Cross-Site Scripting XSS discovered by MOTEKI TAKERU in WordPress Banner Cycler plugin versions = 1.4. Solution Deactivate and delete. This plugin has been closed as of June 30, 2022 and is not available for download. This closure is...