WordPress Advanced Custom Fields PRO premium plugin <= 5.12.2 - Unauthenticated File Upload vulnerability

Unauthenticated File Upload vulnerability discovered by James Golovich in WordPress Advanced Custom Fields PRO premium plugin versions = 5.12.2. Solution Update the WordPress Advanced Custom Fields PRO plugin to the latest available version at least 5.12.3...

WordPress Tabs plugin <= 3.6.0 - Authenticated WordPress Options Change vulnerability

Authenticated WordPress Options Change vulnerability discovered by m0ze Patchstack in WordPress Tabs plugin versions = 3.6.0. Solution Update the WordPress Tabs plugin to the latest available version at least 3.7.0...

WordPress Inspiro Pro premium theme < 7.2.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Fortune Sam Okon in WordPress Inspiro Pro premium theme versions 7.2.3. Solution Update the WordPress Inspiro premium theme to the latest available version at least 7.2.3...

WordPress WP Maintenance plugin <= 6.0.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by m0ze Patchstack in WordPress WP Maintenance plugin versions = 6.0.7 Solution Update the WordPress WP Maintenance plugin to the latest available version at least 6.0.8...

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.9.7 - Reflected Cross-Site-Scripting (XSS) vulnerability

Reflected Cross-Site-Scripting XSS vulnerability discovered by cydave in WordPress Shortcodes and extra features for Phlox theme plugin versions = 2.9.7. Solution Update the WordPress Shortcodes and extra features for Phlox theme plugin to the latest available version at least 2.9.8...

WordPress WP Event Manager plugin <= 3.1.27 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Utkarsh Agrawal in WordPress WP Event Manager plugin versions = 3.1.27. Solution Update the WordPress WP Event Manager plugin to the latest available version at least 3.1.28...

WordPress HTML2WP plugin <= 1.0.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Daniel Ruf in WordPress HTML2WP plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of May 4, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Mihdan: No External Links plugin <= 5.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Vaibhav Nitin Gaikwad in WordPress Mihdan: No External Links plugin versions = 5.0.1. Solution Update the WordPress Mihdan: No External Links plugin to the latest available version at least 5.0.2...

WordPress Ask Me premium theme < 6.8.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Veshraj Ghimire in WordPress Ask Me premium theme versions 6.8.2. Solution Update the WordPress Ask Me premium theme to the latest available version at least 6.8.2...

WordPress Andrea Pernici News Sitemap for Google plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by John Castro aka mirphak Pagely in WordPress Andrea Pernici News Sitemap for Google plugin versions = 1.0.16. Solution No patched version is available...

WordPress WPQA - Builder forms Addon plugin < 5.2 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Veshraj Ghimire in WordPress WPQA - Builder forms Addon plugin versions 5.2. Solution Update the WordPress WPQA - Builder forms Addon plugin to the latest available version at least 5.2...

WordPress Order Listener for WooCommerce plugin <= 3.2.1 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Order Listener for WooCommerce plugin versions = 3.2.1. Solution Update the WordPress Order Listener for WooCommerce plugin to the latest available version at least 3.2.2...

WordPress Sitemap by click5 plugin <= 1.0.35 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by cydave in WordPress Sitemap by click5 plugin versions = 1.0.35. Solution Update the WordPress Sitemap by click5 plugin to the latest available version at least 1.0.36...

WordPress Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Template Import

Cross-Site Request Forgery CSRF vulnerability leading to Template Import discovered by Ex.Mi Patchstack in WordPress Yoo Slider plugin versions = 2.0.0. Solution Update the WordPress Yoo Slider plugin to the latest available version at least 2.1.0...

WordPress Responsive Tabs plugin <= 4.0.5 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability was discovered by Ngo Van Thien Patchstack Alliance in WordPress Responsive Tabs plugin versions = 4.0.5. Solution No patched version is available...

WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 5.174 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ramuel Gall Wordfence in WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin versions = 5.174. Solution Update the WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin to the latest available version at leas...

WordPress Nimble Page Builder plugin < 3.2.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Nimble Page Builder plugin versions 3.2.2. Solution Update the WordPress Nimble Page Builder plugin to the latest available version at least 3.2.3...

WordPress Material Design for Contact Form 7 plugin <= 2.6.4 - Arbitrary Settings Update vulnerability leading to Denial of Service (DoS)

Arbitrary Settings Update vulnerability leading to Denial of Service DoS discovered by Krzysztof Zając in WordPress Material Design for Contact Form 7 plugin versions = 2.6.4. Solution Deactivate and delete. This plugin has been closed as of February 11, 2022 and is not available for download. Th...

WordPress UpdraftPlus plugin <= 1.22.1 - Arbitrary Backup Downloads vulnerability

Arbitrary Backup Downloads vulnerability discovered by Marc-Alexandre Montpas Automattic in WordPress UpdraftPlus plugin versions = 1.22.1. Solution Update the WordPress UpdraftPlus plugin to the latest available version at least 1.22.3...

WordPress PPOM for WooCommerce plugin <= 23.9 - Settings Update vulnerability leading to Stored Cross-Site Scripting (XSS)

Settings Update vulnerability leading to Stored Cross-Site Scripting XSS discovered by Krzysztof Zając in WordPress PPOM for WooCommerce plugin versions = 23.9. Solution Update the WordPress PPOM for WooCommerce plugin to the latest available version at least 24.0...

WordPress OMGF | Host Google Fonts Locally plugin <= 4.5.11 - Arbitrary Folder Deletion via Path Traversal vulnerability

Arbitrary Folder Deletion via Path Traversal vulnerability discovered by José Aguilera in WordPress OMGF | Host Google Fonts Locally plugin versions = 4.5.11. Solution Update the WordPress OMGF | Host Google Fonts Locally plugin to the latest available version at least 4.5.12...

WordPress SendGrid plugin <= 1.11.8 - Authenticated Authorization Bypass vulnerability

Authenticated Authorization Bypass vulnerability discovered by Prashant Baldha in WordPress SendGrid plugin versions = 1.11.8. Solution This plugin has been closed as of July 13, 2021 and is not available for download. This closure is permanent...

WordPress JNews premium theme <= 8.0.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Truoc Phan in WordPress JNews premium theme versions = 8.0.5. Solution Update the WordPress JNews premium theme to the latest available version at least 8.0.6...

WordPress WPML plugin <= 4.3.6 - Authenticated Cross-Site Request Forgery (CSRF) vulnerability leading to Remote Code Execution (RCE)

Authenticated Cross-Site Request Forgery CSRF vulnerability leading to Remote Code Execution RCE discovered by Gerard Arall in WordPress WPML plugin versions = 4.3.6. Solution Update the WordPress WPML plugin to the latest available version at least 4.3.7...

WordPress Elementor Page Builder plugin <= 2.8.4 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found by Impenetrable in WordPress Elementor Page Builder plugin versions = 2.8.4. Solution Update the WordPress Elementor Page Builder plugin to the latest available version at least 2.8.5...

WordPress ResAds Plugin <= 1.0.1 - Cross Site Scripting

This WordPress plugin is prone to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary script or HTML. Solution Update the plugin...

WordPress WPML Plugin <= 3.1.8 - Multiple Vulnerabilities

This WordPress Multilingual plugin is prone to SQL injection, missing authentication, page/post/menu deletion and reflected XSS vulnerabilities. Solution Update the plugin...

WordPress Easy Social Icons Plugin 1.2.2 - CSRF

Easy Social Icons plugin is prone to a cross-site request forgery vulnerability because of insufficient validation is performed on the "imagefile" parameter which allows arbitrary JavaScript. Solution Upgrade the plugin...

WordPress <= 3.9.1 - Denial Of Service Attacks #2

The Incutio XML-RPC IXR Library permits entity declarations without considering recursion during entity expansion. In that way the attackers can cause a denial of service attacks via a crafted XML document containing a large number of nested entity references. Related records:...

WordPress VideoWhisper Live Streaming Integration Plugin <= 4.29.4 - Multiple Vulnerabilities

The error-handling feature in ls/rtmp.inc.php, videowhisperstreaming.php or bp.php allows the attackers to obtain sensitive information via a direct request, which reveals the full path in an error message. Solution Update the plugin...

WordPress Ad-Minister Plugin <= 0.6 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "key" parameter in a delete action to wp-admin/tools.php. Solution Update the plugin...

WordPress <= 3.5.0 - SSRF

Because of The XMLRPC API, the attackers can send HTTP requests to intranet servers. Also, they can conduct port-scanning attacks by specifying a crafted source URL for a pingback. Solution Update WordPress...

WordPress Gravity Forms plugin <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field vulnerability

Unauthenticated Arbitrary File Upload via Hidden File Upload Field vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin Gravity Forms versions = 3.1.0.4...

WordPress < 7.0.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by HDWSec in WordPress core versions 7.0.3...

WordPress SignUp & SignIn plugin <= 1.0.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Alyudin Nafiie in WordPress Plugin SignUp & SignIn versions = 1.0.0...

NPM: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

NPM: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message vulnerability discovered by ? in WordPress Npm nodemailer versions = 9.0.0...

WordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Sunshine Photo Cart versions = 3.6.7...

NPM: FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment

NPM: FlowiseAI has Mass Assignment in Chatflow Update Endpoint that Allows Cross-Workspace AgentFlow Reassignment vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.1...

WordPress Anti-Spam Protection – No API Key, GDPR Friendly plugin <= 2.3.7 - Unauthenticated Reflected Cross-Site Scripting vulnerability

Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Anti-Spam by Fullworks : GDPR Compliant Spam Protection versions = 2.3.7...

WordPress Popup Maker plugin <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via popupID Parameter vulnerability discovered by Asaf Mozes in WordPress Plugin Popup Maker versions = 1.20.4...

WordPress Chartify Plugin <= 2.9.5 is vulnerable to Remote Code Execution (RCE)

Software Chartify Type Plugin Vulnerable versions = 2.9.5 Fixed in 2.9.6 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2024-10571 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 97f7a98a5728 Credits abrahack Required privilege Unauthenticated...

WordPress Form Maker by 10Web Plugin <= 1.15.30 is vulnerable to Cross Site Scripting (XSS)

Software Form Maker by 10Web Type Plugin Vulnerable versions = 1.15.30 Fixed in 1.15.31 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-10265 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0450360afe6c Credits vgo0...

WordPress Advanced Custom Fields Plugin <= 6.3.6 is vulnerable to Arbitrary Code Execution

Software Advanced Custom Fields Type Plugin Vulnerable versions = 6.3.6 Fixed in 6.3.6.1 OWASP Top 10 A1: Injection Classification Arbitrary Code Execution CVE CVE-2024-9529 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2b40e735610b Credits Automattic Security Team...

WordPress Z Y N I T H Plugin <= 7.4.9 is vulnerable to Settings Change

Software Z Y N I T H Type Plugin Vulnerable versions = 7.4.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-43940 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b82e28b179e8 Credits Dave Jong Patchstack Required...

WordPress LearnPress Plugin <= 4.2.6.8.1 is vulnerable to Broken Access Control

Software LearnPress Type Plugin Vulnerable versions = 4.2.6.8.1 Fixed in 4.2.6.8.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-6099 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID b7595fc9b77e Credits shaman0x01 Required privile...

WordPress WS Form LITE Plugin <= 1.9.217 is vulnerable to CSV Injection

Software WS Form LITE Type Plugin Vulnerable versions = 1.9.217 Fixed in 1.9.218 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-5424 Patch priority Low CVSS severity Low 4.7 Developer WS Form PSID 7d55c6663718 Credits Duc Manh Required privilege Unauthenticated Published 7...

WordPress Post Views Counter Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Post Views Counter Type Plugin Vulnerable versions = 1.4.4 Fixed in 1.4.5 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31264 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 68843b34fde0 Credits Brandon Roldan...

WordPress MapPress Maps for WordPress Plugin <= 2.88.16 is vulnerable to Cross Site Scripting (XSS)

Software MapPress Maps for WordPress Type Plugin Vulnerable versions = 2.88.16 Fixed in 2.88.17 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7225 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID fbcdd95991b2 Credits Akbar...

WordPress Ajax Archive Calendar Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)

Software Ajax Archive Calendar Type Plugin Vulnerable versions = 2.6.7 Fixed in 2.6.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-46069 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2c6a1e009987 Credits Ngô Thiên An ancorn from...

WordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability

Auth. Broken Access Control vulnerability leading to arbitrary feed creation discovered by Tien Nguyen Anh Patchstack Alliance in the WordPress Plugin for Google Reviews plugin versions = 2.2.2. Solution Update the WordPress Plugin for Google Reviews plugin to the latest available version at leas...