WordPress RentPress plugin <= 6.6.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress RentPress plugin versions = 6.6.4. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress SendGrid plugin <= 1.11.8 - Authenticated Authorization Bypass vulnerability

Authenticated Authorization Bypass vulnerability discovered by Prashant Baldha in WordPress SendGrid plugin versions = 1.11.8. Solution This plugin has been closed as of July 13, 2021 and is not available for download. This closure is permanent...

WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered by Vlad Visse Patchstack in WordPress Popular Posts plugin versions = 5.3.3. Solution Update the WordPress Popular Posts plugin to the latest available version at least 5.3.4...

WordPress Visitors plugin <= 0.3 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Mesut Cetin in WordPress Visitors plugin versions = 0.3. Solution This plugin has been closed as of May 26, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Easy Google Maps plugin <= 1.9.31 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by 0xB9 in WordPress Easy Google Maps plugin versions = 1.9.31. Solution Update the WordPress Easy Google Maps plugin to the latest available version at least 1.9.32...

WordPress fitness calculators plugin <= 1.9.5 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF leading to Cross-Site Scripting XSS vulnerability discovered by 0xB9 in WordPress fitness calculators plugin versions = 1.9.5. Solution Update the WordPress fitness calculators plugin to the latest available version at least 1.9.6...

WordPress <= 5.5.1 - Mishandled deserialization requests vulnerability

Mishandled deserialization requests vulnerability found by Alex Concha in WordPress versions = 5.5.1. Solution Update the WordPress plugin to the latest available version at least 5.5.2...

WordPress Official MailerLite Sign Up Forms plugin <= 1.4.3 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability found by Dave WebARX in WordPress Official MailerLite Sign Up Forms plugin versions = 1.4.3. Solution Update the WordPress Official MailerLite Sign Up Forms plugin to the latest available version at least 1.4.4...

WordPress CSS Hero plugin <= 4.03 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found by Cary Hooper in WordPress CSS Hero plugin versions = 4.03. Solution Update the WordPress CSS Hero plugin to the latest available version at least 4.07...

WordPress YITH PayPal Express Checkout for WooCommerce plugin <=1.2.5 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH PayPal Express Checkout for WooCommerce plugin versions =1.2.5. Solution Update the WordPress YITH PayPal Express Checkout for WooCommerce plugin to the latest available version at...

WordPress YITH WooCommerce Zoom Magnifier plugin <=1.3.11 - Authenticated Settings Change (YITH Plugin Framework <=3.3.8) vulnerability

Authenticated Settings Change YITH Plugin Framework =3.3.8 vulnerability found by Jerome Bruandet in WordPress YITH WooCommerce Zoom Magnifier plugin versions =1.3.11. Solution Update the WordPress YITH WooCommerce Zoom Magnifier plugin to the latest available version at least 1.3.12...

WordPress SlickQuiz plugin <= 1.3.7.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability found by Julien Ahrens in WordPress SlickQuiz plugin versions = 1.3.7.1. Solution 11 September 2019 - we were unable to find a patched version of this plugin...

WordPress Appointment Hour Booking plugin <= 1.1.45 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by ivoschyk-cs in WordPress Appointment Hour Booking plugin versions = 1.1.45. Solution Update the WordPress Appointment Hour Booking plugin to the latest available version at least 1.1.46...

WordPress Ninja Forms plugin <=3.2.13 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Kasper Karlsson in WordPress Ninja Forms plugin versions = 3.2.13. Solution Update the WordPress Ninja Forms plugin to the latest available version at least 3.2.14...

WordPress Huge-IT Video Gallery plugin <=2.0.4 - SQL Injection vulnerability

SQL Injection vulnerability found by Neven Biruski DefenseCode in WordPress Huge-IT Video Gallery plugin version 2.0.4 and earlier versions. Solution Update WordPress Huge-IT Video Gallery plugin to the latest available version...

WordPress <= 4.5.2 - BYPASS #4

The customizer allows an attacker to bypass intended redirection restrictions via unspecified vectors. Related records: http://db.threatpress.com/vulnerability/wordpress/wordpress-4-5-2-bypass http://db.threatpress.com/vulnerability/wordpress/wordpress-4-5-2-bypass-1...

WordPress Google Analyticator <= 6.4.9.5 - Multiple XSS

These vulnerabilities allow an attacker to inject arbitrary web script or HTML via the 1. gadownloadsprefix 2. gadownloads 3. gaadsense 4. gaadmindisableDimentionIndex 5. gaoutboundprefix parameter in the google-analyticator page to wp-admin/admin.php. Solution Update the plugin...

WordPress Modern Tribe Eventbrite Tickets Plugin <= 3.10.1 - XSS

This vulnerability is in the Event Import page. It allows an attacker to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php. Solution Update the plugin...

WordPress Audio Player Plugin <= 2.0 - Multiple XSS

Because of these vulnerabilities in the wpajaxsaveitem function, the attackers can inject arbitrary web script or HTML via the "itemname" or "itemcustomcss" parameters in a wonderpluginaudiosaveitem action to wp-admin/admin-ajax.php. Solution Upgrade the plugin...

WordPress <= 4.0.0 - XSS #1

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via a crafted Cascading Style Sheets CSS token sequence in a post. Related records: http://db.threatpress.com/vulnerability/wordpress/wordpress-4-0-0-xss-2...

WordPress <= 3.9.2 - XSS

This vulnerability is in the "wptexturize" function. It allows the attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post. Solution Update WordPress...

WordPress BulletProof Security Plugin <= .51 - XSS

Because of this vulnerability in admin/htaccess/bpsunlock.php, the attackers can inject arbitrary web script or HTML via the "dbhost" parameter. Solution Update the plugin...

WordPress Bookclub Theme - Remote Code Execution

There is a bug in this theme, that allows any website visitor to run and see the output of any shortcode. This gives unauthenticated visitors the same power to execute code on the server as regular publishers have. Solution Update the theme...

WordPress WP Cron Dashboard Plugin <= 1.1.5 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "procname" parameter to wp-admin/tools.php. Solution Update the plugin...

WordPress VideoWhisper Live Streaming Integration Plugin <= 4.25.3 - Multiple XSS

Because of these multiple vulnerabilities in ls/htmlchat.php, the attackers can inject arbitrary web script or HTML via the "name" or "message" parameter. Solution Update the plugin...

WordPress <= 0.7 - SQL injection

Because of this vulnerability in log.header.php, the attackers can execute arbitrary SQL commands via the posts variable. Solution Update the plugin...

WordPress <= 2.1.2 - Sensitive Directory Exposure

Because of this vulnerability, the attackers can obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error message. Solution Update the WordPress to the latest available version at least 2.1.3...

WordPress <= 1.5.2 - SQL injection

Because of this vulnerability, attackers can execute arbitrary SQL commands via the User-Agent field in an HTTP header for a comment. Solution Update the WordPress to the latest available version at least 1.5.3...

WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin <= 1.8.40 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Or Benit - MadSec in WordPress Plugin Photo Gallery by 10Web versions = 1.8.40...

WordPress WP to LinkedIn Auto Publish plugin <= 1.9.8 - Reflected Cross-Site Scripting via PostMessage vulnerability

Reflected Cross-Site Scripting via PostMessage vulnerability discovered by Nicolai Hellesnes nico in WordPress Plugin WP to LinkedIn Auto Publish versions = 1.9.8...

WordPress Chartify plugin <= 3.5.9 - Missing Authentication for Administrative Function vulnerability

Missing Authentication for Administrative Function vulnerability discovered by WordFence in WordPress Plugin Chartify versions = 3.5.9...

WordPress Computer Repair Shop Plugin <= 3.8115 is vulnerable to Arbitrary File Upload

Software Computer Repair Shop Type Plugin Vulnerable versions = 3.8115 Fixed in 3.8116 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-51793 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 4e734860df66 Credits stealthcopter Required privilege...

WordPress Hunk Companion Plugin <= 1.8.4 is vulnerable to Broken Access Control

Software Hunk Companion Type Plugin Vulnerable versions = 1.8.4 Fixed in 1.8.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9707 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 20cecbb53904 Credits Sean Murphy Required privileg...

WordPress myCred Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

Software myCred Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43353 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a2faf75ac250 Credits LVT-tholv2k Required privilege Contributor...

WordPress WP Hotel Booking Plugin <= 2.1.0 is vulnerable to SQL Injection

Software WP Hotel Booking Type Plugin Vulnerable versions = 2.1.0 Fixed in 2.1.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3605 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 4c5ededd8a8e Credits Krzysztof Zając Required privilege...

WordPress Avada Theme <= 7.11.6 is vulnerable to Server Side Request Forgery (SSRF)

Software Avada Type Theme Vulnerable versions = 7.11.6 Fixed in 7.11.7 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-2343 Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID b215d9a4cc5d Credits Muhammad Zeeshan Xib3rR4dAr Required...

WordPress Smart Manager Plugin < 8.28.0 is vulnerable to SQL Injection

Software Smart Manager Type Plugin Vulnerable versions 8.28.0 Fixed in 8.28.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0566 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID c1d0448fde12 Credits Ivan Spiridonov Required privilege Administrator...

WordPress WP Stripe Checkout plugin <= 1.2.2.20 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Lana Codes in WordPress WP Stripe Checkout plugin versions = 1.2.2.20. Solution Update the WordPress WP Stripe Checkout plugin to the latest available version at least 1.2.2.21...

WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to status change of translation job discovered by Dave Jong Patchstack in WordPress WPML Multilingual CMS premium plugin versions = 4.5.13. Solution Update the WordPress Multilingual CMS plugin to the latest available version at least 4.5.14...

WordPress Find and Replace All plugin <= 1.3 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to Arbitrary Replacement discovered by Vinay Varma Mudunuri, Krishna Harsha Kondaveeti in WordPress Find and Replace All plugin versions = 1.3. Solution No patched version available...

WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to Plugin Settings Import was discovered by Muhammad Daffa Patchstack Alliance in WordPress Advanced Dynamic Pricing for WooCommerce plugin versions = 4.1.5. Solution Update the WordPress Advanced Dynamic Pricing for WooCommerce plugin to the...

WordPress Ultimate Member plugin <= 2.5.0 - Auth. Remote Code Execution vulnerability

Auth. Remote Code Execution vulnerability discovered by Ruijie Li in WordPress Ultimate Member plugin versions = 2.5.0. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.5.1...

WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to plugin settings change discovered by Muhammad Daffa Patchstack Alliance in WordPress Advanced Dynamic Pricing for WooCommerce plugin versions = 4.1.3 Solution Update the WordPress Advanced Dynamic Pricing for WooCommerce plugin to the lates...

WordPress Booking Calendar plugin <= 9.2.1 - Cross-Site Request Forgery (CSRF) leading to Translations Update

Cross-Site Request Forgery CSRF leading to Translations Update discovered by Muhammad Daffa Patchstack Alliance in WordPress Booking Calendar plugin versions = 9.2.1. Solution Update the WordPress Booking Calendar plugin to the latest available version at least 9.2.2...

WordPress MailerLite – Signup forms (official) plugin <= 1.5.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to API key change discovered by Muhammad Daffa Patchstack Alliance in WordPress MailerLite – Signup forms official plugin versions = 1.5.7. Solution Update the WordPress MailerLite – Signup forms plugin to the latest available version at least...

WordPress YaySMTP – Simple WP SMTP Mail plugin <= 2.2.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Rafshanzani Suhada in WordPress YaySMTP – Simple WP SMTP Mail plugin versions = 2.2.1. Solution Update the WordPress YaySMTP plugin to the latest available version at least 2.2.2...

WordPress Visualizer plugin <= 3.7.9 - Authenticated PHAR Deserialization vulnerability

Authenticated PHAR Deserialization vulnerability discovered by Rasoul Jahanshahi in WordPress Visualizer plugin versions = 3.7.9. Solution Update the WordPress Visualizer plugin to the latest available version at least 3.7.10...

WordPress Core plugin for Kitestudio themes <= 2.3.0 - Reflected Cross-Site-Scripting (XSS) vulnerability

Reflected Cross-Site-Scripting XSS vulnerability discovered by cydave in WordPress Core plugin for Kitestudio themes versions = 2.3.0. Solution Update the WordPress Core plugin for Kitestudio themes to the latest available version at least 2.3.1...

WordPress WPMK Ajax Finder plugin <= 1.0.1 - Stored Cross-Site Scripting (XSS) via CSRF vulnerability

Stored Cross-Site Scripting XSS via CSRF vulnerability discovered by Tsubasa Imaizumi Cryptography Laboratory in Tokyo Denki University in WordPress WPMK Ajax Finder plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of May 17, 2022 and is not available for...

WordPress Popup Maker plugin <= 1.16.4 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Roel van Beurden in WordPress Popup Maker plugin versions = 1.16.4. Solution Update the WordPress Popup Maker plugin to the latest available version at least 1.16.5...