WordPress Shortcodes Ultimate plugin <= 5.10.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Shortcodes Ultimate plugin versions = 5.10.1. Solution Update the WordPress Shortcodes Ultimate plugin to the latest available version at least 5.10.2...

WordPress SEO Backlinks plugin <= 4.0.1 – Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Takahiro Yamashita Cryptography Laboratory - Tokyo Denki University in WordPress SEO Backlinks plugin versions = 4.0.1. Solution This plugin has been closed as of July 23, 2021 and is not...

WordPress Bookshelf plugin <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by ABISHEIK M in WordPress Bookshelf plugin versions = 2.0.4. Solution Deactivate and delete. This plugin has been closed as of May 25, 2021 and is not available for download. Reason: Security Issue...

WordPress Salon booking system plugin <= 6.3 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Phu Tran in WordPress Salon booking system plugin versions = 6.3 Solution Update the WordPress Salon booking system plugin to the latest available version at least 6.3.1...

WordPress Modern WPBakery Page Builder Addons premium plugin <= 3.0.1 - Arbitrary File Upload/Deletion vulnerabilities

Arbitrary File Upload/Deletion vulnerabilities discovered by Robin Goodfellow in WordPress Modern WPBakery Page Builder Addons premium plugin versions = 3.0.1. Solution Plugin removed from Envato repository. Deactivate and delete...

WordPress Imagements plugin <= 1.2.5 - Unauthenticated Arbitrary File Upload leading to Remote Code Execution (RCE) vulnerability

Unauthenticated Arbitrary File Upload leading to Remote Code Execution RCE vulnerability discovered by Jin Huang in WordPress Imagements plugin versions = 1.2.5. Solution Plugin closed. Deactivate and delete...

WordPress Patreon WordPress plugin <= 1.7.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Jetpack Scan team in WordPress Patreon WordPress plugin versions = 1.7.1. Solution Update the WordPress Patreon WordPress plugin to the latest available version at least 1.7.2...

WordPress Hero Maps Premium plugin <= 2.2.1 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability discovered by Hooper Labs in WordPress Hero Maps Premium plugin versions = 2.2.1. Solution Update the WordPress Hero Maps Premium plugin to the latest available version at least 2.2.3...

WordPress Wechat Broadcast plugin <= 1.2.0 - Local/Remote File Inclusion vulnerability

Local/Remote File Inclusion vulnerability found by Manuel Garcia Cardenas in WordPress Wechat Broadcast plugin versions = 1.2.0. Solution 2018 October 3rd - no patched version available to download. We recommend to deactivate and uninstall...

WordPress E-Search Plugin <= 1.0 - Cross-Site Scripting (XSS)

Because of this vulnerability, the variable date-from appears to send unsanitized data back to the users browser. Solution Update the plugin...

WordPress Login Rebuilder Plugin <= 1.1.9 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of arbitrary users. Solution Update the plugin...

WordPress WP Cron Dashboard Plugin <= 1.1.5 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "procname" parameter to wp-admin/tools.php. Solution Update the plugin...

WordPress Sentinel Plugin <= 1.0.0 - SQL iNJECTION

Because of this vulnerability, the attackers can execute arbitrary SQL commands via unspecified vectors. Solution Update the plugin...

WordPress <= 3.1.0 - Multiple Vulnerabilities

The attackers can cause a denial of service via a comment with a crafted URL that triggers many recursive calls, because the makeclickable function in wp-includes/formatting.php does not properly check URLs before passing them to the PCRE library. Solution Update WordPress...

WordPress - Privileges Unchecked in admin.php and Multiple Information

This WordPress vulnerability was found in the way that WordPress handles some URL requests. It results the content of plugins configuration pages in some plugins modifying plugin options, unprivileged users viewing and injecting JavaScript code. The code is abitrary and it may be run by a malicio...

WordPress <= 2.2.2 - BYPASS

The attackers can bypass intended access restrictions for certain pages, because wp-includes/vars.php does not properly extract the current path from the PATHINFO. Solution Update WordPress...

WordPress Pool Theme <= 1.0.7 - XSS

Because of this vulnerability in index.php, the attackers can inject arbitrary web script or HTML via the PATHINFO. Solution Update the theme...

WordPress <= 2.1.1 - Multiple Vulnerabilities

The attackers can execute arbitrary commands via an eval injection vulnerability in the "ix" parameter to wp-includes/feed.php. Also, there is command execution backdoor vulnerability. Solution Update the WordPress to the latest available version at least 2.1.2...

WordPress <= 2.0 - Denial of Service Attacks

The wpremotefopen function allows the attackers to cause a denial of service attacks via pingback service calls. Solution Update the WordPress to the latest available version at least 2.0.1...

WordPress <= 1.2 - Remote Code Execution

Because of this vulnerability in The httpsrequest function in Snoopy, the attackers can execute arbitrary commands via shell metacharacters in an HTTPS URL to an SSL protected web page, that is not properly handled by the fetch function. Solution Update the WordPress to the latest available versi...

WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dthangws in WordPress Plugin YITH WooCommerce Ajax Search versions = 2.28.0...

WordPress Admin Menu Editor Pro 2.35-2.36 - Backdoor vulnerability

Backdoor vulnerability discovered by Unknown in WordPress Plugin Admin Menu Editor Pro versions 2.35-2.36...

WordPress UsersWP plugin < 1.2.67 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by dc11 in WordPress Plugin UsersWP versions 1.2.67...

WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Addons for Elementor versions = 1.45.2...

NPM: DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

NPM: DOMPurify: Trusted Types policy survives clearConfig and can poison later RETURNTRUSTEDTYPE output vulnerability discovered by ? in WordPress Npm dompurify versions 3.4.9...

NPM: Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

NPM: Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization vulnerability discovered by ? in WordPress Npm fabric versions 7.4.0...

WordPress Simple SEO Slideshow plugin <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin Simple SEO Slideshow versions = 1.2.8...

WordPress Advanced Custom Fields (ACF®) plugin <= 6.8.1 - Unauthenticated Arbitrary Post Modification vulnerability

Unauthenticated Arbitrary Post Modification vulnerability discovered by Sarawut Poolkhet MisterHelloz in WordPress Plugin Advanced Custom Fields versions = 6.8.1...

WordPress Islamic Database plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by MAJidox in WordPress Plugin Islamic Database versions = 1.0...

WordPress Ingenioso theme <= 1.14.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Ingenioso versions = 1.14.0...

WordPress LatePoint – Calendar Booking Plugin for Appointments and Events plugin <= 5.3.2 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Tulgaaaa - Empasoft Institute of Technology in WordPress Plugin LatePoint versions = 5.3.2...

WordPress Cooked plugin <= 1.11.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ch1mk in WordPress Plugin Cooked versions = 1.11.3...

WordPress All-in-One Video Gallery plugin <= 4.5.7 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by kr0d in WordPress Plugin All-in-One Video Gallery versions = 4.5.7...

WordPress All in One SEO Pack plugin <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Post Meta Description and Canonical URL vulnerability discovered by Ivan Kuzymchak in WordPress Plugin All In One SEO Pack versions = 4.8.1.1...

WordPress JobSearch Plugin <= 2.6.7 is vulnerable to Arbitrary File Upload

Software JobSearch Type Plugin Vulnerable versions = 2.6.7 Fixed in 2.6.8 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-8614 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID d16b486be3a5 Credits Tonn Required privilege Subscriber Published 5...

WordPress mFolio Lite Plugin <= 1.2.1 is vulnerable to Broken Access Control

Software mFolio Lite Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9307 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 19ba5b646cd3 Credits Francesco Carlucci Required...

WordPress Order Notification for Telegram Plugin <= 1.0.1 is vulnerable to Broken Access Control

Software Order Notification for Telegram Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9686 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c9ae0bfdb3a8 Credits István Márton...

WordPress myCred Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

Software myCred Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43353 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a2faf75ac250 Credits LVT-tholv2k Required privilege Contributor...

WordPress Page and Post Clone Plugin <= 6.0 is vulnerable to Sensitive Data Exposure

Software Page and Post Clone Type Plugin Vulnerable versions = 6.0 Fixed in 6.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2024-5942 Patch priority Low CVSS severity Low 2.7 Developer Claim ownership PSID 2f05aa4ff3e4 Credits Bassem Essam Required...

WordPress Country State City Dropdown CF7 Plugin <= 2.7.2 is vulnerable to SQL Injection

Software Country State City Dropdown CF7 Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3495 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 39d467a76c0d Credits Krzysztof Zając Required privile...

WordPress MasterStudy LMS Plugin <= 3.3.8 is vulnerable to Broken Access Control

Software MasterStudy LMS Type Plugin Vulnerable versions = 3.3.8 Fixed in 3.3.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3942 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID e8c9ed38d014 Credits Lucio Sá Required privilege...

WordPress Remote Content Shortcode Plugin <= 1.5 is vulnerable to Local File Inclusion

Software Remote Content Shortcode Type Plugin Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-45652 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6e56401bc4b5 Credits Mika Required privilege Contributor...

WordPress InfiniteWP Client Plugin <= 1.11.1 is vulnerable to Sensitive Data Exposure

Software InfiniteWP Client Type Plugin Vulnerable versions = 1.11.1 Fixed in 1.12.1 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-2916 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 88e39a11f14f Credits Lana Codes Required...

WordPress Stripe Payment Gateway for WooCommerce Plugin <= 3.7.7 is vulnerable to Privilege Escalation

Software Stripe Payment Gateway for WooCommerce Type Plugin Vulnerable versions = 3.7.7 Fixed in 3.7.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-3162 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID...

WordPress The7 Theme <= 11.7.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software The7 Type Theme Vulnerable versions = 11.7.3 Fixed in 11.7.3.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-32123 Patch priority Low CVSS severity Low 6.1 Developer Claim ownership PSID 3ecb876f7b93 Credits Dave Jong Patchstack Requir...

WordPress fitness-trainer Plugin < 1.4.1 is vulnerable to Privilege Escalation

Software fitness-trainer Type Plugin Vulnerable versions 1.4.1 Fixed in 1.4.1 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2020-36666 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 4ffd920db47c Credits Omar Badran Required privilege...

WordPress Royal Elementor Addons Plugin <= 1.3.59 is vulnerable to Broken Access Control

Software Royal Elementor Addons Type Plugin Vulnerable versions = 1.3.59 Fixed in 1.3.60 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-4700 Patch priority Medium CVSS severity Medium 5.4 Developer WProyal PSID 423004fa0a2f Credits Ramuel Gall Required...

WordPress AgentEasy Properties plugin <= 1.0.4 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Hoang Van Hiep Patchstack Alliance in the WordPress AgentEasy Properties plugin versions = 1.0.4. Solution Deactivate and delete. This plugin has been closed as of November 1, 2022 and is not available for download. This closure is...

WordPress 2kb Amazon Affiliates Store plugin <= 2.1.5 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by ptsfence Patchstack Alliance in WordPress 2kb Amazon Affiliates Store plugin versions = 2.1.5. Solution No patched version is available. No reply from the vendor...

WordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability discovered by Dhakal Ananda Patchstack Alliance in WordPress Better Messages plugin versions = 1.9.10.68. Solution Update the WordPress BP Better Messages plugin to the latest available version at least 1.9.10.69...