WordPress Uninstall Plugin <= 1.1 - WordPress Deletion via CSRF

Because of this vulnerability, it is possible to delete all WordPress database files and tables. Solution Upgrade this plugin...

WordPress <= 2.0.6 - SQL Injection vulnerability

The attackers can execute arbitrary SQL commands via the "tbid" parameter. Solution Update the WordPress to the latest available version at least 2.0.7...

WordPress Advanced Custom Fields plugin 3.1.1 - 6.0.2 - Custom Field Value Exposure vulnerability

Custom Field Value Exposure Through Parsed Shortcode from User Input vulnerability discovered by Juan Hoffmann in WordPress Advanced Custom Fields plugin versions 3.1.1 - 6.0.2. Solution Update the WordPress Advanced Custom Fields plugin to the latest available version at least 6.0.3...

WordPress Timed Popup Plugin <= 1.3 - Multiple CSRF and XSS

Because of these cross site request forgery vulnerabilities, the attackers can hijack the authentication of administrators for requests. In that way they can change plugin settings via unspecified vectors or conduct cross-site scripting attacks. Solution Update the plugin...

WordPress is vulnerable to Cross Site Scripting (XSS)

Software WordPress Type WordPress Core Vulnerable versions 6.5.5 Fixed in 6.5.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31111 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 41d6eebb2ef0 Credits Rafie Muhammad Patchstack Required...

WordPress Elementor Website Builder plugin <= 3.6.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Ramuel Gall Wordfence in WordPress Elementor Website Builder plugin versions = 3.6.2. Solution Update the WordPress Elementor Website Builder plugin to the latest available version at least 3.6.3...

WordPress <= 5.3 - wp_kses_bad_protocol() Colon Bypass vulnerability

wpksesbadprotocol Colon Bypass vulnerability found by WordPress.org Security Team in WordPress versions = 5.3. Solution Update the WordPress to the latest available version at least 5.3.1...

WordPress Google Places Reviews plugin <= 1.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Krishna Harsha Kondaveeti in WordPress Google Places Reviews plugin versions = 1.5.2. Solution Fixed in version 2.0.0, but has been closed as of April 8, 2022 and is not available for download. This closure is temporary,...

WordPress Catch Sticky Menu plugin <= 1.6.3 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress Catch Sticky Menu plugin versions = 1.6.3. Solution Update the WordPress Catch Sticky Menu plugin to the latest available version at least 1.7...

WordPress Spectrum Theme - Remote Code Execution

There are a bug in this theme, that allows any website visitor to run and see the output of any shortcode. This gives unauthenticated visitors the same power to execute code on the server as regular publishers have. Solution Update the theme...

WordPress Google Tag Manager plugin <= 1.15 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Cory Buecker and notstoppable in WordPress Google Tag Manager plugin versions = 1.15. Solution Update the WordPress Google Tag Manager plugin to the latest available version at least 1.15.1...

WordPress RSVPMaker plugin <= 9.2.5 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by Tobias Kay Dala oxnan in WordPress RSVPMaker plugin versions = 9.2.5. Solution Update the WordPress RSVPMaker plugin to the latest available version at least 9.2.6...

WordPress < 7.0.3 - Subscriber+ Site Creation vulnerability

Subscriber+ Site Creation vulnerability discovered by Aikido Security in WordPress core versions 7.0.3...

WordPress Ultimate Member Plugin 2.1.3-2.8.2 is vulnerable to SQL Injection

Software Ultimate Member Type Plugin Vulnerable versions 2.1.3-2.8.2 Fixed in 2.8.3 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-1071 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID d52d7ae096c8 Credits Christiaan Swiers Required privilege...

WordPress DeepL Pro API translation Plugin <= 2.4.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software DeepL Pro API translation Type Plugin Vulnerable versions = 2.4.1.1 Fixed in 2.4.1.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46620 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 93ab7131fcdf Credits thien...

WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Elementor Website Builder versions = 3.29.0...

WordPress Redux Framework plugin <= 4.2.11 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered by Ram Gall WordFence in WordPress Redux Framework plugin versions = 4.2.11. Solution Update the WordPress Redux Framework plugin to the latest available version at least 4.2.13...

WordPress Slider Revolution plugin <= 6.7.36 - Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images' vulnerability

Authenticated Contributor+ Arbitrary File Read via 'usedsvg' and 'usedimages' vulnerability discovered by stealthcopter in WordPress Plugin Slider Revolution versions = 6.7.36...

WordPress Gutenberg plugin <= 14.3.0 - Multiple Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Stored Cross-Site Scripting XSS vulnerabilities via Search, Feature Image, RSS, and Widget blocks were discovered by Alex Concha WP Security team and a third-party audit in the WordPress Gutenberg plugin versions = 14.3.1. Solution Update the WordPress Gutenberg plugin to the latest...

WordPress Use Any Font plugin <= 6.1.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability was discovered by Rasi Afeef Patchstack Alliance in WordPress Use Any Font plugin versions = 6.1.7. Solution Update the WordPress Use Any Font plugin to the latest available version at least 6.1.8...

WordPress Bot for Telegram on WooCommerce plugin <= 1.2.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin Bot for Telegram on WooCommerce versions = 1.2.6...

WordPress KingComposer plugin <= 2.9.6 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Krzysztof Zając in WordPress KingComposer plugin versions = 2.9.6. Solution Deactivate and delete. This plugin has been closed as of February 2, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress 3.7-4.9 - newbloguser Key Bypass

In wp-admin/user-new.php the newbloguser key is set to a string that can be get from the user ID, which allows an attacker to bypass intended access restrictions by entering this string. Solution Update WordPress to 4.9.1...

WordPress TailPress plugin <= 0.4.4 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Anhchangmutrang in WordPress Plugin TailPress versions = 0.4.4...

WordPress Ninja Forms File Uploads Extension premium plugin <= 3.3.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress Ninja Forms File Uploads Extension premium plugin versions = 3.3.0. Solution Update the WordPress Ninja Forms File Uploads Extension premium plugin to the latest available version at least...

WordPress Smart Slider 3 plugin <= 3.5.0.8 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Hardik Solanki in WordPress Smart Slider 3 plugin versions = 3.5.0.8. Solution Update the WordPress Smart Slider 3 plugin to the latest available version at least 3.5.0.9...

NPM: MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

NPM: MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.4...

NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response vulnerability discovered by ? in WordPress Npm react-router versions = 7.12.0, 8.3.0...

WordPress WP SVG Icons plugin <= 3.2.3 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by qerogram in WordPress WP SVG Icons plugin versions = 3.2.3. Solution Deactivate and delete. This plugin has been closed as of April 18, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress WooCommerce plugin <= 5.5.0 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered in WordPress WooCommerce plugin versions = 5.5.0. Solution Update the WordPress WooCommerce plugin to the latest available version at least 5.5.1...

WordPress Flo Launch plugin <= 2.4 - Missing Authentication Allows Full Site Takeover vulnerability

Missing Authentication Allows Full Site Takeover vulnerability discovered by Daniel Ruf in WordPress Flo Launch plugin versions = 2.4. Solution Update the WordPress Flo Launch plugin to the latest available version at least 2.4.1...

WordPress J Cart Upsell and Cross-sell for WooCommerce plugin < 2.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress J Cart Upsell and Cross-sell for WooCommerce plugin versions 2.0.1. Solution Update the WordPress J Cart Upsell and Cross-sell for WooCommerce plugin to the latest available version at least 2.0.1...

WordPress Popup Builder plugin <= 4.0.6 - Local File Inclusion (LFI) leading to Remote Code Execution (RCE)

Local File Inclusion LFI leading to Remote Code Execution RCE discovered by JrXnm in WordPress Popup Builder plugin versions = 4.0.6. Solution Update the WordPress Popup Builder plugin to the latest available version at least 4.0.7...

WordPress LiteSpeed Cache plugin <= 4.4.3 - IP Check Bypass to Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

IP Check Bypass to Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Emil Kylander in WordPress LiteSpeed Cache plugin versions = 4.4.3. Solution Update the WordPress LiteSpeed Cache plugin to the latest available version at least 4.4.4...

WordPress Lenxel Core for Lenxel(LNX) LMS Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Lenxel Core for LenxelLNX LMS Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9270 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID bea8ca18e070 Credits Francesco...

WordPress Form – Contact Form plugin <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Fayçal CHENA in WordPress Form – Contact Form plugin versions = 1.2.4. Solution Deactivate and delete. This plugin has been closed as of June 2, 2022 and is not available for download. This closure is temporary, pending a...

WordPress <=4.9.6 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability found by ripstech in WordPress versions =4.9.6. Solution A new version v4.9.7 including a patch has been released. Please update to 4.9.7 version...

WordPress Chatbot Support AI Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Chatbot Support AI Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6722 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a3c87b3b7064 Credits Kieran Burge Required...

WordPress WordPress Custom Settings Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Custom Settings Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23806 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c898b8c67aa4 Credits Rio Darmawan...

WordPress Cforms Plugin 14.7 - Remote Code Execution

Cforms plugin is prone to a remote code execution vulnerability, because of script does not check remotely cached files properly. Also, it can attack URL. Solution Upgrade the plugin...

WordPress Import any XML or CSV File to WordPress <= 3.6.7 - Authenticated Malicious File Upload vulnerability

Authenticated Malicious File Upload vulnerability discovered by yangkang in WordPress Import any XML or CSV File to WordPress versions = 3.6.7. Solution Update the WordPress Import any XML or CSV File to WordPress plugin to the latest available version at least 3.6.8...

WordPress HC Custom WP-Admin URL plugin <= 1.4 - Unauthenticated Secret URL Disclosure vulnerability

Unauthenticated Secret URL Disclosure vulnerability discovered by Daniel Ruf in WordPress HC Custom WP-Admin URL plugin versions = 1.4. Solution Deactivate and delete. This plugin has been closed as of May 5, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress WS Form Pro premium plugin <= 1.8.175 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Felipe Restrepo Rodriguez in WordPress WS Form Pro premium plugin versions = 1.8.175. Solution Update the WordPress WS Form Pro premium plugin to the latest available version at least 1.8.176...

WordPress Survey Maker Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)

Software Survey Maker Type Plugin Vulnerable versions = 4.9.5 Fixed in 4.9.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8488 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7656cef316d3 Credits Jonas Benjamin Friedli...

WordPress CubeWP Forms – All-in-One Form Builder Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software CubeWP Forms – All-in-One Form Builder Type Plugin Vulnerable versions = 1.1.1 Fixed in 1.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47300 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 126f1788c7ef Credits hunter85...

WordPress Rank Math SEO plugin <= 1.0.95 - Server-Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability was discovered by Rafie Muhammad aka Yeraisci Patchstack Alliance in the WordPress Rank Math SEO plugin versions = 1.0.95. Solution Update the WordPress WordPress SEO Plugin – Rank Math plugin to the latest available version at least 1.0.95.1...

WordPress Team Members plugin <= 5.1.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability was discovered by lucy in the WordPress Team Members plugin versions = 5.1.0. Solution Update the WordPress Team Members plugin to the latest available version at least 5.1.1...

WordPress FooBox Image Lightbox plugin < 2.7.17 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress FooBox Image Lightbox plugin versions 2.7.17. Solution Update the WordPress FooBox Image Lightbox plugin to the latest available version at least 2.7.17...

WordPress Team Members Showcase plugin < 4.4.2 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Team versions 4.4.2...

WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)

Software CodeBard's Patron Button and Widgets for Patreon Type Plugin Vulnerable versions = 2.2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33928 Patch priority Medium CVSS severity Medium 7.1 Developer Codebard PSID f0b671d6d681 Credits Le Ngoc...