WordPress eRoom plugin <= 1.3.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Sync with Zoom Meetings

Cross-Site Request Forgery CSRF vulnerability leading to Sync with Zoom Meetings discovered by Ex.Mi Patchstack in WordPress eRoom plugin versions = 1.3.7. Solution Update the WordPress eRoom plugin to the latest available version at least 1.3.8...

WordPress Content Egg plugin <= 5.2.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Content Egg plugin versions = 5.2.0. Solution Update the WordPress Content Egg plugin to the latest available version at least 5.3.0...

WordPress Thank Me Later plugin <= 3.3.4 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability was discovered by Ankur Bakre in WordPress Thank Me Later plugin versions = 3.3.4. Solution Deactivate and delete. This plugin has been closed as of March 24, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Export All URLs plugin <= 4.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Export All URLs plugin versions = 4.1. Solution Update the WordPress Export All URLs plugin to the latest available version at least 4.2...

WordPress LearnPress plugin <= 4.1.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress LearnPress plugin versions = 4.1.5. Solution Update the WordPress LearnPress plugin to the latest available version at least 4.1.6...

WordPress Post Grid plugin <= 2.1.15 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability via posttypes discovered by Krzysztof Zając in WordPress Post Grid plugin versions = 2.1.15. Solution Update the WordPress Post Grid plugin to the latest available version at least 2.1.16...

WordPress Insights from Google PageSpeed plugin <= 4.0.3 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Insights from Google PageSpeed plugin versions = 4.0.3. Solution Update the WordPress Insights from Google PageSpeed plugin to the latest available version at least 4.0.4,...

WordPress RevivePress – Keep your Old Content Evergreen plugin < 1.3.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress RevivePress – Keep your Old Content Evergreen plugin versions 1.3.1. Solution Update the WordPress RevivePress – Keep your Old Content Evergreen plugin to the latest available version at least 1.3.1...

WordPress CodeKit – Custom Codes Editor plugin <= 2.2.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress CodeKit – Custom Codes Editor plugin versions = 2.2.9. Solution Update the WordPress CodeKit – Custom Codes Editor plugin to the latest available version at least 2.3...

WordPress Advanced Contact form 7 DB plugin <= 1.8.6 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Krzysztof Zając in WordPress Advanced Contact form 7 DB plugin versions = 1.8.6. Solution Update the WordPress Advanced Contact form 7 DB plugin to the latest available version at least 1.8.7...

WordPress Team Circle Image Slider With Lightbox plugin <= 1.0.15 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress Team Circle Image Slider With Lightbox plugin versions = 1.0.15. Solution Update the WordPress Team Circle Image Slider With Lightbox plugin to the latest available version at least 1.0.16...

WordPress WP Cerber Security plugin <= 8.9.5 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WP Cerber Security plugin versions = 8.9.5. Solution Update the WordPress WP Cerber Security plugin to the latest available version at least 8.9.6...

WordPress File Upload Pro premium plugin <= 4.16.2 - Contributor+ Stored Cross-Site Scripting (XSS) via Shortcode vulnerability

Contributor+ Stored Cross-Site Scripting XSS via Shortcode vulnerability discovered by apple502j in WordPress File Upload Pro premium plugin versions = 4.16.2. Solution Update the WordPress File Upload Pro premium plugin to the latest available version at least 4.16.3...

WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Spiffy Calendar plugin versions = 4.9.0 by Ngo Van Thien. Solution Update the WordPress Spiffy Calendar plugin to the latest available version at least 4.9.1...

WordPress Spider Calendar plugin <= 1.5.65 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Spider Calendar plugin versions = 1.5.65. Solution Deactivate and delete. This plugin has been closed as of January 13, 2022 and is not available for download. This closure is permanent...

WordPress Mortgage Calculators WP plugin <= 1.55 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Ceylan Bozogullarindan in WordPress Mortgage Calculators WP plugin versions = 1.55. Solution Update the WordPress Mortgage Calculators WP plugin to the latest available version at least 1.56...

WordPress WooCommerce – Store Exporter plugin <= 2.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WooCommerce – Store Exporter plugin versions = 2.7. Solution Update the WordPress WooCommerce – Store Exporter plugin to the latest available version at least 2.7.1...

WordPress IP2Location Country Blocker plugin <= 2.26.4 - Arbitrary Country Ban vulnerability

Arbitrary Country Ban by low privilege users vulnerability discovered by Krzysztof Zając in WordPress IP2Location Country Blocker plugin versions = 2.26.4. Solution Update the WordPress IP2Location Country Blocker plugin to the latest available version at least 2.26.5...

WordPress WHMCS Bridge plugin <= 6.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered in WordPress WHMCS Bridge plugin versions = 6.1. Solution Update the WordPress WHMCS Bridge plugin to the latest available version at least 6.3...

WordPress Advanced Cron Manager Pro premium plugin <= 2.5.2 - Arbitrary Events/Schedules Creation/Deletion vulnerability

Arbitrary Events/Schedules Creation/Deletion vulnerability discovered by Krzysztof Zając in WordPress Advanced Cron Manager Pro premium plugin versions = 2.5.2. Solution Update the WordPress Advanced Cron Manager Pro premium plugin to the latest available version at least 2.5.3...

WordPress UpdraftPlus plugin <= 1.16.66 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress UpdraftPlus plugin versions = 1.16.66. Solution Update the WordPress UpdraftPlus plugin to the latest available version at least 1.16.69...

WordPress The100 theme <= 1.1.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Lenon Leite Patchstack Red Team project in WordPress The100 theme versions = 1.1.2. This theme uses a vulnerable piece of code related to previously identified vulnerability - CVE-2021-39317. Solution Deactivate and delete. The vendor ignores the...

WordPress Advanced Custom Fields: Extended plugin <= 0.8.8.6 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by JrXnm in WordPress Advanced Custom Fields: Extended plugin versions = 0.8.8.6. Solution Update the WordPress Advanced Custom Fields: Extended plugin to the latest available version at least 0.8.8.7...

WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien in WordPress Contest Gallery plugin versions = 13.1.0.9. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 14.0.0...

WordPress Rich Reviews plugin <= 1.9.5 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by bl4derunner in WordPress Rich Reviews plugin versions = 1.9.5. Solution Update the WordPress Rich Reviews plugin to the latest available version at least 1.9.6...

WordPress Uncode Lite theme <= 1.3.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Lenon Leite Patchstack Red Team project in WordPress Uncode Lite theme versions = 1.3.3. This theme uses a vulnerable piece of code related to previously identified vulnerability - CVE-2021-39317. Solution Deactivate and delete. The vendor ignores...

WordPress HTML5 Responsive FAQ plugin <= 2.8.5 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by José Aguilera in WordPress HTML5 Responsive FAQ plugin versions = 2.8.5. Solution Deactivate and delete. This plugin has been closed as of November 23, 2021 and is not available for download. Reason: Security Issue...

WordPress SportsPress – Sports Club & League Manager plugin <= 2.7.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex in WordPress SportsPress – Sports Club & League Manager plugin versions = 2.7.8. Solution Update the WordPress SportsPress – Sports Club & League Manager plugin to the latest available version at least 2.7.9...

WordPress WP Admin Logo Changer plugin <= 1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Plugin Settings Update

Cross-Site Request Forgery CSRF vulnerability leading to Plugin Settings Update discovered by apple502j in WordPress WP Admin Logo Changer plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of October 4, 2021 and is not available for download. This closure is...

WordPress LoginWP plugin <= 3.0.0.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress LoginWP plugin versions = 3.0.0.4. Solution Update the WordPress LoginWP plugin to the latest available version at least 3.0.0.5...

WordPress eCommerce Product Catalog plugin <= 3.0.38 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress eCommerce Product Catalog plugin versions = 3.0.38. Solution Update the WordPress eCommerce Product Catalog plugin to the latest available version at least 3.0.39...

WordPress Ninja Tables plugin <= 4.1.7 - Stored Cross-Site Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Cross-Site Scripting XSS vulnerability discovered by Akash Rajendra Patil in WordPress Ninja Tables plugin versions = 4.1.7. Solution Update the WordPress Ninja Tables plugin to the latest available version at least 4.1.8...

WordPress HAL plugin <= 2.1.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Thinkland Security Team in WordPress HAL plugin versions = 2.1.1. Solution Update the WordPress HAL plugin to the latest available version at least 2.2...

WordPress Batch Cat plugin <= 0.3 - Arbitrary Categories Add/Set/Delete to Posts vulnerability

Arbitrary Categories Add/Set/Delete to Posts vulnerability discovered by Quentin VILLAIN 3wsec in WordPress Batch Cat plugin versions = 0.3. Solution Deactivate and delete. This plugin has been closed as of September 24, 2021 and is not available for download. This closure is temporary, pending a...

WordPress Cookie Bar plugin <= 1.8.8 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by pang0lin in WordPress Cookie Bar plugin versions = 1.8.8. Solution Update the WordPress Cookie Bar plugin to the latest available version at least 1.8.9...

WordPress Gutenberg PDF Viewer Block plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Gutenberg PDF Viewer Block plugin versions = 1.0. Solution Update the WordPress Gutenberg PDF Viewer Block plugin to the latest available version at least 1.0.1...

WordPress Coming soon and Maintenance mode plugin <= 3.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Coming soon and Maintenance mode plugin versions = 3.5.2. Solution Update the WordPress Coming soon and Maintenance mode plugin to the latest available version at least 3.5.3...

WordPress On Page SEO + Whatsapp Chat Button plugin <= 1.0.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress On Page SEO + Whatsapp Chat Button plugin versions = 1.0.1. Solution Update the WordPress On Page SEO + Whatsapp Chat Button plugin to the latest available version at least 1.0.2...

WordPress GeoDirectory plugin <= 2.1.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Thinkland Security Team in WordPress GeoDirectory plugin versions = 2.1.1.2. Solution Update the WordPress GeoDirectory plugin to the latest available version at least 2.1.1.3...

WordPress Real Media Library Lite plugin <= 4.14.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Thinkland Security Team in WordPress Real Media Library Lite plugin versions = 4.14.1. Solution Update the WordPress Real Media Library Lite plugin to the latest available version at least 4.14.2...

WordPress MicroCopy plugin <= 1.1.0 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Syed Sheeraz Ali in WordPress MicroCopy plugin versions = 1.1.0. Solution This plugin has been closed as of May 13, 2021 and is not available for download. Reason: Security Issue...

WordPress Absolutely Glamorous Custom Admin plugin <= 6.8 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Jörgson Patchstack Red Team in WordPress Absolutely Glamorous Custom Admin plugin versions = 6.8. Solution Update the WordPress Absolutely Glamorous Custom Admin plugin to the latest available version at least 6.9, addition...

WordPress GiveWP plugin <= 2.11.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress GiveWP plugin versions = 2.11.3. Solution Update the WordPress GiveWP plugin to the latest available version at least 2.12.0...

WordPress Secure Copy Content Protection and Content Locking plugin <= 2.6.6 - Authenticated Blind SQL Injection (SQLi) vulnerability

Authenticated Blind SQL Injection SQLi vulnerability discovered by To Quang Duong in WordPress Secure Copy Content Protection and Content Locking plugin versions = 2.6.6. Solution Update the WordPress Secure Copy Content Protection and Content Locking plugin to the latest available version at lea...

WordPress ProfilePress plugin <= 3.1.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Vaibhav Koli in WordPress ProfilePress plugin versions = 3.1.7. Solution Update the WordPress ProfilePress plugin to the latest available version at least 3.1.8...

WordPress CiviCRM plugin <= 5.24.2 - Authenticated Phar Deserialization vulnerability

Authenticated Phar Deserialization vulnerability discovered by Dennis Brinkrolf SonarSource in WordPress CiviCRM plugin versions = 5.24.2. Solution Update the WordPress CiviCRM plugin to the latest available version at least 5.24.3...

WordPress WP Reset plugin <= 1.86 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by m0ze in WordPress WP Reset plugin versions = 1.86. Solution Update the WordPress WP Reset plugin to the latest available version at least 1.90...

WordPress Welcart e-Commerce plugin <= 2.2.3 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability discovered by Yu Iwama in WordPress Welcart e-Commerce plugin versions = 2.2.3. Solution Update the WordPress Welcart e-Commerce plugin to the latest available version at least 2.2.4...

WordPress Jannah premium theme <= 5.4.3 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Truoc Phan in WordPress Jannah premium theme versions = 5.4.3. Solution Update the WordPress Jannah premium theme to the latest available version at least 5.4.4...

WordPress Quiz And Survey Master plugin <= 7.1.17 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by renniepak in WordPress Quiz And Survey Master plugin versions = 7.1.17. Solution Update the WordPress Quiz And Survey Master plugin to the latest available version at least 7.1.18...