WordPress Another Classifieds Plugin - SQL Injection

This WordPress GD Star Rating plugin's "keywordphrase" parameter is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database when doing a search for classifieds. Solution...

WordPress Tom M8te Plugin <= 1.5.3 - Local File Inclusion

Because of this vulnerability, the attackers can read arbitrary files via the "file" parameter to tom-download-file.php. Solution Upgrade the plugin...

WordPress All Video Gallery Plugin <= 1.2 - SQL Injection

Because of this vulnerability, authenticated administrators can execute arbitrary SQL commands via the "id" parameter. Solution Update the plugin...

WordPress Last.FM Rotation Plugin <= 3.3 - Local File Inclusion

Because of this vulnerability in lastfm-proxy.php, the attackers can read arbitrary files in the "snode" parameter. Solution Update the plugin...

WordPress Contact Form Plugin <= 2.3 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "width" parameter. Solution Update the plugin...

WordPress MailPoet Newsletters Plugin <= 2.6.10 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of arbitrary users. Solution Update the plugin...

WordPress iMember360 Plugin 3.8.012 - 3.9.001 - Multiple Vulnerabilities

WordPress iMember360 plugin is prone to multiple vulnerabilities, such as XSS, arbitrary user deletion, arbitrary code execution and disclosure of database credentials vulnerabilities. Solution Upgrade the plugin...

WordPress BuddyPress Plugin <= 1.9.1 - XSS

Because of this vulnerability, authenticated users can inject arbitrary web script or HTML via the name field to groups/create/step/group-details. Solution Update the plugin...

WordPress <= 3.3.2 - Information Disclosure

Because of this vulnerability, the authenticated users can obtain sensitive information by visiting a draft. Solution Update the plugin...

WordPress Jetpack Plugin <= 2.9.2 - Security BYPASS

This plugin does not properly restrict access to the XML-RPC service. In that way the attackers can bypass intended restrictions and publish posts via unspecified vectors. Solution Update the plugin...

WordPress Download Monitor Plugin <= 3.3.6.1 - XSS #1

Because of this vulnerability in admin/admin.php, the attackers can inject arbitrary web script or HTML via the "sort" parameter. Solution Update the plugin...

WordPress qTranslate Plugin <= 2.5.34 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. Solution Update the plugin...

WordPress Symposium Plugin <= 13.03 - XSS

Because of this vulnerability in invite.php in, the attackers can inject arbitrary web script or HTML via the "u" parameter. Solution Update the plugin...

WordPress <= 3.5.1 - External Entity Injection

Because of this vulnerability, the attackers can read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference. Solution Update the plugin...

WordPress Organizer Plugin <= 1.2.1 - Multiple XSS

Because of these vulnerabilities in organizer/page/users.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress Mingle Forum Plugin <= 1.0.34 - Multiple CSRF

Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests. Solution Update the plugin...

WordPress Nest Theme - SQL Injection

This WordPress Nest theme's "codigo" parameter is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the theme...

WordPress All Video Gallery Plugin 1.1 - SQL Injection Vulnerability

This WordPress All Video Gallery plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress <= 3.4.1 - Multiple vulnerabilities

Multiple vulnerabilities are in the wp-admin/plugins.php. Because of that, remote authenticated users can make unintended plugin changes by leveraging the Administrator role. Solution Update WordPress...

WordPress Organizer Plugin 1.2.1 - Multiple Security Vulnerabilities

WordPress Organizer plugin is prone to a cross-site scripting, information disclosure and directory-traversal vulnerabilities. These vulnerabilities allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the browser, also, disclose sensitive...

WordPress WassUp Plugin <= 1.8.3.0 - XSS

Because of this vulnerability in wassup.php, the attackers can inject arbitrary web script or HTML via the User-Agent HTTP header. Solution Update the plugin...

WordPress Users Plugin <= 1.3 - SQL Injection

Because of this vulnerability in wp-users.php, the attackers can execute arbitrary SQL commands via the "uid" parameter to index.php. Solution Update the plugin...

WordPress Adminimize Plugin 1.7.21 - Cross Site Scripting

WordPress Adminimize plugin's "page" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

WordPress The Erudite Theme <= XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "cpage" parameter. Solution Update the theme...

WordPress F8 Lite Theme 4.2.1 - Cross Site Scripting

WordPress F8 Lite theme's "s" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...

WordPress <= 3.1.2 - Multiple Unspecified Remote vulnerabilities

Because of these vulnerabilities, the attackers can determine usernames of non-authors via canonical redirects. Solution Update WordPress...

WordPress WPtouch Plugin <= 1.9.20 - XSS

Because of this vulnerability in lib/includes/auth.inc.php, the attackers can inject arbitrary web script or HTML via the "wptouchsettings" parameter to include/adsense-new.php. Solution Update the plugin...

WordPress Processing Embed Plugin 0.5 - Cross-Site Scripting Vulnerability

This Processing Embed plugin's "pluginurl" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

WordPress <= 2.8.2 - Multiple Vulnerabilities #1

Because of these vulnerabilities, the attackers can make unauthorized edits or additions via a direct request to edit-category-form.php, edit-pages.php, edit-comments.php, edit-link-category-form.php, or edit.php. Solution Update WordPress...

WordPress <= 2.6.1 - SQL Truncation Vulnerability #2

The attackers can change an arbitrary user's password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability.", because this WordPress does not properly handle MySQL warnings about insertion of username strings...

WordPress Sniplets Plugin <= 1.2.2 - Eval Injection

Because of this vulnerability in modules/execute.php, the attackers can execute arbitrary PHP code via the "text" parameter. Solution Update the plugin...

WordPress PictPress Plugin <= 0.91 - Multiple Directory Traversal

Because of these vulnerabilities in resize.php, the attackers can read arbitrary files in the "size" or "path" parameter. Solution Update the plugin...

WordPress Feed Reader Plugin <= 3.10 - XSS

Because of this vulnerability in the internal browser, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress Vistered Little Theme - XSS

Because of this vulnerability in 404.php, the attackers can inject arbitrary web script or HTML via the URI REQUESTURI that accesses index.php. Solution Update the theme...

WordPress <= 2.2 - SQL Injection

Because of this vulnerability in xmlrpc.php, the authenticated users can execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall. Solution Update WordPress...

WordPress <= 2.1.2 RC2 - XSS

Because of this vulnerability in wp-admin/vars.php, the authenticated users with theme privileges can inject arbitrary web script or HTML via the PATHINFO. Solution Update the WordPress to the latest available version at least 2.1.3...

WordPress <= 1.4.5 - Multiple Vulnerabilities

Becase of these vulnerabilities, the attackers can determine the existence of arbitrary files and possibly read portions of certain files. Solution Update the WordPress to the latest available version at least 1.4.6...

WordPress <=1.5 - SQL injection vulnerability

Because of this vulnerability, attackers can obtain sensitive information. Solution Update WordPress to the latest possible version...

WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability

SQL Injection vulnerability discovered by johska in WordPress Plugin Maps Marker Pro versions = 4.32...

WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability

Path Traversal vulnerability discovered by luc in WordPress Plugin Do Lasso versions = 358...

NPM: n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes

NPM: n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes vulnerability discovered by ? in WordPress Npm n8n versions 2.31.5...

NPM: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

NPM: Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.7.0, 1.18.0...

WordPress WP CTA – Call Now Button, Sticky Button & Call to Action Builder plugin <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection vulnerability

Unauthenticated Time-Based Blind SQL Injection vulnerability discovered by daroo in WordPress Plugin WordPress CTA versions = 2.2.2...

WordPress ICS Calendar plugin <= 12.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin ICS Calendar versions = 12.1.1...

WordPress LoginPress Pro plugin <= 6.2.3 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin LoginPress Pro versions = 6.2.3...

NPM: 9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING

NPM: 9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING vulnerability discovered by ? in WordPress Npm 9router versions = 0.4.55...

WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Blocksy Companion Pro versions = 2.1.46...

NPM: Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory

NPM: Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory vulnerability discovered by ? in WordPress Npm network-ai versions = 5.12.1...

WordPress Newsletters plugin <= 4.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by wesley wcraft in WordPress Plugin Newsletters versions = 4.13...

WordPress All-In-One Security (AIOS) – Security and Firewall plugin <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin All In One WP Security & Firewall versions = 5.4.7...