WordPress SEO by Yoast Plugin <= 2.0.1 - Cross Site Scripting

This plugin is prone to cross site scripting vulnerability because of misuse of the addqueryarg and removequeryarg functions. Solution Update the plugin...

WordPress Contact List – Easy Business Directory, Staff Directory and Address Book Plugin Plugin < 2.9.73 is vulnerable to Cross Site Scripting (XSS)

Software Contact List – Easy Business Directory, Staff Directory and Address Book Plugin Type Plugin Vulnerable versions 2.9.73 Fixed in 2.9.73 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Tammersoft...

WordPress core <= 6.0.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability via SQL Injection SQLi in Media Library discovered by Ben Bidner WordPress security team and Marc Montpas Automattic in WordPress core versions = 6.0.2. Solution Update the WordPress to the latest available version at least 6.0.3...

WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.7 - Broken Access Control vulnerability leading to &yikes-the-content-toggle option update

Broken Access Control vulnerability leading to &yikes-the-content-toggle option update discovered by Tien Nguyen Anh Patchstack Alliance in WordPress Custom Product Tabs for WooCommerce plugin versions = 1.7.7. Solution Update the WordPress Custom Product Tabs for WooCommerce plugin to the latest...

WordPress Modern Events Calendar Lite plugin <= 6.1.0 - Unauthenticated Blind SQL Injection (SQLi) vulnerability

Unauthenticated Blind SQL Injection SQLi vulnerability discovered by Krzysztof Zając in WordPress Modern Events Calendar Lite plugin versions = 6.1.0. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 6.1.5...

WordPress WPS Hide Login plugin <= 1.5.4.2 - Secret login page location disclosure vulnerability

Secret login page location disclosure vulnerability found by Jerome Bruandet in WordPress WPS Hide Login plugin versions = 1.5.4.2. Solution Update the WordPress WPS Hide Login plugin to the latest available version at least 1.5.5...

WordPress Parallax Theme - File Upload Arbitrary Code Execution

A "themify-ajax.php" file upload arbitrary PHP code execution vulnerability was found in WordPress Parallax theme. Solution Update the theme...

WordPress Blue Memories Plugin <= 1.5 - XSS

Because of this vulnerability in index.php, the attackers can inject arbitrary web script or HTML via the "s" parameter. Solution Update the theme...

WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mamgad in WordPress Plugin PayPlus Payment Gateway versions = 8.2.5...

WordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin GeekyBot versions = 1.2.5...

NPM: npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

NPM: npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining vulnerability discovered by ? in WordPress Npm praisonai versions = 1.2.3, = 1.7.1...

WordPress NextCellent Gallery plugin <= 1.9.35 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by lucy in WordPress NextCellent Gallery plugin versions = 1.9.35. Solution Deactivate and delete. This plugin has been closed as of June 1, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress WPQA premium plugin <= 5.4 - Unauthenticated Private Message Disclosure vulnerability

Unauthenticated Private Message Disclosure vulnerability discovered by Veshraj Ghimire in WordPress WPQA premium plugin versions = 5.4. Solution Update the WordPress WPQA premium plugin to the latest available version at least 5.5...

WordPress Country Selector premium plugin <= 1.6.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Country Selector premium plugin versions = 1.6.5. Solution Update the WordPress Country Selector premium plugin to the latest available version at least 1.6.6...

WordPress JSmol2WP plugin <= 1.07 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability in WordPress JSmol2WP plugin versions = 1.07. Solution 08.01.2019 - we were unable to find a patched version of this plugin. According to WordPess.org plugin repository, this plugin was closed on January 7, 2019 and is no longer available for...

WordPress Everest Forms (Pro) plugin <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion vulnerability

Unauthenticated Path Traversal to Arbitrary File Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Everest Forms Pro versions = 1.9.4...

WordPress WP Contact Slider plugin <= 2.4.7 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress WP Contact Slider plugin versions = 2.4.7. Solution Update the WordPress WP Contact Slider plugin to the latest available version at least 2.4.8...

WordPress SEO URL Redirects LlamasApps plugin <= 2.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress SEO URL Redirects LlamasApps plugin versions = 2.0. Solution No patched version available...

WordPress Custom Map plugin <=1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability found by Nicolas Buzy-Debat in WordPress Custom Map plugin versions =1.1. Solution Dec 20, 2017 - we were unable to find a patched version of this plugin. Uninstall or use it at your own risk...

WordPress Saan World Clock Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)

Software Saan World Clock Type Plugin Vulnerable versions = 1.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0145 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID cb720ac68691 Credits Lana Codes Required...

WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerability

Broken Authentication vulnerability via Nonce Token Leakage Leading to Plugin Settings Change discovered by Dave Jong Patchstack in the WordPress SearchWP premium plugin versions = 4.2.5. Solution Update the WordPress SearchWP plugin to the latest available version at least 4.2.6...

WordPress Oceanwp sticky header plugin <= 1.0.8 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to a header style change discovered by Rasi Afeef Patchstack Alliance in WordPress Oceanwp sticky header plugin versions = 1.0.8. Solution No patched version is available. No reply from the vendor...

WordPress Wordfence Plugin <= 3.8.6 - Stored XSS

This plugin is prone to lib/IPTraf.php User-Agent header stored cross site scripting vulnerability. Solution Update plugin...

WordPress Jetpack plugin 12.0-16.1.2 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Jetpack in WordPress Plugin Jetpack versions 16.1-16.1.2...

NPM: n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

NPM: n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

WordPress Booster for WooCommerce plugin <= 5.6.6 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to Checkout Files Deletion discovered by WPScan in WordPress Booster for WooCommerce plugin versions = 5.6.6. Solution Update the WordPress Booster for WooCommerce plugin to the latest available version at least 5.6.7...

WordPress Advanced Custom Fields plugin <= 5.12.2 - Unauthenticated File Upload vulnerability

Unauthenticated File Upload vulnerability discovered by James Golovich in WordPress Advanced Custom Fields plugin versions = 5.12.2. Solution Update the WordPress Advanced Custom Fields plugin to the latest available version at least 5.12.3...

WordPress Popup Builder plugin <= 4.1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change

Cross-Site Request Forgery CSRF vulnerability leading to Popup Status Change discovered by BEE-K Patchstack in WordPress Popup Builder plugin versions = 4.1.0. Solution Update the WordPress Popup Builder plugin to the latest available version at least 4.1.1...

WordPress Ad Injection plugin <= 1.2.0.19 - Stored Cross-Site Scripting (XSS) & RCE vulnerabilities

Stored Cross-Site Scripting XSS & RCE vulnerabilities discovered by Asif Nawaz Minhas in WordPress Ad Injection plugin versions = 1.2.0.19. Solution Deactivate and delete. This plugin has been closed as of March 18, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress Paid Memberships Pro <= 2.6.6 - Unauthenticated Blind SQL Injection (SQLi) vulnerability

Unauthenticated Blind SQL Injection SQLi vulnerability discovered by Krzysztof Zając in WordPress Paid Memberships Pro versions = 2.6.6. Solution Update the WordPress Paid Memberships Pro to the latest available version at least 2.6.7...

WordPress Enlighten theme <= 1.3.5 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Lenon Leite Patchstack Red Team project in WordPress Enlighten theme versions = 1.3.5. This theme uses a vulnerable piece of code related to previously identified vulnerability - CVE-2021-39317. Solution Deactivate and delete. The vendor ignores t...

WordPress Any Font Plugin <= 2.2.3 - XSS

Because of this vulnerability in mceanyfont/dialog.php, the attackers can inject arbitrary web script or HTML via the "text" parameter. Solution Update the plugin...

WordPress Web Minimalist Theme 1.1 - Cross Site Scripting

WordPress Web Minimalist theme's "index.php" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can ste...

WordPress TimThumb Plugin 1.32 - Remote Code Execution

This TimThumb plugin is prone to a Remote Code Execution vulnerability because script does not check remotely cached files properly. Solution Update this plugin to the latest version or just delete the "timthumb" file...

NPM: 9router: Missing Authorization and OS Command Injection

NPM: 9router: Missing Authorization and OS Command Injection vulnerability discovered by ? in WordPress Npm 9router versions 0.4.44...

WordPress Category Ajax Filter Plugin <= 2.8.2 is vulnerable to Local File Inclusion

Software Category Ajax Filter Type Plugin Vulnerable versions = 2.8.2 Fixed in 2.8.3 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-10871 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 41b4026eef43 Credits Le Ngoc Anh Required privilege...

WordPress Slider Revolution Plugin <= 6.6.20 is vulnerable to Cross Site Scripting (XSS)

Software Slider Revolution Type Plugin Vulnerable versions = 6.6.20 Fixed in 6.7.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2306 Patch priority Low CVSS severity Low 5.9 Developer ThemePunch PSID 25a221b7c033 Credits wesley wcraft Nikolas - md...

WordPress Simple Backup Plugin <= 2.7.10 - Arbitrary File Download

This plugin is prone to an arbitrary file download vulnerability. Solution Update the plugin...

WordPress Sahifa Theme <= 2.4.0 - Multiple Vulnerabilities

This theme is prone to a cross site request forgery and full path disclosure vulnerabilities. Because of CSRF you can lost your site settings. Because of full path disclosure, the attackers can obtain sensitive information via an invalid upload request. Solution Update the theme...

NPM: Facebook React has a Denial of Service Vulnerability in React Server Components

NPM: Facebook React has a Denial of Service Vulnerability in React Server Components discovered by ? in WordPress Npm react-server-dom-webpack versions = 19.0.0, 19.0.6...

WordPress WordPress Automatic plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Automatic versions = 3.115.0...

WordPress is vulnerable to Path Traversal

Software WordPress Type WordPress Core Vulnerable versions 6.5.5 Fixed in 6.5.5 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-32111 Patch priority Low CVSS severity Low 5 Developer Claim ownership PSID f2c038f99720 Credits Rafie Muhammad Patchstack Required...

WordPress Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor Plugin < 1.7.6 is vulnerable to Cross Site Scripting (XSS)

Software Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor Type Plugin Vulnerable versions 1.7.6 Fixed in 1.7.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress VR Calendar plugin < 2.3.1 - Unauthenticated Arbitrary Function Call vulnerability

Unauthenticated Arbitrary Function Call vulnerability discovered by Vinay Varma Mudunuri and Krishna Harsha Kondaveeti in WordPress VR Calendar plugin versions 2.3.1. Solution Update the WordPress VR Calendar plugin to the latest available version at least 2.3.1...

WordPress SP Project & Document Manager plugin <= 4.57 - Sensitive File Disclosure vulnerability

Sensitive File Disclosure vulnerability discovered by Viktor Markopoulos in WordPress SP Project & Document Manager plugin versions = 4.57. Solution Update the WordPress SP Project & Document Manager plugin to the latest available version at least 4.58...

WordPress Database Backup for WordPress plugin <= 2.5.1 - Arbitrary Schedule Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Schedule Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress Database Backup for WordPress plugin versions = 2.5.1. Solution Update the WordPress Database Backup for WordPress plugin to the latest available version at least 2.5.2...

WordPress WPQA premium plugin < 5.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Veshraj Ghimire in WordPress WPQA premium plugin versions 5.4. Solution Update the WordPress WPQA premium plugin to the latest available version at least 5.4...

WordPress All in One WP Migration plugin <= 7.58 - Directory Traversal to File Deletion on Windows Hosts vulnerability

Directory Traversal to File Deletion on Windows Hosts vulnerability discovered by haidv35 Viettel Cyber Security in WordPress All-in-One WP Migration plugin versions = 7.58. Solution Update the WordPress All-in-One WP Migration plugin to the latest available version at least 7.59...

WordPress Yoast SEO <= 17.2.1 - Unauthenticated Full Path Disclosure vulnerability

Unauthenticated Full Path Disclosure vulnerability discovered by Fariq Fadillah Gusti Insani in WordPress Yoast SEO versions = 17.2.1. Solution Update the WordPress Yoast SEO to the latest available version at least 17.3...

WordPress WP Statistics plugin <= 13.1.5 - Unauthenticated Blind SQL Injection (SQLi) vulnerability

Unauthenticated Blind SQL Injection SQLi vulnerability via currentpagetype discovered by Muhammad Zeeshan Xib3rR4dAr in WordPress WP Statistics plugin versions = 13.1.5. Solution Update the WordPress WP Statistics plugin to the latest available version at least 13.1.6...