WordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability

Block BYPASS vulnerability was discovered by Brandon Roldan Patchstack Alliance in the WordPress iQ Block Country plugin versions = 1.2.18. Solution Update the WordPress iQ Block Country plugin to the latest available version at least 1.2.19...

WordPress Customer Reviews for WooCommerce plugin <= 5.3.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to sending of test emails discovered by Muhammad Daffa Patchstack Alliance in WordPress Customer Reviews for WooCommerce plugin versions = 5.3.5. Solution Update the WordPress Customer Reviews for WooCommerce plugin to the latest available...

WordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability was discovered by Lana Codes Patchstack Alliance in the WordPress FavIcon Switcher plugin versions = 1.2.11. Solution Deactivate and delete. This plugin has been closed as of September 19, 2022 and is not available for download. This closure is...

WordPress WP 2FA plugin <= 2.2.1 - Time-Based Side-Channel Attack vulnerability

Time-Based Side-Channel Attack vulnerability discovered by Calvin Alkan in WordPress WP 2FA plugin versions = 2.2.1. Solution Update the WordPress WP 2FA plugin to the latest available version at least 2.3.0...

WordPress Woo Billingo Plus plugin <= 4.4.5.3 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by Lana Codes in the WordPress Woo Billingo Plus plugin versions = 4.4.5.3. Solution Update the WordPress Woo Billingo Plus plugin to the latest available version at least 4.4.5.4...

WordPress Soledad plugin <= 8.2.4 - Reflected Cross-site Scripting (XSS) vulnerability

Reflected Cross-site Scripting XSS vulnerability discovered by Truoc Phan in the WordPress Soledad plugin versions = 8.2.4. Solution Update the WordPress Soledad plugin to the latest available version at least 8.2.5...

WordPress Donation Thermometer plugin <= 2.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Donation Thermometer plugin versions = 2.1.2. Solution Update the WordPress Donation Thermometer plugin to the latest available version at least 2.1.3...

WordPress NinjaForms plugin <= 3.6.12 - Authenticated PHP Objection Injection vulnerability

Authenticated PHP Objection Injection vulnerability discovered by Alessio Santoru in WordPress NinjaForms plugin versions = 3.6.12. Solution Update the WordPress Ninja Forms plugin to the latest available version at least 3.6.13...

WordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress Easy Org Chart plugin versions = 3.1. Solution Deactivate and delete. This plugin has been closed as of July 29, 2022 and is not available for download. This closure is...

WordPress Beaver Builder plugin <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Image URL

Authenticated Stored Cross-Site Scripting XSS vulnerability via Image URL discovered by Zhouyuan Yang in WordPress Beaver Builder plugin versions = 2.5.5.2. Solution Update the WordPress Beaver Builder plugin to the latest available version at least 2.5.5.3...

WordPress WP Users Exporter plugin <= 1.4.2 - CSV Injection vulnerability

CSV Injection vulnerability discovered by Zhouyuan Yang in WordPress WP Users Exporter plugin versions = 1.4.2. Solution Deactivate and delete. This plugin has been closed as of January 8, 2020 and is not available for download. Reason: Security Issue...

WordPress Search Exclude plugin <= 1.2.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Muhammad Daffa Patchstack Alliance in WordPress Search Exclude plugin versions = 1.2.6. Solution Update the WordPress Search Exclude plugin to the latest available version at least 1.2.7...

WordPress Video Gallery plugin <= 1.3.4.5 - Broken Authentication

Broken Authentication leading to cache delete discovered by Muhammad Daffa Patchstck Alliance in WordPress Video Gallery plugin versions = 1.3.4.5. Solution Update the WordPress Video Gallery plugin to the latest available version at least 1.3.5...

WordPress Export All URLs plugin <= 4.3 - Authenticated Arbitrary System File Removal vulnerability

Authenticated Arbitrary System File Removal vulnerability discovered by Raad Haddad in WordPress Export All URLs plugin versions = 4.3. Solution Update the WordPress Export All URLs plugin to the latest available version at least 4.4...

WordPress Rich Reviews by Starfish plugin <= 1.9.14 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to review deletion discovered by Ngo Van Thien Patchstack Alliance in WordPress Rich Reviews by Starfish plugin versions = 1.9.14. Solution No patched version available...

WordPress Social Slider Feed plugin <= 2.0.4 - Authenticated Arbitrary API Key Update vulnerability leading to Stored Cross-Site Scripting (XSS)

Authenticated Arbitrary API Key Update vulnerability leading to Stored Cross-Site Scripting XSS discovered by WPScan in WordPress Social Slider Feed plugin versions = 2.0.4. Solution Update the WordPress Social Slider Feed plugin to the latest available version at least 2.0.5...

WordPress WP Sticky Button plugin <= 1.4.0 - Unauthenticated Arbitrary Settings Update vulnerability leading to Stored Cross-Site Scripting (XSS)

Unauthenticated Arbitrary Settings Update vulnerability leading to Stored Cross-Site Scripting XSS discovered by Krzysztof Zając in WordPress WP Sticky Button plugin versions = 1.4.0. Solution Update the WordPress WP Sticky Button – Click to Chat plugin to the latest available version at least...

WordPress ЮKassa для WooCommerce plugin <= 2.3.0 - Authenticated Arbitrary Settings Update vulnerability

Authenticated Arbitrary Settings Update vulnerability discovered by ptsfence Patchstack Alliance in WordPress ЮKassa для WooCommerce plugin versions = 2.3.0. Solution Update the WordPress ЮKassa для WooCommerce plugin to the latest available version at least 2.3.1...

WordPress Duplicate Page and Post plugin <= 2.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Sachin Kumar eSec Forte Technologies Pvt Ltd in WordPress Duplicate Page and Post plugin versions = 2.7. Solution Update the WordPress Duplicate Page and Post plugin to the latest available version at least 2.8...

WordPress Team plugin <= 1.2.6 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities were discovered by m0ze Patchstack in the WordPress Team plugin versions = 1.2.6. Solution Deactivate and delete. This plugin has been closed as of May 3, 2022 and is not available for download. Reason: Licensing/Trademark...

WordPress mTouch Quiz plugin <= 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Vinay Varma Mudunuri and Krishna Harsha Kondaveeti in WordPress mTouch Quiz plugin versions = 3.1.3. Solution Deactivate and delete. This plugin has been closed as of July 14, 2022 and is not available for download. This...

WordPress WP Comments Fields plugin <= 4.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Rafshanzani Suhada in WordPress WP Comments Fields plugin versions = 4.0. Solution Update the WordPress WordPress Comments Fields plugin to the latest available version at least 4.1...

WordPress Discy premium theme <= 4.9 - Broken Access Control to change settings vulnerability

Broken Access Control to change settings vulnerability discovered by Veshraj Ghimire in WordPress Discy premium theme versions = 4.9. Solution Update the WordPress Discy theme to the latest available version at least 5.0...

WordPress Project Source Code Download plugin <= 1.0.0 - Unauthenticated Backup Download vulnerability

Unauthenticated Backup Download vulnerability discovered by Daniel Ruf in WordPress Project Source Code Download plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of May 4, 2022 and is not available for download. Reason: Security Issue...

WordPress GiveWP plugin <= 2.21.2 - DoS via Cross-Site Request Forgery (CSRF) vulnerability

DoS via Cross-Site Request Forgery CSRF vulnerability discovered by Raad Haddad in WordPress GiveWP plugin versions = 2.21.2. Solution Update the WordPress GiveWP plugin to the latest available version at least 2.21.3...

WordPress Popups plugin <= 1.9.3.8 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Raad Haddad in WordPress Popups plugin versions = 1.9.3.8. Solution Deactivate and delete. This plugin has been closed as of July 5, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Contact Form 7 Captcha plugin <= 0.1.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by ZhongFu Su aka JrXnm WuHan University in WordPress Contact Form 7 Captcha plugin versions = 0.1.1. Solution Update the WordPress Contact Form 7 Captcha plugin to the latest available version at least 0.1.2...

WordPress Admin Management Xtended plugin <= 2.4.4 - Post Visibility/Date/Comment Status Update via CSRF vulnerability

Post Visibility/Date/Comment Status Update via CSRF vulnerability discovered by Daniel Ruf in WordPress Admin Management Xtended plugin versions = 2.4.4. Solution Update the WordPress Admin Management Xtended plugin to the latest available version at least 2.4.5...

WordPress WP Duplicate Page plugin <= 1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Sachin Bahl eSec Forte Technologies Pvt Ltd in WordPress WP Duplicate Page plugin versions = 1.2. Solution Update the WordPress WP Duplicate Page plugin to the latest available version at least 1.3...

WordPress Site Offline or Coming Soon plugin <= 1.6.6 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress Site Offline or Coming Soon plugin versions = 1.6.6. Solution Deactivate and delete. This plugin has been closed as of May 5, 2022 and is not available for download. This closur...

WordPress Flower Delivery by Florist One plugin <= 3.5.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by fuzzyap1 in WordPress Flower Delivery by Florist One plugin versions = 3.5.15. Solution No fixed version is available...

WordPress Modern Events Calendar Lite plugin < 6.3.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Tsutomu Aramaki Mitsui Bussan Secure Directions, Inc in WordPress Modern Events Calendar Lite plugin versions 6.3.0. Solution Fixed in version 6.3.0, but the plugin is closed. This plugin has been closed as of May 11, 2022...

WordPress Rotating Posts plugin <= 1.11 - Arbitrary Settings Update to Stored XSS via CSRF vulnerability

Arbitrary Settings Update to Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress Rotating Posts plugin versions = 1.11. Solution Deactivate and delete. This plugin has been closed as of May 24, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress WPlite plugin <= 1.3.1 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress WPlite plugin versions = 1.3.1. Solution Deactivate and delete. This plugin has been closed as of May 23, 2022 and is not available for download. This closure is temporary, pending a...

WordPress Print, PDF, Email by PrintFriendly plugin <= 5.2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Muhamad Hidayat Solution Update the WordPress Print, PDF, Email by PrintFriendly plugin to the latest available version at least 5.2.3...

WordPress Custom Share Buttons with Floating Sidebar plugin <= 4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Custom Share Buttons with Floating Sidebar plugin versions = 4.1. Solution Update the WordPress Custom Share Buttons with Floating Sidebar plugin to the latest available version at least 4.2...

WordPress New User Email Set Up plugin <= 0.5.2 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress New User Email Set Up plugin versions = 0.5.2. Solution Deactivate and delete. This plugin has been closed as of May 18, 2022 and is not available for download. This closure is...

WordPress Simple Membership plugin <= 4.1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by cydave in WordPress Simple Membership plugin versions = 4.1.0. Solution Update the WordPress Simple Membership plugin to the latest available version at least 4.1.1...

WordPress Themify – WooCommerce Product Filter plugin <= 1.3.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Utkarsh Agrawal in WordPress Themify – WooCommerce Product Filter plugin versions = 1.3.7. Solution Update the WordPress Themify – WooCommerce Product Filter plugin to the latest available version at least 1.3.8...

WordPress Code Snippets Extended plugin <= 1.4.7 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by BEE-K Patchstack in WordPress Code Snippets Extended plugin versions = 1.4.7. Solution Deactivate and delete. No patched version is available. No reply from the vendor...

WordPress Popup Box plugin <= 2.1.2 - Authenticated Local File Inclusion (LFI) vulnerability

Authenticated Local File Inclusion LFI vulnerability discovered by 0xB9 Patchstack Alliance in WordPress Popup Box plugin versions = 2.1.2. Solution Update the WordPress Popup Box plugin to the latest available version at least 2.2...

WordPress Discy premium theme < 5.2 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Bibek Neupane in WordPress Discy premium theme versions 5.2. Solution Update the WordPress Discy premium theme to the latest available version at least 5.2...

WordPress WP Born Babies plugin <= 1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Wejdan Alomari in WordPress WP Born Babies plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of April 27, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress Note Press plugin <= 0.1.10 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability was discovered by Daniel Krohmer and Shi Chen in the WordPress Note Press plugin versions = 0.1.10. Solution Deactivate and delete. This plugin has been closed as of May 12, 2022 and is not available for download. This closure is temporary, pending a...

WordPress Amazon Link plugin <= 3.2.10 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability was discovered by Vinay Varma Mudunuri and Krishna Harsha Kondaveeti in the WordPress Amazon Link plugin versions = 3.2.10. Solution Deactivate and delete. This plugin has been closed as of April 14, 2022 and is not available for download. This closur...

WordPress Enable SVG plugin <= 1.3.1 - Stored Cross-Site Scripting (XSS) vulnerability via SVG

Stored Cross-Site Scripting XSS vulnerability via SVG discovered by Luan Pedersini in WordPress Enable SVG plugin versions = 1.3.1. Solution Update the WordPress Enable SVG plugin to the latest available version at least 1.4.0...

WordPress WP JS plugin <= 2.0.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Marco Wotschka in WordPress WP JS plugin versions = 2.0.6. Solution Deactivate and delete. This plugin has been closed as of April 25, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Themify - Post Type Builder Search Addon premium plugin <= 1.3.9 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Kevin Barbón García, David Álvarez Robles, Francisco Díaz-Pache Alonso & Sergio Corral Cristo in WordPress Themify - Post Type Builder Search Addon premium plugin versions = 1.3.9. Solution Update the WordPress Themify - Post Type...

WordPress Fast Flow plugin <= 1.2.10 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Fast Flow plugin versions = 1.2.10. Solution Update the WordPress Fast Flow plugin to the latest available version at least 1.2.11...

WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.20.95 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Taurus Omar in WordPress Anti-Malware Security and Brute-Force Firewall plugin versions = 4.20.95. Solution Update the WordPress Anti-Malware Security and Brute-Force Firewall plugin to the latest available version at least 4.20.96...