48064 matches found
WordPress Daily Prayer Time plugin <= 2021.10.29 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Daily Prayer Time plugin versions = 2021.10.29. Solution Update the WordPress Daily Prayer Time plugin to the latest available version at least 2022.03.01...
WordPress Church Admin plugin <= 3.4.134 - Unauthenticated Plugin's Backup Disclosure vulnerability
Unauthenticated Plugin's Backup Disclosure vulnerability discovered by cydave in WordPress Church Admin plugin versions = 3.4.134. Solution Update the WordPress Church Admin plugin to the latest available version at least 3.4.135...
WordPress Title Experiments Free plugin <= 9.0 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Title Experiments Free plugin versions = 9.0. Solution Update the WordPress Title Experiments Free plugin to the latest available version at least 9.0.1...
WordPress AI Mojo – GPT-3 Playground for WordPress plugin < 0.2.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress AI Mojo – GPT-3 Playground for WordPress plugin versions 0.2.5. Solution Update the WordPress AI Mojo – GPT-3 Playground for WordPress plugin to the latest available version at least 0.2.5...
WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps plugin <= 1.2.1 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps plugin versions = 1.2.1. Solution Update the WordPress AppExperts – WordPress to Mobile App – WooCommerce to iOs and Android Apps plugin to the latest...
WordPress License Manager for WooCommerce plugin <= 2.2.5 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress License Manager for WooCommerce plugin versions = 2.2.5. Solution Update the WordPress License Manager for WooCommerce plugin to the latest available version at least 2.2.6...
WordPress Royal Elementor Addons (Header Footer Builder, Popups, Post Grid, Woocommerce Product Grid, Slider, Parallax Image, Free Elementor Widgets & Elementor Templates) plugin <= 1.3.32 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Royal Elementor Addons Header Footer Builder, Popups, Post Grid, Woocommerce Product Grid, Slider, Parallax Image, Free Elementor Widgets & Elementor Templates plugin versions = 1.3.32. Solution Update...
WordPress Checkout with Zelle on Woocommerce plugin <= 1.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Checkout with Zelle on Woocommerce plugin versions = 1.0. Solution Update the WordPress Checkout with Zelle on Woocommerce plugin to the latest available version at least 2.0...
WordPress Menu Image, Icons made easy plugin <= 3.0.5 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Menu Image, Icons made easy plugin versions = 3.0.5. Solution Update the WordPress Menu Image, Icons made easy plugin to the latest available version at least 3.0.6...
WordPress Download Woocommerce Category Banner Management plugin <= 2.2.2 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Download Woocommerce Category Banner Management plugin versions = 2.2.2. Solution Update the WordPress Download Woocommerce Category Banner Management plugin to the latest available version at least 2.2.3...
WordPress WP-HR Manager: The Human Resources Plugin for WordPress plugin < 3.0.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP-HR Manager: The Human Resources Plugin for WordPress plugin versions 3.0.3. Solution Update the WordPress WP-HR Manager: The Human Resources Plugin for WordPress plugin to the latest available versi...
WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin <= 1.7.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin versions = 1.7.9. Solution Update the WordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt plugin to the latest available version at least 1.7.91...
WordPress WoowGallery – image gallery / content gallery / ecommerce gallery / social gallery / video gallery / album photo gallery plugin <= 1.1.8 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress WoowGallery – image gallery / content gallery / ecommerce gallery / social gallery / video gallery / album photo gallery plugin versions = 1.1.8. Solution Update the WordPress WoowGallery – image gallery / content gallery /...
WordPress Display WP Admin Pages in the Frontend – WP Frontend Admin plugin < 1.17.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Display WP Admin Pages in the Frontend – WP Frontend Admin plugin versions 1.17.0.4. Solution Update the WordPress Display WP Admin Pages in the Frontend – WP Frontend Admin plugin to the latest...
WordPress Simple Membership plugin <= 4.0.9 - Arbitrary Transaction Deletion via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary Transaction Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Muhamad Hidayat in WordPress Simple Membership plugin versions = 4.0.9. Solution Update the WordPress Simple Membership plugin to the latest available version at least 4.1.0...
WordPress Amelia plugin <= 1.0.45 - Arbitrary Customer Deletion via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary Customer Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Muhamad Hidayat in WordPress Amelia plugin versions = 1.0.45. Solution Update the WordPress Amelia plugin to the latest available version at least 1.0.46...
WordPress BulletProof Security plugin <= 5.7 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Mika in WordPress BulletProof Security plugin versions = 5.7. Solution Update the WordPress BulletProof Security plugin to the latest available version at least 5.8...
WordPress Patreon WordPress plugin <= 1.8.1 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by José Aguilera in WordPress Patreon WordPress plugin versions = 1.8.1. Solution Update the WordPress Patreon WordPress plugin to the latest available version at least 1.8.2...
WordPress Kunze Law plugin <= 1.9 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by fuzzyap1 in WordPress Kunze Law plugin versions = 1.9. Solution Update the WordPress Kunze Law plugin to the latest available version at least 2.1...
WordPress Relevanssi Premium plugin <= 2.16.4 - Unauthorized AJAX Calls vulnerability
Unauthorized AJAX Calls vulnerability discovered by Jan w Oleju in WordPress Relevanssi Premium plugin versions = 2.16.4. Solution Update the WordPress Relevanssi Premium plugin to the latest available version at least 2.16.5...
WordPress WP Review Slider plugin <= 10.9 - SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability discovered by Felipe de Avila in WordPress WP Review Slider plugin versions = 10.9. Solution Update the WordPress WP Review Slider plugin to the latest available version at least 11.0...
WordPress Product Feed PRO for WooCommerce plugin <= 11.2.1 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Product Feed PRO for WooCommerce plugin versions = 11.2.1. Solution Update the WordPress Product Feed PRO for WooCommerce plugin to the latest available version at least 11.2.2...
WordPress WordPress GDPR & CCPA premium plugin <= 1.9.25 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Ace Candelario @0xspade and Victor Paynat-Sautivet 3DS Outscale SOC in WordPress WordPress GDPR & CCPA premium plugin versions = 1.9.25. Solution Update the WordPress WordPress GDPR & CCPA premium plugin to the latest...
WordPress Popup | Custom Popup Builder plugin <= 1.3 - Unauthenticated Denial of Service (DoS) vulnerability
Unauthenticated Denial of Service DoS vulnerability discovered by Felipe de Avila in WordPress Popup | Custom Popup Builder plugin versions = 1.3. Solution Update the WordPress Popup | Custom Popup Builder plugin to the latest available version at least 1.3.1...
WordPress Download Manager plugin <= 3.2.33 - Authenticated SQL injection (SQLi) vulnerability to Reflected XSS vulnerability
Authenticated SQL injection SQLi vulnerability to Reflected XSS vulnerability discovered by Krzysztof ZajÄ…c in WordPress Download Manager plugin versions = 3.2.33. Solution Update the WordPress Download Manager plugin to the latest available version at least 3.2.34...
WordPress Permalink Manager Lite plugin <= 2.2.14 - Unauthorized Reflected Cross-Site Scripting (XSS) vulnerability
Unauthorized Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof ZajÄ…c in WordPress Permalink Manager Lite plugin versions = 2.2.14. Solution Update the WordPress Permalink Manager Lite plugin to the latest available version at least 2.2.15...
WordPress WHMCS Bridge plugin <= 6.1 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered in WordPress WHMCS Bridge plugin versions = 6.1. Solution Update the WordPress WHMCS Bridge plugin to the latest available version at least 6.3...
WordPress Asset CleanUp plugin <= 1.3.8.4 - Reflected Cross-Site Scripting (XSS) vulnerability via AJAX Action
Reflected Cross-Site Scripting XSS vulnerability via AJAX Action discovered by JrXnm in WordPress Asset CleanUp plugin versions = 1.3.8.4. Solution Update the WordPress Asset CleanUp plugin to the latest available version at least 1.3.8.5...
WordPress Orange Form plugin <= 1.0 - SQL Injection (SQLi) via Cross-Site Request Forgery (CSRF) vulnerability
SQL Injection SQLi via Cross-Site Request Forgery CSRF vulnerability discovered by Francesco Carlucci in WordPress Orange Form plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of December 29, 2021 and is not available for download. This closure is temporary,...
WordPress UpdraftPlus plugin <= 1.16.66 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress UpdraftPlus plugin versions = 1.16.66. Solution Update the WordPress UpdraftPlus plugin to the latest available version at least 1.16.69...
WordPress Orders Tracking for WooCommerce plugin <= 1.1.9 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof ZajÄ…c in WordPress Orders Tracking for WooCommerce plugin versions = 1.1.9. Solution Update the WordPress Orders Tracking for WooCommerce plugin to the latest available version at least 1.1.10...
WordPress Simple Download Monitor plugin <= 3.9.10 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Simple Download Monitor plugin versions = 3.9.10. Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.9.11...
WordPress Contest Gallery plugin <= 13.1.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien in WordPress Contest Gallery plugin versions = 13.1.0.9. Solution Update the WordPress Contest Gallery plugin to the latest available version at least 14.0.0...
WordPress .htaccess Redirect plugin <= 0.3.1 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress .htaccess Redirect plugin versions = 0.3.1. Solution Deactivate and delete. This plugin has been closed as of December 3, 2021 and is not available for download. This closure is temporary, pending a full review...
WordPress H5P CSS Editor plugin <= 1.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress H5P CSS Editor plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of December 3, 2021 and is not available for download. This closure is temporary, pending a full review...
WordPress The Monday theme <= 1.4.1 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Lenon Leite Patchstack Red Team project in WordPress The Monday theme versions = 1.4.1. This theme uses a vulnerable piece of code related to previously identified vulnerability - CVE-2021-39317. Solution Deactivate and delete. The vendor ignores...
WordPress Swing Lite theme <= 1.1.9 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Lenon Leite Patchstack Red Team project in WordPress Swing Lite theme versions = 1.1.9. This theme uses a vulnerable piece of code related to previously identified vulnerability - CVE-2021-39317. Solution Deactivate and delete. The vendor ignores...
WordPress Doko theme <= 1.0.27 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Lenon Leite Patchstack Red Team project in WordPress Doko theme versions = 1.0.27. This theme uses a vulnerable piece of code related to previously identified vulnerability - CVE-2021-39317. Solution Deactivate and delete. The vendor ignores the...
WordPress Get Custom Field Values plugin <= 4.0 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Francesco Carlucci in WordPress Get Custom Field Values plugin versions = 4.0. Solution Update the WordPress Get Custom Field Values plugin to the latest available version at least 4.0.1...
WordPress WP Data Access plugin <= 4.3.1 - SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability discovered by JrXnm in WordPress WP Data Access plugin versions = 4.3.1. Solution Update the WordPress WP Data Access plugin to the latest available version at least 5.0.0...
WordPress Download Monitor plugin <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Nguy Minh Tuan in WordPress Download Monitor plugin versions = 4.4.6. Solution Update the WordPress Download Monitor plugin to the latest available version at least 4.4.7...
WordPress WPS Hide Login plugin <= 1.9 - Protection Bypass with Referer-Header vulnerability
Protection Bypass with Referer-Header vulnerability discovered by Daniel Ruf in WordPress WPS Hide Login plugin versions = 1.9. Solution Update the WordPress WPS Hide Login plugin to the latest available version at least 1.9.1...
WordPress eCommerce Product Catalog plugin <= 3.0.38 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress eCommerce Product Catalog plugin versions = 3.0.38. Solution Update the WordPress eCommerce Product Catalog plugin to the latest available version at least 3.0.39...
WordPress Slideshow Gallery plugin <= 1.7.3 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Tyler Miller in WordPress Slideshow Gallery plugin versions = 1.7.3. Solution Update the WordPress Slideshow Gallery plugin to the latest available version at least 1.7.4...
WordPress Advanced Forms plugin <= 1.6.8 - Arbitrary User Email Address Update via IDOR vulnerability
Arbitrary User Email Address Update via IDOR vulnerability discovered by Suppawit Punhakit in WordPress Advanced Forms plugin versions = 1.6.8. Solution Update the WordPress Advanced Forms plugin to the latest available version at least 1.6.9...
WordPress BetterLinks plugin <= 1.2.5 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Huy Nguyen in WordPress BetterLinks plugin versions = 1.2.5. Solution Update the WordPress BetterLinks plugin to the latest available version at least 1.2.6...
WordPress Image to WebP plugin <= 1.8 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by apple502j in WordPress Image to WebP plugin versions = 1.8. Solution Update the WordPress Image to WebP plugin to the latest available version at least 1.9...
WordPress Speed Booster Pack plugin <= 4.3.3 - SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability discovered by Quan, Hoang Xuan in WordPress Speed Booster Pack plugin versions = 4.3.3. Solution Update the WordPress Speed Booster Pack plugin to the latest available version at least 4.3.3.1...
WordPress Simple JWT Login plugin <= 3.2.1 - Insecure Password Creation vulnerability
Insecure Password Creation vulnerability discovered by Zian Choy in WordPress Simple JWT Login plugin versions = 3.2.1. Solution Update the WordPress Simple JWT Login plugin to the latest available version at least 3.3.0...
WordPress MAZ Loader plugin <= 1.3.2 - SQL Injection (SQLi) vulnerabilities
SQL Injection SQLi vulnerabilities discovered by apple502j in WordPress MAZ Loader plugin versions = 1.3.2. Solution Update the WordPress MAZ Loader plugin to the latest available version at least 1.3.3...