47760 matches found
WordPress Salon booking system plugin <= 7.6.1 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered by Huli Cymetrics in WordPress Salon booking system plugin versions = 7.6.1. Solution Update the WordPress Salon booking system plugin to the latest available version at least 7.6.3...
WordPress Paid Memberships Pro <= 2.6.6 - Unauthenticated Blind SQL Injection (SQLi) vulnerability
Unauthenticated Blind SQL Injection SQLi vulnerability discovered by Krzysztof ZajÄ…c in WordPress Paid Memberships Pro versions = 2.6.6. Solution Update the WordPress Paid Memberships Pro to the latest available version at least 2.6.7...
WordPress Vision Interactive plugin < 1.5.2 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by WPScanTeam in WordPress Vision Interactive plugin versions 1.5.2. Solution Update the WordPress Vision Interactive plugin to the latest available version at least 1.5.2...
WordPress White Label CMS Plugin <= 1.5.0 - CSRF
Because of this vulnerability in wlcms-plugin.php, the attackers can hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to wp-admin/admin.php. Solution Update the plugin...
WordPress is vulnerable to Path Traversal
Software WordPress Type WordPress Core Vulnerable versions 6.5.5 Fixed in 6.5.5 OWASP Top 10 A1: Broken Access Control Classification Path Traversal CVE CVE-2024-32111 Patch priority Low CVSS severity Low 5 Developer Claim ownership PSID f2c038f99720 Credits Rafie Muhammad Patchstack Required...
WordPress Page View Count plugin <= 2.5.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability leading to plugin settings reset was discovered by Mika Patchstack Alliance in the WordPress Page View Count plugin versions = 2.5.5. Solution Update the WordPress Page View Count plugin to the latest available version at least 2.5.6...
WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.3 - Authenticated Arbitrary File Upload vulnerability
Authenticated Arbitrary File Upload vulnerability discovered by Kim Jong Min aka Universe Patchstack Alliance in WordPress Enable SVG, WebP & ICO Upload plugin versions = 1.0.3. Solution No patched version available...
WordPress PowerPack Lite for Beaver Builder plugin <= 1.2.9.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof ZajÄ…c in WordPress PowerPack Lite for Beaver Builder plugin versions = 1.2.9.2. Solution Update the WordPress PowerPack Lite for Beaver Builder plugin to the latest available version at least 1.2.9.3...
WordPress Perfect Survey plugin <= 1.5.0 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered by apple502j in WordPress Perfect Survey plugin versions = 1.5.0. Solution Vulnerability fixed in 1.5.2 version, but plugin closed due to other security issues. This plugin has been closed as of October 5, 2021 and is not available for...
WordPress WOOCS – WooCommerce Currency Switcher plugin <= 1.3.6.2 - Local File Inclusion (LFI) leading vulnerability to Remote Code Execution (RCE)
Local File Inclusion LFI leading vulnerability to Remote Code Execution RCE discovered by Marc Montpas Automattic in WordPress WOOCS – WooCommerce Currency Switcher plugin versions = 1.3.6.2. Solution Update the WordPress WOOCS – WooCommerce Currency Switcher plugin to the latest available versio...
WordPress <= 5.5.1 - Cross-Site Scripting (XSS) via Global Variables vulnerability
Cross-Site Scripting XSS via Global Variables vulnerability found by Marc Montas in WordPress versions = 5.5.1. Solution Update the WordPress to the latest available version at least 5.5.2...
WordPress All In One WP Security Plugin 3.8.2 - SQL Injection
This WordPress All In One WP Security plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...
NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
NPM: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response vulnerability discovered by ? in WordPress Npm react-router versions = 7.12.0, 8.3.0...
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.8 - SQL Injection vulnerability
SQL Injection vulnerability discovered by daroo in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.8...
WordPress RegistrationMagic Plugin <= 6.0.2.6 is vulnerable to Privilege Escalation
Software RegistrationMagic Type Plugin Vulnerable versions = 6.0.2.6 Fixed in 6.0.2.7 OWASP Top 10 A3: Injection Classification Privilege Escalation CVE CVE-2024-10508 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID fa83ac6f8527 Credits shaman0x01 Required privilege...
WordPress GutenKit Plugin <= 2.1.0 is vulnerable to Arbitrary File Upload
Software GutenKit Type Plugin Vulnerable versions = 2.1.0 Fixed in 2.1.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-9234 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 084e0f3075d0 Credits Sean Murphy Required privilege Unauthenticated...
Drupal Monster Menus module < 9.3.2 - Unauthenticated Multiple Vulnerabilities
Unauthenticated Multiple Vulnerabilities discovered by Dan Wilga in WordPress Module Monster Menus versions 9.3.2...
WordPress Brozzme Scroll Top Plugin <= 1.8.5 is vulnerable to Cross Site Scripting (XSS)
Software Brozzme Scroll Top Type Plugin Vulnerable versions = 1.8.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34426 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 40ba77316890 Credits Cronus Required privilege Administrat...
WordPress BuddyForms Plugin <= 2.8.8 is vulnerable to Arbitrary File Download
Software BuddyForms Type Plugin Vulnerable versions = 2.8.8 Fixed in 2.8.9 OWASP Top 10 A4: Insecure Design Classification Arbitrary File Download CVE CVE-2024-32830 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID df4ae0005bef Credits Yudistira Arya Required privilege...
WordPress EmbedPress Plugin <= 3.9.10 is vulnerable to Cross Site Scripting (XSS)
Software EmbedPress Type Plugin Vulnerable versions = 3.9.10 Fixed in 3.9.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1802 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8bde08f20018 Credits WordFence Required privileg...
WordPress Transposh WordPress Translation plugin <= 1.0.8.1 - Authorization Bypass vulnerability
Authorization Bypass vulnerability discovered by Julien Ahrens in WordPress Transposh WordPress Translation plugin versions = 1.0.8.1. Solution No patched version is available. This plugin has been closed as of February 7, 2022 and is not available for download. Reason: Security Issue...
WordPress Fast Flow Plugin <= 1.2.12 - Authenticated Stored Cross-Site Scripting
Authenticated Stored Cross-Site Scripting vulnerability discovered by Hardik Rathod in Fast Flow plugin versions = 1.2.12 Solution Update the WordPress Fast Flow plugin to the latest available version at least 1.2.13...
WordPress Request a Quote plugin <= 2.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Benachi in WordPress Request a Quote plugin versions = 2.3.7. Solution Deactivate and delete. This plugin has been closed as of June 21, 2022 and is not available for download. This closure is temporary, pending a full revi...
WordPress Subscribe To Comments Reloaded plugin <= 211130 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
Multiple Cross-Site Request Forgery CSRF vulnerabilities discovered by Ex.Mi Patchstack in WordPress Subscribe To Comments Reloaded plugin versions = 211130. Solution Update the WordPress Subscribe To Comments Reloaded plugin to the latest available version at least 220502...
WordPress File Upload plugin <= 4.16.2 - Contributor+ Path Traversal vulnerability leading to Remote Code Execution (RCE)
Contributor+ Path Traversal vulnerability leading to Remote Code Execution RCE discovered by apple502j in WordPress File Upload plugin versions = 4.16.2. Solution Update the WordPress File Upload plugin to the latest available version at least 4.16.3...
WordPress Float menu plugin <= 4.3 - Arbitrary Menu Deletion via Cross-Site Request Forgery (CSRF) vulnerability
Arbitrary Menu Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Krzysztof ZajÄ…c in WordPress Float menu plugin versions = 4.3. Solution Update the WordPress Float menu plugin to the latest available version at least 4.3.1...
WordPress RegistrationMagic plugin <= 5.0.1.5 - SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability discovered by JrXnm in WordPress RegistrationMagic plugin versions = 5.0.1.5. Solution Update the WordPress RegistrationMagic plugin to the latest available version at least 5.0.1.6...
WordPress NEX-Forms – Ultimate Form Builder plugin <= 8.1 - Multiple Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Stored Cross-Site Scripting XSS vulnerabilities were discovered by Shivam Rai in WordPress NEX-Forms – Ultimate Form Builder plugin versions = 8.1. Solution Deactivate and delete. This plugin has been closed as of October 4, 2021 and is not available for download. This closure is...
WordPress Age Gate plugin <= 2.16.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Martin Vierula Trustwave in WordPress Age Gate plugin versions = 2.16.3. Solution Update the WordPress Age Gate plugin to the latest available version at least 2.16.4...
WordPress <= 4.4.1 - CSRF
WordPress before 4.5 is prone to a cross-site request forgery CSRF vulnerability. In the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php file attackers can hijack the authentication of administrators when they change the script compression option. Solution Update WordPress ...
WordPress WPML Plugin <= 3.1.9.1 - Multiple Vulnerabilities
WPML is prone to SQL injection, page or post menu deletion and reflected cross-site scripting vulnerabilities. Solution Update the plugin...
WordPress W3 Total Cache Plugin <= 2.7.5 is vulnerable to Sensitive Data Exposure
Software W3 Total Cache Type Plugin Vulnerable versions = 2.7.5 Fixed in 2.7.6 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-5359 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 553a33ae4238 Credits Ivan Kuzymchak Required...
WordPress Backup Buddy plugin 8.5.8.0 - 8.7.4.1 - Unauthenticated Path Traversal / Arbitrary File Download vulnerability
Unauthenticated Path Traversal / Arbitrary File Download vulnerability discovered by Lew Ayotte & Timothy Jacobs in WordPress Backup Buddy plugin versions 8.5.8.0 - 8.7.4.1. Solution Update the WordPress BackupBuddy plugin to the latest available version at least 8.7.5.0...
WordPress All-in-One WP Migration plugin <= 7.62 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability
Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Team ISH Tecnologia in WordPress All-in-One WP Migration plugin versions = 7.62. Solution Update the WordPress All-in-One WP Migration plugin to the latest available version at least 7.63...
WordPress WC Marketplace Plugin <= 3.8.11.8 - Unauthorized AJAX Calls Vulnerability
Unauthorized AJAX Calls vulnerability discovered by ptsfence in WordPress WC Marketplace plugin versions = 3.8.11.8. Solution Update the WordPress WC Marketplace plugin to the latest available version at least 3.8.12...
WordPress Transposh WordPress Translation plugin <= 1.0.8.1 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered by Julien Ahrens in WordPress Transposh WordPress Translation plugin versions = 1.0.8.1. Solution Deactivate and delete. This plugin has been closed as of February 7, 2022 and is not available for download. Reason: Security Issue...
WordPress ToolBar to Share plugin <= 2.0 - Cross-Site Request Forgery (CSRF) vulnerability to Cross-Site Scripting (XSS)
Cross-Site Request Forgery CSRF vulnerability leading to Cross-Site Scripting XSS discovered by Sho Sakata Cryptography Laboratory at Tokyo Denki University in WordPress ToolBar to Share plugin versions = 2.0. Solution Deactivate and delete. This plugin has been closed as of May 31, 2022 and is n...
WordPress WPCargo Track & Trace plugin <= 6.9.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Raul in WordPress WPCargo Track & Trace plugin versions = 6.9.4. Solution Update the WordPress WPCargo Track & Trace plugin to the latest available version at least 6.9.5...
WordPress wpDataTables plugin <= 2.1.27 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Muhammad Daffa Patchstack Alliance in WordPress wpDataTables plugin versions = 2.1.27. Solution Update the WordPress wpDataTables plugin to the latest available version at least 2.1.28...
WordPress iQ Block Country plugin <= 1.2.12 - Arbitrary File Deletion vulnerability via Zip Slip
Arbitrary File Deletion vulnerability via Zip Slip discovered by Ceylan Bozogullarindan in WordPress iQ Block Country plugin versions = 1.2.12. Solution Update WordPress iQ Block Country plugin to the latest available version at least 1.2.13...
WordPress Ignition premium theme <= 1.59 - Unauthenticated Arbitrary File Upload and Option Deletion
Unauthenticated Arbitrary File Upload and Option Deletion discovered by WordFence in WordPress Ignition premium theme versions = 1.59. Solution Update the WordPress Ignition premium theme to the latest available version at least 2.0.0...
WordPress <= 5.5.1 - Unauthenticated Denial-of-Service (DoS) Attack to Remote Code Execution (RCE) vulnerability
Unauthenticated Denial-of-Service DoS Attack to Remote Code Execution RCE vulnerability found by Omar Ganiev in WordPress versions = 5.5.1. Solution Update the WordPress to the latest available version at least 5.5.2...
WordPress 3.9-5.1 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found by Simon Scannell in WordPress versions 3.9-5.1. Solution Update WordPress to the latest available version at least 5.1.1...
WordPress <=4.7.4 - Host Header Injection in Password Reset
The issue with the SERVERNAME and PHP mail function allow an attacker to trick the WordPress send the password reset crafted wp-login.php?action=lostpassword request mail to the attackers SMTP server. Solution Update WordPress to the latest possible version at least 4.7.5...
WordPress Photo Gallery plugin <= 1.2.100 - SQL Injection
Because of this vulnerability, authenticated users can execute arbitrary SQL commands via "the ascordesc" parameter in the galleriesbwg page to wp-admin/admin.php. Solution Upgrade the plugin...
WordPress Portable phpMyAdmin Plugin - Authentication Bypass
Portable phpMyAdmin plugins is prone to authentication bypass vulnerability. It allows an attacker to gain sensitive information. Solution Upgrade to version 1.3.1...
WordPress WP Flipclock plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin WP Flipclock versions = 1.9.1...
WordPress TailPress plugin <= 0.4.4 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Anhchangmutrang in WordPress Plugin TailPress versions = 0.4.4...
WordPress Widget Options Plugin <= 4.0.7 is vulnerable to Remote Code Execution (RCE)
Software Widget Options Type Plugin Vulnerable versions = 4.0.7 Fixed in 4.0.8 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2024-8672 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 44c40aa090ca Credits Webbernaut Required privilege...
WordPress Contact Form to Any API Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Software Contact Form to Any API Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7617 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8a05dbbe144d Credits Jorgson...