WordPress Slider Revolution Plugin <= 4.2.2 - XSS

This vulnerability allows an attacker to inject arbitrary web script or HTML via the "clientaction" parameter. Solution Update the plugin...

WordPress WooCommerce Plugin <= 1.3 - Absolute Path Traversal

This vulnerability is in proxy.php in the google currency lookup in the Paypal Currency Converter Basic For WooCommerce plugin. It allows an attacker to read arbitrary files in the "requrl" parameter via a full pathname. Solution Update the plugin...

WordPress Users Ultra Plugin <= 1.5.15 - Multiple SQL Injection

Multiple SQL injection vulnerabilities allow the attackers to execute arbitrary SQL commands via 2 parameters: "datatarget" or "datavote" in a ratingvote wpajaxnoprivratingvote action to wp-admin/admin-ajax.php. Solution Update the plugin...

WordPress Free Counter Plugin 1.1 - Stored XSS

This vulnerability works by using wpajaxnoprivcheckstat action. Any user can perform a stored XSS attack. Solution Upgrade the plugin...

WordPress ClickBank Affiliate Ads plugin <= 1.20 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Kaustubh G. Padwad in WordPress ClickBank Affiliate Ads plugin versions = 1.20. Solution Update the WordPress ClickBank Affiliate Ads plugin to the latest available version at least 1.35...

WordPress TheCartPress Plugin 1.3.9 - Multiple Vulnerabilities

TheCartPress plugin is prone to multiple vulnerabilities, such as local PHP file inclusion, stored XSS, improper access control and multiple XSS vulnerabilities. Solution Update the plugin...

WordPress Simple Ads Manager Plugin - Information Disclosure

Simple Ads Manager plugin is prone to an information disclosure vulnerability via "simple-ads-manager/sam-ajax-admin.php". This vulnerability allows an attacker to obtain sensitive information and in this way lead to further attacks. Solution Upgrade the plugin...

WordPress Apptha Video Gallery Plugin <= 2.7 - SQL Injection

Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "vid" parameter in a rss action to wp-admin/admin-ajax.php. Solution Update the plugin...

WordPress FancyBox Plugin 3.0.2 - Stored XSS

FancyBox plugin is prone to a stored XSS vulnerability that allows to steal cookies or gain privileged access to the affected site. Solution Upgrade the plugin...

WordPress Symposium Plugin 14.11 - Shell Upload

Symposium plugin is prone to a shell upload vulnerability. It allows an attacker to execute arbitrary PHP code by making a direct request to the uploaded .php file. Solution Update the plugin...

WordPress <= 3.9.1 - Unsafe Serialization

wp-includes/class-wp-customize-widgets.php in the widget implementation in allow the attackers to execute arbitrary code via crafted serialized data. Solution Update WordPress...

WordPress Last.FM Rotation Plugin <= 3.3 - Local File Inclusion

Because of this vulnerability in lastfm-proxy.php, the attackers can read arbitrary files in the "snode" parameter. Solution Update the plugin...

WordPress Tom M8te Plugin <= 1.5.3 - Local File Inclusion

Because of this vulnerability, the attackers can read arbitrary files via the "file" parameter to tom-download-file.php. Solution Upgrade the plugin...

WordPress AdRotate Plugin 3.9.4 - SQL Injection

This WordPress AdRotate plugin's clicktracker.php "track param" parameter is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Upgrade the plugin to 3.9.5...

WordPress Advanced Dewplayer Plugin - Script Directory Traversal

Advanced Dewplayer plugin is prone to a directory traversal vulnerability because of failure of cleaning up user-supplied input. An attacker can obtain sensitive information that could aid in further attacks. Solution Upgrade the plugin...

WordPress Download Manager Free & Pro Plugin 2.5.8 - Persistent Cross Site Scripting

Download Manager Free & Pro plugin is prone to a persistent XSS vulnerability. The title input field is not sanitized and therefor vulnerable to persistent cross site scripting. Solution Upgrade the plugin...

WordPress Landing Pages Plugin <=1.2.3 - SQL Injection

Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "post" parameter to index.php. Solution Update the plugin...

WordPress Download Monitor Plugin <= 3.3.6.1 - XSS #2

Because of this vulnerability in admin/admin.php, the attackers can inject arbitrary web script or HTML via the "p" parameter. Solution Update the plugin...

WordPress Digg Digg Plugin <= 5.3.4 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of users for requests that modify settings via unspecified vectors. Solution Update the plugin...

WordPress WP125 Plugin <= 1.4.9 - CSRF

Because of this vulnerability in the adminmenus.php, the attackers can hijack the authentication of administrators for requests that add or edit an ad via unspecified vectors. Solution Update the plugin...

WordPress Smart Flv Plugin - Multiple Cross Site Scripting Vulnerabilities

Smart Flv plugin is prone to multiple cross-site scripting vulnerabilities because of failure to properly clean up user-supplied input. It allows an attacker to execute arbitrary script code in the browser of an user in the context of the affected site. Other attacks are also possible. Solution...

WordPress Organizer Plugin <= 1.2.1 - Multiple XSS

Because of these vulnerabilities in organizer/page/users.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress White Label CMS Plugin <= 1.5 - XSS

Because of this vulnerability in wlcms-plugin.php, the authenticated administrators can inject arbitrary web script or HTML via the "wlcmsodevelopername" parameter. Solution Update the plugin...

WordPress BulletProof Security Plugin <= .47.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the HTTPACCEPTENCODING header. Solution Update the plugin...

WordPress Better WP Security Plugin <= 3.2.4 - Multiple XSS

Because of this vulnerabilities, the attackers can inject arbitrary web script or HTML via unspecified vectors related to "server variables". Solution Update the plugin...

WordPress 2 Click Social Media Buttons Plugin <= 0.33 - XSS

Because of this vulnerability in libs/xing.php, the attackers can inject arbitrary web script or HTML via the "xing-url" parameter. Solution Update the plugin...

WordPress Grand FlAGallery Plugin 1.57 - Cross Site Scripting

WordPress Grand FlAGallery plugin's "flagshow.php" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker c...

WordPress WPtouch Plugin - SQL Injection Vulnerability

WPtouch plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress Elegant Grunge Theme 1.0.3 - Cross Site Scripting

WordPress Elegant Grunge theme's "s" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

WordPress Custom Pages Plugin 0.5.0.1 - Local File Inclusion

This vulnerability can be exploited to include arbitrary files. Solution Update the plugin...

WordPress Processing Embed Plugin 0.5 - Cross-Site Scripting Vulnerability

This Processing Embed plugin's "pluginurl" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal...

WordPress FireStats Plugin <= 1.6.1 - Remote File Inclusion

Because of this vulnerability in firestats-wordpress.php, the attackers can execute arbitrary PHP code via a URL in the "fsjavascript" parameter. Solution Update the plugin...

WordPress Sniplets Plugin <= 1.2.2 - Remote File Inclusion

Because of this vulnerability in modules/syntaxhighlight.php, the attackers can execute arbitrary PHP code via a URL in the "libpath" parameter. Solution Update the plugin...

WordPress Footnotes Plugin <= 2.2 - Multiple XSS vulnerabilities

Because of these vulnerabilities in adminpanel.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress <= 2.0.11 - XSS

Because of this vulnerability in wp-db-backup.php, the attackers can inject arbitrary web script or HTML via the "backup" parameter in a wp-db-backup.php action to wp-admin/edit.php. Solution Update the WordPress...

WordPress <= 2.0.5 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update WordPress...

WordPress <= 2.0.5 - SQL Injection

Because of this vulnerability, the attackers can bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets. Solution Update the WordPress to the latest available version at least 2.0.6...

WordPress Enigma2 Plugin - Remote File Inclusion

Because of this vulnerability, the attackers can execute arbitrary PHP code via a URL in the "boarddir" parameter. Solution Update the plugin...

WordPress Livees Checkout plugin 6.8-7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure vulnerability

Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Livees Checkout versions 6.8-7.0.2...

WordPress Code Snippets plugin < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation vulnerability

Admin+ Network-Scoped Snippet Activation and Deactivation vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Code Snippets versions 3.10.0...

WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Jetpack versions = 16.2...

WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Intrudify in WordPress Plugin Photo Gallery by Supsystic versions = 1.21.0...

WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin EWWW Image Optimizer versions = 8.7.7...

WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rully Miftahur Rozaq in WordPress Plugin Strong Testimonials versions = 3.3.11...

NPM: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab

NPM: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab vulnerability discovered by ? in WordPress Npm electron versions 41.10.4...

WordPress Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin <= 4.8.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Jiemook in WordPress Plugin Wawp versions = 4.8.6...

WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Estatik versions = 4.3.5...

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ElementsKit Elementor addons Lite versions = 4.0.5...

WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate FAQ versions = 2.4.14...

WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerability

WordPress WSP MCP - AI Agents Connector plugin = 2.7.0 - Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WSP MCP AI Agents Connector versions = 2.7.0...