WordPress FluentSMTP plugin <= 2.0.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by YoshiKen in WordPress FluentSMTP plugin versions = 2.0.0. Solution Update the WordPress FluentSMTP plugin to the latest available version at least 2.0.1...

WordPress Post Index plugin <= 0.7.5 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Kentaro Kuroki Cryptography Laboratory - Tokyo Denki University in WordPress Post Index plugin versions = 0.7.5. Solution This plugin has been closed as of July 20, 2021 and is not available for...

WordPress Diary & Availability Calendar plugin <= 1.0.3 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Shreya Pohekar in WordPress Diary & Availability Calendar plugin versions = 1.0.3. Solution This plugin has been closed as of May 19, 2021 and is not available for download. Reason: Security Issue...

WordPress Simple Events Calendar plugin <= 1.4.0 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Shreya Pohekar in WordPress Simple Events Calendar plugin versions = 1.4.0. Solution This plugin has been closed as of June 2, 2021 and is not available for download. Reason: Security Issue...

WordPress Workreap premium theme <= 2.2.1 - Missing authorization checks in AJAX actions vulnerability

Missing authorization checks in AJAX actions vulnerability discovered by Harald Eilertsen Jetpack in WordPress Workreap premium theme versions = 2.2.1. Solution Update the WordPress Workreap premium theme to the latest available version at least 2.2.2...

WordPress Profile Builder plugin <= 3.4.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Akash Rajendra Patil in WordPress Profile Builder plugin versions = 3.4.7. Solution Update the WordPress Profile Builder plugin to the latest available version at least 3.4.8...

WordPress ProfilePress plugin 3.0 – 3.1.3 - Arbitrary File Upload in Image Uploader Component vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Chloe Chamberland WordFence in WordPress ProfilePress plugin versions 3.0 – 3.1.3. 06.29.2021 - WordFence updated the vulnerable version to 3.0 - 3.1.3. Solution Update the WordPress ProfilePress plugin to the latest version at leas...

WordPress Browser Screenshots plugin <= 1.7.5 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Browser Screenshots plugin versions = 1.7.5. Solution Update the WordPress Browser Screenshots plugin to the latest available version at least 1.7.6...

WordPress Motor premium theme <= 3.0 - Unauthenticated Local File Inclusion (LFI) vulnerability

Unauthenticated Local File Inclusion LFI vulnerability discovered by Harald Eilertsen JetPack in WordPress Motor premium theme versions = 3.0. Solution Update the WordPress Motor theme to the latest available version at least 3.1...

WordPress Qtranslate Slug plugin <= 1.1.18 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by NinTechNet in WordPress Qtranslate Slug plugin versions = 1.1.18. Solution This plugin has been closed as of February 11, 2021 and is not available for download. Reason: Security Issue...

WordPress Fancy Product Designer premium plugin <= 4.6.8 - Unauthenticated Arbitrary File Upload and Remote Code Execution (RCE) vulnerabilities

Unauthenticated Arbitrary File Upload and Remote Code Execution RCE vulnerabilities discovered by WordFence in WordPress Fancy Product Designer premium plugin versions = 4.6.8. Solution Update the WordPress Fancy Product Designer premium plugin to the latest available version at least 4.6.9...

WordPress Side Menu plugin <= 3.1.3 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Shreya Pohekar in WordPress Side Menu plugin versions = 3.1.3. Solution Update the WordPress Side Menu plugin to the latest available version at least 3.1.5...

WordPress Backup by 10Web – Backup and Restore plugin <= 1.0.20 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by m0ze Patchstack Red Team in WordPress Backup by 10Web – Backup and Restore plugin versions = 1.0.20. Solution This plugin has been closed as of June 2, 2021 and is not available for download. This closure is permanent...

WordPress Speed Booster Pack plugin <= 4.1.3 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by m0ze in WordPress Speed Booster Pack plugin versions = 4.1.3 to be more precise = 4.2.0-beta. Solution Update the WordPress Speed Booster Pack plugin to the latest available version at least 4.2.0...

WordPress Ultimate Member plugin <= 2.1.19 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Riki Aji in WordPress Ultimate Member plugin versions = 2.1.19. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.1.20...

WordPress AcyMailing SMTP Newsletter plugin <= 7.4.1 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by Viktor Markopoulos WordPress AcyMailing SMTP Newsletter plugin versions = 7.4.1. Solution Update the WordPress AcyMailing SMTP Newsletter plugin to the latest available version at least 7.5.0...

WordPress Pods plugin <= 2.7.26 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WhiteSource in WordPress Pods plugin versions = 2.7.26. Solution Update the WordPress Pods plugin to the latest available version at least 2.7.27...

WordPress Store Locator Plus plugin <= 5.5.14 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by WordFence in WordPress Store Locator Plus plugin versions = 5.5.14. Solution Update the WordPress Store Locator Plus plugin to the latest available version at least 5.5.15...

WordPress Redirection for Contact Form 7 plugin <= 2.3.3 - Unprotected AJAX Actions vulnerability

Unprotected AJAX Actions vulnerability discovered by WordFence in WordPress Redirection for Contact Form 7 plugin versions = 2.3.3. Solution Update the WordPress Redirection for Contact Form 7 plugin to the latest available version at least 2.3.4...

WordPress Contact Form by Supsystic plugin <= 1.7.14 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by 0xB9 in WordPress Contact Form by Supsystic plugin versions = 1.7.14. Solution Update the WordPress Contact Form by Supsystic plugin to the latest available version at least 1.7.15...

WordPress Invoicing with InvoiceXpress for WooCommerce plugin <= 3.0.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Frank Liauw in WordPress Invoicing with InvoiceXpress for WooCommerce plugin versions = 3.0.2. Solution Update the WordPress Invoicing with InvoiceXpress for WooCommerce plugin to the latest available version at least...

WordPress Business Directory Plugin <= 5.11.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by 0xB9 in WordPress Business Directory Plugin versions = 5.11.1. Solution Update the WordPress Business Directory Plugin to the latest available version at least 5.11.2...

WordPress Classyfrieds plugin <= 3.8 - Authenticated Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)

Authenticated Arbitrary File Upload vulnerability leading to Remote Code Execution RCE discovered by Jin Huang in WordPress Classyfrieds plugin versions = 3.8. Solution This plugin has been closed as of December 24, 2018 and is not available for download. Reason: Guideline Violation...

WordPress WP Page Builder plugin <= 1.2.3 - Multiple Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Stored Cross-Site Scripting XSS vulnerabilities discovered by WordFence in WordPress WP Page Builder plugin versions = 1.2.3. Solution Update the WordPress WP Page Builder plugin to the latest available version at least 1.2.4...

WordPress WP Page Builder plugin <= 1.2.3 - Insecure Default Configuration vulnerability

Insecure Default Configuration vulnerability discovered by WordFence in WordPress WP Page Builder plugin versions = 1.2.3. Solution Update the WordPress WP Page Builder plugin to the latest available version at least 1.2.4...

WordPress Cooked Pro premium plugin <= 1.7.5.5 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Jinson Varghese Behanan in WordPress Cooked Pro premium plugin versions = 1.7.5.5. Solution Update the WordPress Cooked Pro premium plugin to the latest available version at least 1.7.5.6...

WordPress Listeo premium theme <= 1.6.07 - Authenticated Multiple Insecure Direct Object References (IDOR) vulnerabilities

Multiple Insecure Direct Object References IDOR vulnerabilities discovered by m0ze Patchstack Red Team in the WordPress Listeo premium theme versions = 1.6.07. Solution Update the WordPress Listeo premium theme to the latest available version at least 1.6.11...

WordPress WorkScout premium theme <= 2.0.31 - Cross-Frame Scripting (XFS) vulnerability

Cross-Frame Scripting XFS vulnerability discovered by m0ze Patchstack Red Team in WordPress WorkScout premium theme versions = 2.0.31. Solution Update the WordPress WorkScout premium theme to the latest available version at least 2.0.32...

WordPress WP-Curriculo Vitae Free plugin <= 6.3 - Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)

Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution RCE discovered by Jin Huang in WordPress WP-Curriculo Vitae Free plugin versions = 6.3. Solution Plugin closed. Deactivate and delete...

WordPress WooCommerce Help Scout plugin <= 2.9 - Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)

Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution RCE discovered by Ville Korhonen in WordPress WooCommerce Help Scout plugin versions = 2.9. Solution Update the WordPress WooCommerce Help Scout plugin to the latest available version at least 2.9.1...

WordPress WPS Hide Login plugin <= 1.6.1 - Login Page Protection Bypass vulnerability

Login Page Protection Bypass vulnerability discovered by Sebastian Schmitt in WordPress WPS Hide Login plugin versions = 1.6.1. Solution Update the WordPress WPS Hide Login plugin to the latest available version at least 1.7...

WordPress WP Database Reset plugin <= 3.1 - Unauthenticated Database Reset vulnerability

Unauthenticated Database Reset vulnerability discovered by WordFence in WordPress WP Database Reset plugin versions = 3.1. Solution Update the WordPress WP Database Reset plugin to the latest available version at least 3.15...

WordPress DiveBook plugin <= 1.1.4 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability found by Hooper Labs in WordPress DiveBook plugin versions = 1.1.4. Solution 2020-12-09 - we were unable to find a patched version of this plugin Last updated: 10 years ago...

WordPress Themify Portfolio Post plugin <= 1.1.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Nguyen Anh Tien SunCSR in WordPress Themify Portfolio Post plugin versions = 1.1.5. Solution Update the WordPress Themify Portfolio Post plugin to the latest available version at least 1.1.6...

WordPress AIT CSV Import / Export plugin <= 3.0.3 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability found by Ryan WPScan in WordPress AIT CSV Import / Export plugin versions = 3.0.3. Solution 2020-11-13 - we were unable to find a patched version of this plugin...

WordPress Simple Download Monitor plugin <= 3.8.8 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found by Gen Sato Mitsui Bussan Secure Directions in WordPress Simple Download Monitor plugin versions = 3.8.8 . Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.8.9...

WordPress Dynamic Content for Elementor premium plugin <= 1.9.5.6 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability found by CompuNet in WordPress Dynamic Content for Elementor premium plugin versions = 1.9.5.6. Solution Update the WordPress Dynamic Content for Elementor premium plugin to the latest available version at least 1.9.6...

WordPress WP Courses LMS plugin <= 2.0.28 - Broken Access Controls leading to Courses Content Disclosure vulnerability

Broken Access Controls leading to Courses Content Disclosure vulnerability found by Marco Ortisi redtimmysec in WordPress WP Courses LMS plugin versions = 2.0.28. Solution Update the WordPress WP Courses LMS plugin to the latest available version at least 2.0.29...

WordPress Extra premium theme <= 4.5.2 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by WordFence in WordPress Extra premium theme versions = 4.5.2. Solution Update the WordPress Extra premium theme to the latest available version at least 4.5.3...

WordPress ACF to REST API plugin <= 3.2.0 - Unauthenticated Sensitive Information Disclosure vulnerability

Unauthenticated Sensitive Information Disclosure vulnerability discovered by Mariusz Poplawski in WordPress ACF to REST API plugin versions = 3.2.0. Solution Update the WordPress ACF to REST API plugin to the latest available version at least 3.3.0...

WordPress Advanced Custom Fields plugin <= 5.8.11 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress Advanced Custom Fields plugin versions = 5.8.11. Solution Update the WordPress Advanced Custom Fields plugin to the latest available version at least 5.8.12...

WordPress GTranslate plugin <= 2.8.51 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Gaurav in WordPress GTranslate plugin versions = 2.8.51. Solution Update the WordPress GTranslate plugin to the latest available version at least 2.8.52...

WordPress Page Builder by SiteOrigin plugin <= 2.10.15 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS discovered by WordFence in WordPress Page Builder by SiteOrigin plugin versions = 2.10.15. Solution Update the WordPress Page Builder by SiteOrigin plugin to the latest available version at least 2.10.16...

WordPress Media Library Assistant plugin <= 2.81 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Daniel Monzón stark0de in WordPress Media Library Assistant plugin versions = 2.81. Solution Update the WordPress Media Library Assistant plugin to the latest available version at least 2.82...

WordPress IMPress for IDX Broker plugin <= 2.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress IMPress for IDX Broker plugin versions = 2.6.1. Solution Update the WordPress IMPress for IDX Broker plugin to the latest available version at least 2.6.2...

WordPress 10Web Map Builder for Google Maps <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting (XSS) via Plugin Settings Change vulnerability

Unauthenticated Stored Cross-Site Scripting XSS via Plugin Settings Change vulnerability found by Sean Murphy, QA Lead Matt Rusnak, and QA Engineer Ramuel Gall Wordfence in WordPress 10Web Map Builder for Google Maps = 1.0.63. Solution Update the WordPress 10Web Map Builder for Google Maps plugin...

WordPress Yottis premium theme <= 1.0 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by WordFence in WordPress Yottis premium theme versions = 1.0. Solution Update the WordPress Yottis premium theme to the latest available version at least 1.0.1...

WordPress Login by Auth0 plugin <= 3.11.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by Muhamad Visat in WordPress Login by Auth0 plugin versions = 3.11.2. Solution Update the WordPress Login by Auth0 plugin to the latest available version at least 3.11.3...

WordPress Code Snippets plugin <= 2.13.3 - Cross-Site Request Forgery (CSRF) to Remote Code Execution (RCE) vulnerability

Cross-Site Request Forgery CSRF to Remote Code Execution RCE vulnerability found by Chloe Chamberland in WordPress Code Snippets plugin versions = 2.13.3. Solution Update the WordPress Code Snippets plugin to the latest available version at least 2.14.0...

WordPress Ultimate Member plugin <= 2.1.2 - Insecure Direct Object Reference (IDOR) vulnerability

Insecure Direct Object Reference IDOR vulnerability found in WordPress Ultimate Member plugin versions = 2.1.2. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.1.3...