WordPress Chat Bubble plugin <= 2.2 - Unauth. Stored Cross-Site Scripting (XSS) vulnerability

Unauth. Stored Cross-Site Scripting XSS vulnerability discovered by Juampa Rodríguez in WordPress Chat Bubble plugin versions = 2.2. Solution Update the WordPress Chat Bubble plugin to the latest available version at least 2.3...

WordPress core <= 6.0.2 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability in the Widget block discovered in WordPress core versions = 6.0.2 Solution Update the WordPress to the latest available version at least 6.0.3...

WordPress Easy Digital Downloads plugin <= 2.11.7 - Arbitrary Post Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Post Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Krzysztof Zając in WordPress Easy Digital Downloads plugin versions = 2.11.7. Solution Update the WordPress Easy Digital Downloads plugin to the latest available version at least 3.0...

WordPress SeoSamba for WordPress Webmasters plugin <= 1.0.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by ptsfence Patchstack Alliance in WordPress SeoSamba for WordPress Webmasters plugin versions = 1.0.5. Solution No patched version is available. No reply from the vendor...

WordPress WP-Polls plugin <= 2.76.0 - Race Condition vulnerability

Race Condition vulnerability leading to voting manipulation discovered by Nguy Minh Tuan Patchstack Alliance in the WordPress WP-Polls plugin versions = 2.76.0. Solution Update the WordPress WP-Polls plugin to the latest available version at least 2.77.0...

WordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to Deletion Of Plugin Tables From Database discovered by Rasi Afeef Patchstack Alliance in WordPress Media Library Folders plugin versions = 7.1.1. Solution Update the WordPress Media Library Folders plugin to the latest available version at...

WordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerability

Unauthenticated Error Log Disclosure vulnerability discovered by Brandon Roldan Patchstack Alliance in WordPress Media Library Assistant plugin versions = 3.00. Solution Update the WordPress Media Library Assistant plugin to the latest available version at least 3.01...

WordPress Import all XML, CSV & TXT plugin <= 6.5.7 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Sanjay Das in WordPress Import all XML, CSV & TXT plugin versions = 6.5.7. Solution Update the WordPress WP Ultimate CSV Importer plugin to the latest available version at least 6.5.8...

WordPress Simple File List plugin <= 4.4.11 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Raad Haddad Cloudyrion GmbH in WordPress Simple File List plugin versions = 4.4.11. Solution Update the WordPress Simple File List plugin to the latest available version at least 4.4.12...

WordPress CPO Shortcodes plugin <= 1.5.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by ptsfence Patchstack Alliance in WordPress CPO Shortcodes plugin versions = 1.5.0 . Solution Deactivate and delete. This plugin has been closed as of September 14, 2022 and is not available for download. This closure is...

WordPress Post SMTP Mailer/Email Log plugin <= 2.1.6 - Authenticated Blind Server-Side Request Forgery (SSRF) vulnerability

Authenticated Blind Server-Side Request Forgery SSRF vulnerability discovered by Raad Haddad Cloudyrion GmbH in WordPress Post SMTP Mailer/Email Log plugin versions = 2.1.6. Solution Update the WordPress Post SMTP Mailer/Email Log plugin to the latest available version at least 2.1.7...

WordPress SVG Support plugin <= 2.4.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Chafik Amraoui in WordPress SVG Support plugin versions = 2.4.2. Solution Update the WordPress SVG Support plugin to the latest available version at least 2.5...

WordPress WHA Crossword plugin <= 1.1.10 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities were discovered by Vlad Vector Patchstack in the WordPress WHA Crossword plugin versions = 1.1.10. Solution Deactivate and delete. No reply from the vendor...

WordPress add2fav plugin <= 1.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by ptsfence Patchstack Alliance in WordPress add2fav plugin versions = 1.0. Solution No patched version available...

WordPress Gettext override translations plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Su Xue Ming in WordPress Gettext override translations plugin versions = 1.0.1. Solution Update the WordPress Gettext override translations plugin to the latest available version at least 2.0.0...

WordPress Zephyr Project Manager plugin <= 3.2.42 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities

Multiple Unauthenticated SQL Injection SQLi vulnerabilities were discovered by Rizacan Tufan in the WordPress Zephyr Project Manager plugin versions = 3.2.42. Solution Update the WordPress Zephyr Project Manager plugin to the latest available version at least 3.2.5...

WordPress Event Calendar – Calendar plugin <= 1.4.6 - Unauthenticated Event Deletion vulnerability

Unauthenticated Event Deletion vulnerability discovered by Nguy Minh Tuan Patchstack Alliance in WordPress Event Calendar – Calendar plugin versions = 1.4.6. Solution Update the WordPress Event Calendar – Calendar plugin to the latest available version at least 1.4.7...

WordPress Fast Flow Plugin <= 1.2.11 - Reflected Stored Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by p7e4 in Fast Flow plugin versions = 1.2.11 Solution Update the WordPress Fast Flow plugin to the latest available version at least 1.2.12...

WordPress Duplicator plugin <= 1.4.7 - Unauthenticated System Information Disclosure vulnerability

Unauthenticated System Information Disclosure vulnerability discovered by Ihsan Sencan in WordPress Duplicator plugin versions = 1.4.7. Solution Update the WordPress Duplicator plugin to the latest available version at least 1.4.7.1...

WordPress Yotpo Reviews for WooCommerce (Unofficial) plugin <= 2.0.4 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Johannes Gangsö in WordPress Yotpo Reviews for WooCommerce Unofficial plugin versions = 2.0.4. Solution Deactivate and delete. This plugin has been closed as of July 27, 2022 and is not available for downloa...

WordPress Automations By Autonami plugin <= 2.1.1 - Automation Creation vulnerability

Automation Creation vulnerability discovered by Krzysztof Zając in WordPress Automations By Autonami plugin versions = 2.1.1. Solution Update the WordPress Automation By Autonami plugin to the latest available version at least 2.1.2...

WordPress Homepage Product Organizer for WooCommerce plugin <= 1.1 - Multiple Authenticated SQL Injection (SQLi) vulnerabilities

Multiple Authenticated SQL Injection SQLi vulnerabilities were discovered by Lenon Leite Patchstack Alliance in the WordPress Homepage Product Organizer for WooCommerce plugin versions = 1.1. Solution No patched version is available. We were unable to contact the vendor...

WordPress Thinkific Uploader plugin <= 1.0.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Raad Haddad in WordPress Thinkific Uploader plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of July 15, 2022 and is not available for download. This closure is temporary, pending a fu...

WordPress User Private Files plugin <= 1.1.2 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Raad Haddad in WordPress User Private Files plugin versions = 1.1.2. Solution Update the WordPress User Private Files plugin to the latest available version at least 1.1.3...

WordPress Shortcode For Current Date plugin <= 2.1.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ryan Dewhurst in WordPress Shortcode For Current Date plugin versions = 2.1.6. Solution Update the WordPress Shortcode for Current Date plugin to the latest available version at least 2.1.7...

WordPress Copyright Proof plugin <= 4.16 - Reflected Cross-Site-Scripting (XSS) vulnerability

Reflected Cross-Site-Scripting XSS vulnerability discovered by cydave in WordPress Copyright Proof plugin versions = 4.16 Solution Deactivate and delete. This plugin has been closed as of June 14, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Shareaholic <= 9.7.5 - Information Disclosure vulnerability

Information Disclosure vulnerability discovered by Brandon James Roldan in WordPress Shareaholic versions = 9.7.5. Solution Update the WordPress Shareaholic plugin to the latest available version at least 9.7.6...

WordPress Image Slider plugin <= 1.1.123 - Cross-Site Request Forgery (CSRF) vulnerability leading to Post Duplication

Cross-Site Request Forgery CSRF vulnerability leading to Post Duplication discovered by Marco Wotschka in WordPress Image Slider plugin versions = 1.1.123. Solution No patched version available...

WordPress Brizy Page Builder plugin <= 2.4.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability via Element URL

Authenticated Stored Cross-Site Scripting XSS vulnerability via Element URL discovered by Vishnupriya Ilango in WordPress Brizy Page Builder plugin versions = 2.4.1. Solution Update the WordPress Brizy – Page Builder plugin to the latest available version at least 2.4.2...

WordPress Cache Images plugin <= 3.2 - Image Upload / Import via Cross-Site Request Forgery (CSRF) vulnerability

Image Upload / Import via Cross-Site Request Forgery CSRF vulnerability was discovered by Daniel Ruf in the WordPress Cache Images plugin versions = 3.2. Solution Update the WordPress Cache Images plugin to the latest available version at least 3.2.1...

WordPress Flexible Shipping plugin <= 4.11.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Flexible Shipping plugin versions = 4.11.8. Solution Update the WordPress Flexible Shipping plugin to the latest available version at least 4.11.9...

WordPress Custom Popup Builder plugin <= 1.3.1 - Improper Access Control vulnerability leading to multiple Authenticated Stored XSS

Improper Access Control vulnerability leading to multiple Authenticated Stored XSS discovered by Ngo Van Thien Patchstack Alliance in WordPress Custom Popup Builder plugin versions = 1.3.1. Solution Deactivate and delete. This plugin has been closed as of May 26, 2022 and is not available for...

WordPress WordPress Security plugin <= 4.2.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Niraj Mahajan in WordPress WordPress Security plugin versions = 4.2.0. Solution Update the WordPress WordPress Security plugin to the latest available version at least 4.2.1...

WordPress miniOrange's Google Authenticator plugin <= 5.5.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Niraj Mahajan in WordPress miniOrange's Google Authenticator plugin versions = 5.5.5. Solution Update the WordPress miniOrange's Google Authenticator plugin to the latest available version at least 5.5.6...

WordPress HTML2WP plugin <= 1.0.0 - Authenticated Arbitrary File Deletion vulnerability

Authenticated Arbitrary File Deletion vulnerability discovered by Daniel Ruf in WordPress HTML2WP plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of May 4, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress OpenBook Book Data plugin <= 3.5.2 - Arbitrary Settings Update to Stored XSS via CSRF vulnerability

Arbitrary Settings Update to Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress OpenBook Book Data plugin versions = 3.5.2. Solution Deactivate and delete. This plugin has been closed as of May 24, 2022 and is not available for download. This closure is temporary, pending a...

WordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.4.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Fayçal CHENA in WordPress Post Grid, Slider & Carousel Ultimate plugin versions = 1.4.3. Solution Update the WordPress Post Grid, Slider & Carousel Ultimate plugin to the latest available version at least 1.5.0...

WordPress Private Messages For WordPress plugin <= 2.1.10 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress Private Messages For WordPress plugin versions = 2.1.10. Solution Deactivate and delete. This plugin has been closed as of May 20, 2022 and is not available for download. This...

WordPress Quick Subscribe plugin <= 1.7.1 - Arbitrary Settings Update via CSRF leading to Stored XSS vulnerability

Arbitrary Settings Update via CSRF to Stored XSS vulnerability discovered by Daniel Ruf in WordPress Quick Subscribe plugin versions = 1.7.1. Solution Deactivate and delete. This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress Change Uploaded File Permissions plugin <= 4.0.0 - File Permission Update via Cross-Site Request Forgery (CSRF) vulnerability

File Permission Update via Cross-Site Request Forgery CSRF vulnerability was discovered by Daniel Ruf in the WordPress Change Uploaded File Permissions plugin versions = 4.0.0. Solution Deactivate and delete. This plugin has been closed as of May 18, 2022 and is not available for download. This...

WordPress LaTeX plugin <= 3.4.10 - Arbitrary Settings Update via CSRF leading to Stored XSS vulnerability

Arbitrary Settings Update via CSRF leading to Stored XSS vulnerability discovered by Daniel Ruf in WordPress LaTeX plugin versions = 3.4.10. Solution Deactivate and delete. This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress RB Internal Links plugin <= 2.0.16 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress RB Internal Links plugin versions = 2.0.16. Solution Deactivate and delete. This plugin has been closed as of May 17, 2022 and is not available for download. This closure is...

WordPress Sticky Popup plugin <= 1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Saeed Alzahrani in WordPress Sticky Popup plugin versions = 1.2. Solution Deactivate and delete. This plugin has been closed as of May 17, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress Peter’s Collaboration E-mails plugin <= 2.2.0 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress Peter’s Collaboration E-mails plugin versions = 2.2.0. Solution Deactivate and delete. This plugin has been closed as of May 17, 2022 and is not available for download. This closure i...

WordPress Newsletter plugin <= 7.4.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Phyo Win Shein in WordPress Newsletter plugin versions = 7.4.4. Solution Update the WordPress Newsletter plugin to the latest available version at least 7.4.5...

WordPress JupiterX premium theme <= 2.0.6 - Insufficient Access Control leading to Authenticated Arbitrary Plugin Deactivation and Settings Modification

Insufficient Access Control leading to Authenticated Arbitrary Plugin Deactivation and Settings Modification discovered by Ramuel Gall Wordfence in WordPress JupiterX premium theme versions = 2.0.6. Solution Update the WordPress JupiterX premium theme to the latest available version at least 2.0....

WordPress Webriti SMTP Mail plugin <= 1.0 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress Webriti SMTP Mail plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of May 13, 2022 and is not available for download. This closure is temporary,...

WordPress iQ Block Country plugin <= 1.2.18 - Protection Bypass due to IP Spoofing vulnerability

Protection Bypass due to IP Spoofing vulnerability discovered by Daniel Ruf in WordPress iQ Block Country plugin versions = 1.2.18. Solution Deactivate and delete. This plugin has been closed as of April 20, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Bestbooks plugin <= 2.6.3 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Bestbooks plugin versions = 2.6.3. Solution Deactivate and delete. This plugin has been closed as of May 11, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Donations plugin <= 1.8 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance WordPress Donations plugin versions = 1.8. Solution Deactivate and delete. This plugin has been closed as of February 28, 2022 and is not available for download. Reason: Security Issue...