WordPress Nextend Facebook Connect Plugin 1.4.59 - XSS

Because of a cross-site scripting vulnerability in Nextend Facebook Connect plugin, anyone can change plugin settings. Solution Update the plugin to version 1.5.1...

WordPress XCloner Plugin <= 3.1.1 - Remote Database Download & Local File Permissions

The attackers can obtain sensitive information via a direct request to a backup file in administrators/backups/, because the plugin stores database backup files with predictable names under the web root with insufficient access control. Solution Update the plugin...

WordPress Download Manager Plugin - Arbitrary File Download

Because of this vulnerability, the attackers can read arbitrary files in the "fname" parameter to views/filedownload.php or filedownload.php. Solution Update the plugin...

WordPress Pods Plugin <= 2.4 - Multiple CSRF

Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that conduct cross-site scripting attacks via the "toggled" parameter in the pods-components page to wp-admin/admin.php, reset pod settings and data via the "podsreset" parameter in the...

WordPress Huge IT Image Gallery Plugin 1.0.1 - Authenticated SQL Injection

An authenticated SQL injection allows an attacker to bypass a web application’s authentication mechanism and retrieve the contents of database. Solution Upgrade the plugin...

WordPress WP Content Source Control Plugin - Directory Traversal

This WP Content Source Control plugin is prone to a directory-traversal vulnerability via "download.php". It fails to clean up user-supplied input. Using this plugin allows an attacker to obtain an important information which could aid in further attacks. Solution Upgrade the plugin...

WordPress All Video Gallery Plugin <= 1.2 - SQL Injection

Because of this vulnerability, authenticated administrators can execute arbitrary SQL commands via the "id" parameter. Solution Update the plugin...

WordPress Wordfence Security Plugin <= 5.1.3 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "whoisval" parameter on the WordfenceWhois page to wp-admin/admin.php. Solution Update the plugin...

WordPress Contact Form Plugin <= 2.3 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "width" parameter. Solution Update the plugin...

WordPress Wu Rating Plugin <= 1.0 12319 - XSS

Because of this vulnerability in wu-ratepost.php, the attackers can inject arbitrary web script or HTML via the "v" parameter. Solution Update the plugin...

WordPress TinyMCE Color Picker Plugin <= 1.1 - Security Bypass

Because of this vulnerability, the attackers can modify plugin settings via unspecified vectors. Solution Update the plugin...

WordPress iMember360 Plugin 3.8.012 - 3.9.001 - Multiple Vulnerabilities

WordPress iMember360 plugin is prone to multiple vulnerabilities, such as XSS, arbitrary user deletion, arbitrary code execution and disclosure of database credentials vulnerabilities. Solution Upgrade the plugin...

WordPress <= 3.8.1 - Privilege Escalation

Because of this vulnerability, authenticated users can publish posts. Solution Update the plugin...

WordPress ShareThis Plugin <= 7.0.5 - CSRF

Because of this vulnerability, the attackers can hijack the authentication of administrators for requests that modify this plugin's settings. Solution Update the plugin...

WordPress WP Photo Album Plus Plugin <= 5.0.2 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "commentid" parameter in a wppamanagecomments edit action. Solution Update the plugin...

WordPress Symposium Plugin <= 13.03 - XSS

Because of this vulnerability in invite.php in, the attackers can inject arbitrary web script or HTML via the "u" parameter. Solution Update the plugin...

WordPress WP Table Reloaded Plugin - Cross Site Scripting

WP Table Reloaded plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...

WordPress Sentinel Plugin <= 1.0.0 - CSRF

Because of this vulnerability in wordpresssentinel.php, the attackers can hijack the authentication of an administrator for requests that trigger snapshots. Solution Update the plugin...

WordPress Sentinel Plugin <= 1.0.0 - Cross Site Scripting

Because of this vulnerability in wordpresssentinel.php, the attackers can inject arbitrary web script or HTML via unknown vectors. Solution Update the plugin...

WordPress Organizer Plugin 1.2.1 - Multiple Security Vulnerabilities

WordPress Organizer plugin is prone to a cross-site scripting, information disclosure and directory-traversal vulnerabilities. These vulnerabilities allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the browser, also, disclose sensitive...

WordPress MM Forms Community Plugin 2.2.6 - Arbitrary File Upload

MM Forms Community plugin is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also possible...

WordPress BuddyPress Plugin 1.5.5 - Remote SQL Injection

Buddypress plugin is prone to Remote SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress Bonus Theme 1.0 - Cross Site Scripting

WordPress Bonus theme's "s" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...

WordPress The Erudite Theme <= XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "cpage" parameter. Solution Update the theme...

WordPress Register Plus Plugin <= 3.5.1 - Multiple Vulnerabilities

Because of these vulnerabilities, the attackers can obtain sensitive information via a direct request to dashwidget.php and register-plus.php. Solution Update the plugin...

WordPress Sniplets Plugin <= 1.2.2 - Remote File Inclusion

Because of this vulnerability in modules/syntaxhighlight.php, the attackers can execute arbitrary PHP code via a URL in the "libpath" parameter. Solution Update the plugin...

WordPress WP People Plugin <= 1.6.1 - SQL Injection

Because of this vulnerability, the attackers can execute arbitrary SQL commands via the "person" parameter. Solution Update the plugin...

WordPress Footnotes Plugin <= 2.2 - Multiple XSS vulnerabilities

Because of these vulnerabilities in adminpanel.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress DMSGuestbook Plugin <= 1.7.0 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress WassUp Plugin <= 1.4.3 - Multiple SQL Injection

Because of these vulnerabilities in main.php, the attackers can execute arbitrary SQL commands. Solution Update the plugin...

WordPress <= 2.3 - XSS

Because of this vulnerability in wp-admin/edit-post-rows.php, the attackers can inject arbitrary web script or HTML via the "postscolumns" array parameter. Solution Update WordPress...

WordPress AndyBlue Theme - XSS

Because of this vulnerability in searchform.php, the attackers can inject arbitrary web script or HTML. Solution Update the theme...

WordPress WP Table Plugin <= 1.43 - Remote File Inclusion

Because of this vulnerability, the attackers can execute arbitrary PHP code via a URL in the "wpPATH" parameter. Solution Update the WordPress WP Table plugin to the latest available version at least 1.44...

WordPress myGallery Plugin <= 1.4 - Remote File Inclusion

Because of this vulnerability in myfunctions/mygallerybrowser.php, the attackers can execute arbitrary PHP code via a URL in the "myPath" parameter. Solution Update the WordPress myGallery plugin to the latest available version at least 1.5...

WordPress <= 2.1.2 - SQL Injection vulnerability

Because of this vulnerability in xmlrpc, the authenticated users can execute arbitrary SQL commands. Solution Update the WordPress to the latest available version at least 2.1.3...

WordPress <= 2.0.4 - Denial of Service Attacks

The authenticated users can cause a denial of service attacks, because this WordPress version does not properly store a profile containing a string representation of a serialized object. Solution Update WordPress...

WordPress <= 2.0.3 - Multiple Vulnerabilities

Because of these vulnerabilities, WordPress 2.0.3 and previous versions have unknown impact and remote attack vectors. Solution Update the WordPress to the latest available version at least 2.0.4...

WordPress <= 2.0.2 - Direct Static Code Injection

Because of this vulnerability, the attackers can execute arbitrary commands by inserting a carriage return and PHP code when updating a profile, when it is appended after a special comment sequence into files. Solution Update the WordPress to the latest available version at least 2.0.3...

WordPress <= 2.0.2 - Shell Injection

Because of this vulnerability in vars.php, the attackers can spoof their IP address via a PCREMOTEADDR HTTP header and include a remote file. Solution Update the WordPress to the latest available version at least 2.0.3...

WordPress Livees Checkout plugin 6.8-7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure vulnerability

Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Livees Checkout versions 6.8-7.0.2...

WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Jetpack versions = 16.2...

WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Oly Hossen in WordPress Plugin Review Schema versions = 3.1.0...

WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Intrudify in WordPress Plugin Media LIbrary Assistant versions = 3.41...

WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rully Miftahur Rozaq in WordPress Plugin Strong Testimonials versions = 3.3.11...

WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Safe SVG versions = 2.5.0...

WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by spectreDeveloper in WordPress Plugin Safe SVG versions = 2.5.0...

WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin wpForo Forum versions = 3.1.5...

WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.11...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution vulnerability

Authenticated Subscriber+ PHP Object Injection to Remote Code Execution vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin Tutor LMS versions = 4.0.7...

WordPress Brevo – Email, SMS, Web Push, Chat, and more. plugin <= 3.1.77 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin Brevo versions = 3.1.77...