WordPress Contact Form Submissions plugin <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Yoru Oni in WordPress Contact Form Submissions plugin versions = 1.7.2. Solution Update the WordPress Contact Form Submissions plugin to the latest available version at least 1.7.3...

WordPress Login with phone number plugin <= 1.3.6 - Unauthenticated Remote Plugin Deletion vulnerability

Unauthenticated Remote Plugin Deletion vulnerability discovered by Michal Lipinski in WordPress Login with phone number plugin versions = 1.3.6. Solution Update the WordPress Login with phone number plugin to the latest available version at least 1.3.7...

WordPress Powerkit plugin <= 2.5.8 - Post Views Settings Update/Reset via Cross-Site Request Forgery (CSRF) vulnerability

Post Views Settings Update/Reset via Cross-Site Request Forgery CSRF vulnerability discovered by Jan w Oleju in WordPress Powerkit plugin versions = 2.5.8. Solution Update the WordPress Powerkit plugin to the latest available version at least 2.5.9...

WordPress WP Voting Contest plugin <= 2.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Brandon James Roldan in WordPress WP Voting Contest plugin versions = 2.1. Solution Update the WordPress WP Voting Contest plugin to the latest available version at least 3.0...

WordPress Custom Content Shortcode plugin <= 3.8.9 - Unauthorized Arbitrary Post Metadata Access vulnerability

Unauthorized Arbitrary Post Metadata Access vulnerability discovered by Francesco Carlucci in WordPress Custom Content Shortcode plugin versions = 3.8.9. Solution Update the WordPress Custom Content Shortcode plugin to the latest available version at least 4.0.0...

WordPress WS Form LITE plugin <= 1.8.175 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Felipe Restrepo Rodriguez in WordPress WS Form LITE plugin versions = 1.8.175. Solution Update the WordPress WS Form LITE plugin to the latest available version at least 1.8.176...

WordPress Crazy Bone plugin <= 0.6.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Crazy Bone plugin versions = 0.6.0. Solution Deactivate and delete. This plugin has been closed as of January 26, 2022 and is not available for download. This closure is temporary, pending a...

WordPress Superforms premium plugin <= 6.0.3 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Koutrouss Naddara in WordPress Superforms premium plugin versions = 6.0.3. Solution Update the WordPress Superforms premium plugin to the latest available version at least 6.0.4...

WordPress WP Accessibility Helper (WAH) plugin <= 0.6.0.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WP Accessibility Helper WAH plugin versions = 0.6.0.6. Solution Update the WordPress WP Accessibility Helper WAH plugin to the latest available version at least 0.6.0.7...

WordPress Form Store to DB plugin <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Yoru Oni in WordPress Form Store to DB plugin versions = 1.1.0. Solution Update the WordPress Form Store to DB plugin to the latest available version at least 1.1.1...

WordPress Futurio Extra plugin <= 1.6.2 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Jan w Oleju in WordPress Futurio Extra plugin versions = 1.6.2. Possible chained Cross-Site Scripting XSS vulnerability. Solution Update the WordPress Futurio Extra plugin to the latest available version at least 1.6.3...

WordPress Newsletter, SMTP, Email marketing and Subscribe plugin <= 3.1.30 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Newsletter, SMTP, Email marketing and Subscribe plugin versions = 3.1.30. Solution Update the WordPress Newsletter, SMTP, Email marketing and Subscribe plugin to the latest available version at least 3.1.31...

WordPress WP-DownloadManager plugin <= 1.68.5 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Stored Cross-Site Scripting XSS vulnerabilities discovered by Ex.Mi Patchstack in WordPress WP-DownloadManager plugin versions = 1.68.5. Solution Update the WordPress WP-DownloadManager plugin to the latest available version at least 1.68.6...

WordPress Store Toolkit for WooCommerce plugin <= 2.3.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Store Toolkit for WooCommerce plugin versions = 2.3.1. Solution Update the WordPress Store Toolkit for WooCommerce plugin to the latest available version at least 2.3.2...

WordPress Ultimate Reviews plugin <= 3.0.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Red Team project in WordPress Ultimate Reviews plugin versions = 3.0.15. Solution Update the WordPress Ultimate Reviews plugin to the latest available version at least 3.0.16...

WordPress WP Photo Album Plus plugin <= 8.0.9 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WP Photo Album Plus plugin versions = 8.0.9. Solution Update the WordPress WP Photo Album Plus plugin to the latest available version at least 8.0.10...

WordPress WP User Frontend plugin <= 3.5.25 - SQL Injection (SQLi) to Reflected Cross-Site Scripting (XSS)

SQL Injection SQLi to Reflected Cross-Site Scripting XSS discovered by Krzysztof Zając in WordPress WP User Frontend plugin versions = 3.5.25. Solution Update the WordPress WP User Frontend plugin to the latest available version at least 3.5.26...

WordPress Product Feed PRO for WooCommerce plugin <= 11.0.6 - Settings Update to Stored Cross-Site Scripting (XSS) vulnerability

Settings Update to Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Product Feed PRO for WooCommerce plugin versions = 11.0.6. Solution Update the WordPress Product Feed PRO for WooCommerce plugin to the latest available version at least 11.0.7...

WordPress SEUR Oficial plugin <= 1.6.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by José Aguilera in WordPress SEUR Oficial plugin versions = 1.6.0. Solution Update the WordPress SEUR Oficial plugin to the latest available version at least 1.7.0...

WordPress Landing Page Builder plugin <= 1.4.9.5 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Landing Page Builder plugin versions = 1.4.9.5. Solution Update the WordPress Landing Page Builder plugin to the latest available version at least 1.4.9.6...

WordPress Simple Image Gallery plugin <= 1.0.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Simple Image Gallery plugin versions = 1.0.6. Solution Deactivate and delete. This plugin has been closed as of December 3, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Magic Post Voice plugin <= 1.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Magic Post Voice plugin versions = 1.2. Solution Deactivate and delete. This plugin has been closed as of December 3, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress link-list-manager plugin <= 1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress link-list-manager plugin versions = 1.0. Solution Deactivate and delete. This plugin has been closed as of December 3, 2021 and is not available for download. This closure is temporary, pending a full review...

WordPress Button Generator – easily Button Builder plugin <= 2.3.2 - Remote File Inclusion (RFI) leading to Remote Code Execution (RCE) via CSRF vulnerability

Remote File Inclusion RFI leading to Remote Code Execution RCE via CSRF vulnerability discovered by Krzysztof Zając in WordPress Button Generator – easily Button Builder plugin versions = 2.3.2. Solution Update the WordPress Button Generator – easily Button Builder plugin to the latest available...

WordPress Booster for Woocommerce plugin <= 5.4.8 - Reflected Cross-Site Scripting (XSS) vulnerability in General Module

Reflected Cross-Site Scripting XSS vulnerability in PDF Invoicing Module discovered by Jeremie Amsellem in WordPress Booster for Woocommerce plugin versions = 5.4.8. Solution Update the WordPress Booster for Woocommerce plugin to the latest available version at least 5.4.9...

WordPress Asgaros Forum plugin <= 1.15.13 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Mohammed Aadhil Ashfaq in WordPress Asgaros Forum plugin versions = 1.15.13. Solution Update the WordPress Asgaros Forum plugin to the latest available version at least 1.15.14...

WordPress FotoGraphy theme <= 2.4.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Lenon Leite Patchstack Red Team project in WordPress FotoGraphy theme versions = 2.4.0. This theme uses a vulnerable piece of code related to previously identified vulnerability - CVE-2021-39317. Solution Deactivate and delete. The vendor ignores...

WordPress Punte theme <= 1.1.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Lenon Leite Patchstack Red Team project in WordPress Punte theme versions = 1.1.2. This theme uses a vulnerable piece of code related to previously identified vulnerability - CVE-2021-39317. Solution Deactivate and delete. The vendor ignores the...

WordPress Blog2Social plugin <= 6.8.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Blog2Social plugin versions = 6.8.6. Solution Update the WordPress Blog2Social plugin to the latest available version at least 6.8.7...

WordPress Logo Carousel plugin <= 3.4.1 - Unauthorized Private Post Access vulnerability

Unauthorized Private Post Access vulnerability discovered by apple502j in WordPress Logo Carousel plugin versions = 3.4.1. Solution Update the WordPress Logo Carousel plugin to the latest available version at least 3.4.2...

WordPress Temporary Login Without Password plugin <= 1.7.0 - Unauthorized Plugin's Settings Update vulnerability

Unauthorized Plugin's Settings Update vulnerability discovered by apple502j in WordPress Temporary Login Without Password plugin versions = 1.7.0. Solution Update the WordPress Temporary Login Without Password plugin to the latest available version at least 1.7.1...

WordPress Improved Include Page plugin <= 1.2 - Arbitrary Posts/Pages Access vulnerability

Arbitrary Posts/Pages Access vulnerability discovered by Francesco Carlucci in WordPress Improved Include Page plugin versions = 1.2. Solution Deactivate and delete. This plugin has been closed as of October 8, 2021 and is not available for download. This closure is temporary, pending a full revi...

WordPress Pixel Cat plugin <= 2.6.1 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by JrXnm in WordPress Pixel Cat plugin versions = 2.6.1. Solution Update the WordPress Pixel Cat plugin to the latest available version at least 2.6.2...

WordPress Shiny Buttons plugin <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Vishal Mohan in WordPress Shiny Buttons plugin versions = 1.1.0. Solution Deactivate and delete. This plugin has been closed as of September 27, 2021 and is not available for download. This closure is temporary, pending a...

WordPress Caldera Forms plugin <= 1.9.4 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Dhananjay Garg in WordPress Caldera Forms plugin versions = 1.9.4. Solution Update the WordPress Caldera Forms plugin to the latest available version at least 1.9.5...

WordPress Microsoft Clarity plugin <= 0.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Cyber Security Works Pvt. Ltd. in WordPress Microsoft Clarity plugin versions = 0.3. Solution Update the WordPress Microsoft Clarity plugin to the latest available version at least 0.4...

WordPress Support Board premium plugin <= 3.3.5 - Arbitrary File Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary File Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Brandon Roldan in WordPress Support Board premium plugin versions = 3.3.5. Solution Update the WordPress Support Board premium plugin to the latest available version at least 3.3.6...

WordPress Accept Donations with PayPal plugin <= 1.3.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by dc11 in WordPress Accept Donations with PayPal plugin versions = 1.3.1. Solution Update the WordPress Accept Donations with PayPal plugin to the latest available version at least 1.3.2...

WordPress Helpful plugin <= 4.4.58 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Mika in WordPress Helpful plugin versions = 4.4.58. Solution Update the WordPress Helpful plugin to the latest available version at least 4.4.59...

WordPress Testimonial plugin <= 1.5.9 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Testimonial plugin versions = 1.5.9. Solution Update the WordPress Testimonial plugin to the latest available version at least 1.6.0...

WordPress 3DPrint Lite plugin <= 1.9.1.5 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress 3DPrint Lite plugin versions = 1.9.1.5. Solution Update the WordPress 3DPrint Lite plugin to the latest available version at least 1.9.1.6...

WordPress WPSchoolPress plugin <= 2.1.9 - Multiple Authenticated SQL Injections (SQLi) vulnerabilities

Multiple Authenticated SQL Injections SQLi vulnerabilities discovered by JrXnm in WordPress WPSchoolPress plugin versions = 2.1.9. Solution Update the WordPress WPSchoolPress plugin to the latest available version at least 2.1.10...

WordPress Access Demo Importer plugin <= 1.0.6 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Chloe Chamberland WordFence in WordPress Access Demo Importer plugin versions = 1.0.6. Solution Update the WordPress Access Demo Importer plugin to the latest available version at least 1.0.7...

WordPress Visitor Traffic Real Time Statistics plugin <= 3.8 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by JrXnm in WordPress Visitor Traffic Real Time Statistics plugin versions = 3.8. Solution Update the WordPress Visitor Traffic Real Time Statistics plugin to the latest available version at least 3.9...

WordPress WP Bannerize plugin 2.0.0 – 4.0.2 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Margaux Dabert Intrinsec in WordPress WP Bannerize plugin versions = 2.0.0 – 4.0.2. Solution Deactivate and delete. This plugin has been closed as of July 19, 2021 and is not available for download. Reason: Security Issue...

WordPress Stripe For WooCommerce plugin 3.0.0 – 3.3.9 - Missing Authorization Controls to Financial Account Hijacking vulnerability

Missing Authorization Controls to Financial Account Hijacking vulnerability discovered by Margaux DABERT Intrinsec in WordPress Stripe For WooCommerce plugin versions 3.0.0 – 3.3.9. Solution Update the WordPress Stripe For WooCommerce plugin to the latest available version at least 3.3.10...

WordPress Connections Business Directory plugin <= 10.4.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Huy Nguyen in WordPress Connections Business Directory plugin versions = 10.4.2. Solution Update the WordPress Connections Business Directory plugin to the latest available version or at least to the version 10.4.3...

WordPress Special Text Boxes plugin <= 5.9.109 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Akash Rajendra Patil in WordPress Special Text Boxes plugin versions = 5.9.109. Solution Update the WordPress Special Text Boxes plugin to the latest available version at least 5.9.110...

WordPress To Top plugin <= 2.2.2 - Unauthorized Plugin Setting Change vulnerability

Unauthorized Plugin Setting Change vulnerability discovered by apple502j in WordPress To Top plugin versions = 2.2.2. Solution Update the WordPress To Top plugin to the latest available version at least 2.3...

WordPress PlanSo Forms plugin <= 2.6.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Felipe Restrepo Rodriguez in WordPress PlanSo Forms plugin versions = 2.6.3. Solution Deactivate and delete. This plugin has been closed as of August 2, 2021 and is not available for download. Reason: Security Issue...