WordPress Flexible Shipping plugin <= 4.11.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Flexible Shipping plugin versions = 4.11.8. Solution Update the WordPress Flexible Shipping plugin to the latest available version at least 4.11.9...

WordPress Custom Popup Builder plugin <= 1.3.1 - Improper Access Control vulnerability leading to multiple Authenticated Stored XSS

Improper Access Control vulnerability leading to multiple Authenticated Stored XSS discovered by Ngo Van Thien Patchstack Alliance in WordPress Custom Popup Builder plugin versions = 1.3.1. Solution Deactivate and delete. This plugin has been closed as of May 26, 2022 and is not available for...

WordPress OpenBook Book Data plugin <= 3.5.2 - Arbitrary Settings Update to Stored XSS via CSRF vulnerability

Arbitrary Settings Update to Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress OpenBook Book Data plugin versions = 3.5.2. Solution Deactivate and delete. This plugin has been closed as of May 24, 2022 and is not available for download. This closure is temporary, pending a...

WordPress Image Slider by NextCode plugin <= 1.1.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by BEE-K Patchstack in the WordPress Image Slider by NextCode plugin versions = 1.1.2. Solution Deactivate and delete. This plugin has been closed as of May 20, 2022 and is not available for download. This closure is...

WordPress Image Slider by NextCode plugin <= 1.1.2 - Slider Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Slider Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress Image Slider by NextCode plugin versions = 1.1.2. Solution Deactivate and delete. This plugin has been closed as of May 20, 2022 and is not available for download. This...

WordPress Private Messages For WordPress plugin <= 2.1.10 - Sending Messages via Cross-Site Request Forgery (CSRF) vulnerability

Sending Messages via Cross-Site Request Forgery CSRF vulnerability discovered by BEE-K Patchstack in WordPress Private Messages For WordPress plugin versions = 2.1.10. Solution Deactivate and delete. This plugin has been closed as of May 20, 2022 and is not available for download. This closure is...

WordPress WP Statistics plugin <= 13.2.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Shogo Kumamaru LAC CyberLink Co., Ltd in WordPress WP Statistics plugin versions = 13.2.1. Solution Update the WordPress WP Statistics plugin to the latest available version at least 13.2.2...

WordPress postTabs plugin <= 2.10.6 - Arbitrary Settings Update via CSRF vulnerability leading to XSS

Arbitrary Settings Update via CSRF vulnerability leading to XSS discovered by Daniel Ruf in WordPress postTabs plugin versions = 2.10.6. Solution Deactivate and delete. This plugin has been closed as of May 18, 2022 and is not available for download. This closure is temporary, pending a full revi...

WordPress RB Internal Links plugin <= 2.0.16 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress RB Internal Links plugin versions = 2.0.16. Solution Deactivate and delete. This plugin has been closed as of May 17, 2022 and is not available for download. This closure is...

WordPress Newsletter plugin <= 7.4.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Phyo Win Shein in WordPress Newsletter plugin versions = 7.4.4. Solution Update the WordPress Newsletter plugin to the latest available version at least 7.4.5...

WordPress Peter’s Collaboration E-mails plugin <= 2.2.0 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress Peter’s Collaboration E-mails plugin versions = 2.2.0. Solution Deactivate and delete. This plugin has been closed as of May 17, 2022 and is not available for download. This closure i...

WordPress RSVPMaker plugin <= 9.3.2 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability was discovered by Muhammad Zeeshan Xib3rR4dAr in the WordPress RSVPMaker plugin versions = 9.3.2. Solution Update the WordPress RSVPMaker plugin to the latest available version at least 9.3.3...

WordPress Enqueue Anything plugin <= 1.0.1 - Arbitrary Asset/Post Deletion vulnerability

Arbitrary Asset/Post Deletion vulnerability discovered by Abhishek Bhoir in WordPress Enqueue Anything plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of April 26, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress amtyThumb plugin <= 4.2.0 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability was discovered by Daniel Krohmer Fraunhofer IESE, Germany and Shi Chen University of Kaiserslautern, Germany in the WordPress amtyThumb plugin versions = 4.2.0. Solution Deactivate and delete. This plugin has been closed as of May 12, 2022 and is not...

WordPress WooCommerce Green Wallet Gateway plugin <= 1.0.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by goodguyandy in WordPress WooCommerce Green Wallet Gateway plugin versions = 1.0.1. Solution Update the WordPress WooCommerce Green Wallet Gateway plugin to the latest available version at least 1.0.2...

WordPress Simple Real Estate Pack plugin <= 1.4.8 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability was discovered by Vinay Varma Mudunuri and Krishna Harsha Kondaveeti in the WordPress Simple Real Estate Pack plugin versions = 1.4.8. Solution Deactivate and delete. This plugin has been closed as of April 14, 2022 and is not available for download...

WordPress WP 2FA plugin <= 2.2.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Utkarsh Agrawal in WordPress WP 2FA plugin versions = 2.2.0. Solution Update the WordPress WP 2FA plugin to the latest available version at least 2.2.1...

WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload

Unauthenticated Cross-Site Scripting XSS vulnerability via SVG image upload discovered by Ngo Van Thien Patchstack Alliance in WordPress Tripetto plugin versions = 5.1.4. Solution Update the WordPress Tripetto plugin to the latest available version at least 5.2.0...

WordPress Psychological tests & quizzes plugin <= 0.21.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ex.Mi Patchstack in WordPress Psychological tests & quizzes plugin versions = 0.21.19. Solution No patched version is available...

WordPress Gmedia Photo Gallery plugin <= 1.19.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Kaushalendra Dubey in WordPress Gmedia Photo Gallery plugin versions = 1.19.7. Solution Update the WordPress Gmedia Photo Gallery plugin to the latest available version at least 1.20.0...

WordPress WPC Smart Wishlist for WooCommerce plugin <= 2.9.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Utkarsh Agrawal in WordPress WPC Smart Wishlist for WooCommerce plugin versions = 2.9.8. Solution Update the WordPress WPC Smart Wishlist for WooCommerce plugin to the latest available version at least 2.9.9...

WordPress Advanced Image Sitemap plugin <= 1.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Advanced Image Sitemap plugin versions = 1.2. Solution Deactivate and delete. This plugin has been closed as of April 4, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress WP Maintenance plugin <= 6.0.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas Patchstack Alliance in WordPress WP Maintenance plugin versions = 6.0.7. Solution Update the WordPress WP Maintenance plugin to the latest available version at least 6.0.8...

WordPress LifterLMS PayPal plugin <= 1.3.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Brandon James Roldan in WordPress LifterLMS PayPal plugin versions = 1.3.0. Solution Update the WordPress LifterLMS PayPal plugin to the latest available version at least 1.4.0...

WordPress Clipr plugin <= 1.2.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Hassan Khan Yusufzai Splint3r7 in WordPress Clipr plugin versions = 1.2.3. Solution No patched version is available...

WordPress Good & Bad Comments plugin <= 1.0.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Vaibhav Nitin Gaikwad in WordPress Good & Bad Comments plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of March 25, 2022 and is not available for download. This closure is temporary, pending a full...

WordPress Text Hover plugin <= 4.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Rohan Chaudhari in WordPress Text Hover plugin versions = 4.1. Solution Update the WordPress Text Hover plugin to the latest available version at least 4.2...

WordPress Simple Event Planner plugin <= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress Simple Event Planner plugin versions = 1.5.4. Solution Update the WordPress Simple Event Planner plugin to the latest available version at least 1.5.5...

WordPress WP Downgrade plugin <= 1.2.2 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Taurus Omar in WordPress WP Downgrade plugin versions = 1.2.2. Solution Update the WordPress WP Downgrade plugin to the latest available version at least 1.2.3...

WordPress Elasta theme < 1.0.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Elasta theme versions 1.0.8. Solution Update the WordPress Elasta theme to the latest available version at least 1.0.8...

WordPress AI Mojo – GPT-3 Playground for WordPress plugin < 0.2.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress AI Mojo – GPT-3 Playground for WordPress plugin versions 0.2.5. Solution Update the WordPress AI Mojo – GPT-3 Playground for WordPress plugin to the latest available version at least 0.2.5...

WordPress RevivePress – Keep your Old Content Evergreen plugin < 1.3.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress RevivePress – Keep your Old Content Evergreen plugin versions 1.3.1. Solution Update the WordPress RevivePress – Keep your Old Content Evergreen plugin to the latest available version at least 1.3.1...

WordPress DIVI Enhancer – DIVI Modules and Options plugin <= 5.0.9 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress DIVI Enhancer – DIVI Modules and Options plugin versions = 5.0.9. Solution No patched version available...

WordPress F4 Post Tree plugin <= 1.1.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress F4 Post Tree plugin versions = 1.1.8. Solution Update the WordPress F4 Post Tree plugin to the latest available version at least 1.1.9...

WordPress Projectopia – WordPress Project Management Plugin plugin < 5.0.7 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Projectopia – WordPress Project Management Plugin plugin versions 5.0.7. Solution Update the WordPress Projectopia – WordPress Project Management Plugin plugin to the latest available version at least 5.0.7...

WordPress Impexium Single Sign On plugin <= 1.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Impexium Single Sign On plugin versions = 1.1. Solution No patched version available...

WordPress Display WP Admin Pages in the Frontend – WP Frontend Admin plugin < 1.17.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Display WP Admin Pages in the Frontend – WP Frontend Admin plugin versions 1.17.0.4. Solution Update the WordPress Display WP Admin Pages in the Frontend – WP Frontend Admin plugin to the latest...

WordPress LawPress – Law Firm Website Management plugin <= 1.4.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress LawPress – Law Firm Website Management plugin versions = 1.4.4. Solution Update the WordPress LawPress – Law Firm Website Management plugin to the latest available version at least 1.4.5...

WordPress Prime Slider – Addons For Elementor plugin <= 2.6.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Prime Slider – Addons For Elementor plugin versions = 2.6.2. Solution Update the WordPress Prime Slider – Addons For Elementor plugin to the latest available version at least 2.7.0...

WordPress Stripe Express plugin < 1.7.7 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Stripe Express plugin versions 1.7.7. Solution Update the WordPress Stripe Express plugin to the latest available version at least 1.7.7...

WordPress Premmerce Product Filter for WooCommerce plugin <= 3.6.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Premmerce Product Filter for WooCommerce plugin versions = 3.6.1. Solution Update the WordPress Premmerce Product Filter for WooCommerce plugin to the latest available version at least 3.6.2...

WordPress GDMylist plugin <= 1.1.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by fuzzyap1 in WordPress GDMylist plugin versions = 1.1.1. Solution Deactivate and delete. This plugin has been closed as of February 15, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress CommonsBooking plugin <= 2.6.7 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress CommonsBooking plugin versions = 2.6.7. Solution Update the WordPress CommonsBooking plugin to the latest available version at least 2.6.8...

WordPress Contact Form Submissions plugin <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Yoru Oni in WordPress Contact Form Submissions plugin versions = 1.7.2. Solution Update the WordPress Contact Form Submissions plugin to the latest available version at least 1.7.3...

WordPress Simple Quotation plugin <= 1.3.2 - Quote Creation/Edition via CSRF vulnerability leading to Stored Cross-Site Scripting (XSS)

Quote Creation/Edition via CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Abhishek Bhoir in WordPress Simple Quotation plugin versions = 1.3.2. Solution Deactivate and delete. This plugin has been closed as of January 7, 2022 and is not available for download. This...

WordPress Better WordPress Google XML Sitemaps plugin <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Better WordPress Google XML Sitemaps plugin versions = 1.4.1. Solution Deactivate and delete. This plugin has been closed as of February 14, 2022 and is not available for download. This closur...

WordPress WP Voting Contest plugin <= 2.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Brandon James Roldan in WordPress WP Voting Contest plugin versions = 2.1. Solution Update the WordPress WP Voting Contest plugin to the latest available version at least 3.0...

WordPress CP Blocks plugin <= 1.0.14 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Shweta Mahajan in WordPress CP Blocks plugin versions = 1.0.14. Solution Update the WordPress CP Blocks plugin to the latest available version at least 1.0.15...

WordPress WP Email Users plugin <= 1.7.6 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by Krzysztof Zając in WordPress WP Email Users plugin versions = 1.7.6. Solution Deactivate and delete. This plugin has been closed as of January 31, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress WP Accessibility Helper (WAH) plugin <= 0.6.0.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress WP Accessibility Helper WAH plugin versions = 0.6.0.6. Solution Update the WordPress WP Accessibility Helper WAH plugin to the latest available version at least 0.6.0.7...