WordPress SoftMarket plugin <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass vulnerability

Unauthenticated Account Takeover via Email Verification Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin SoftMarket — Digital Marketplace versions = 1.0.0...

WordPress To Do List Member plugin 1.4-1.6 - Unauthenticated Stored XSS, File Listing and Deletion vulnerability

Unauthenticated Stored XSS, File Listing and Deletion vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin To Do List Member versions 1.4-1.6...

WordPress PuppyFW plugin <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation vulnerability

Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PuppyFW versions = 0.4.4...

WordPress WP Cloud Plugins - Dropbox (Out-of-the-Box) plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

WordPress WP Cloud Plugins - Dropbox Out-of-the-Box plugin 2.0-3.8.3 - Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Out-of-the-Box versions 2.0-3.8.3...

WordPress WP Cloud Plugins - Box (Lets-Box) plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

WordPress WP Cloud Plugins - Box Lets-Box plugin 2.0-3.8.3 - Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Lets-Box versions 2.0-3.8.3...

WordPress Share-one-Drive | OneDrive & SharePoint plugin for WordPress plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Share-one-Drive versions 2.0-3.8.3...

WordPress Use-your-Drive | Google Drive plugin for WordPress plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Use-your-Drive versions 2.0-3.8.3...

WordPress wpShopGermany IT-RECHT KANZLEI plugin 1.6-2.3 - Unauthenticated RCE vulnerability

Unauthenticated RCE vulnerability discovered by Naoki Kawahigashi in WordPress Plugin wpShopGermany IT-RECHT KANZLEI versions 1.6-2.3...

WordPress Filter Gallery plugin <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Gallery Deletion vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Filter Gallery versions = 1.1.4...

WordPress Login with QR plugin <= 1.0.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Login with QR versions = 1.0.0...

WordPress The Pressengine plugin <= 1.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin The Pressengine versions = 1.0...

WordPress Private Feed Key plugin <= 0.1 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Private Feed Key versions = 0.1...

WordPress Clean Login plugin < 1.19 - Unauthenticated Account Creation with Registration Disabled vulnerability

Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Artus KG in WordPress Plugin Clean Login versions 1.19...

WordPress All Bootstrap Blocks plugin <= 1.3.31 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin All Bootstrap Blocks versions = 1.3.31...

WordPress Bookit — Booking & Appointment Calendar plugin < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure vulnerability

Bookit Staff+ Appointment PII Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin BookIt versions 2.6.0.5...

WordPress MasterStudy LMS WordPress Plugin plugin 3.6.2-3.7.49 - Instructor+ Student PII Disclosure vulnerability

Instructor+ Student PII Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin MasterStudy LMS versions 3.6.2-3.7.49...

WordPress Easy Appointments plugin < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation vulnerability

Unauthenticated Appointment Cancellation/Confirmation vulnerability discovered by Morato Antoine in WordPress Plugin Easy Appointments versions 4.0.2.2...

WordPress Easy Appointments plugin 4.0-4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion vulnerability

Unauthenticated Arbitrary Appointment Modification and Deletion vulnerability discovered by blast in WordPress Plugin Easy Appointments versions 4.0-4.0.2.1...

WordPress King Addons for Elementor plugin < 51.1.81 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin King Addons for Elementor versions 51.1.81...

WordPress King Addons for Elementor plugin < 51.1.81 - Contributor+ Private Post Content Disclosure vulnerability

Contributor+ Private Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin King Addons for Elementor versions 51.1.81...

WordPress King Addons for Elementor plugin 51.1.56-51.1.80 - Author+ Missing Authorization vulnerability

Author+ Missing Authorization vulnerability discovered by Artus KG in WordPress Plugin King Addons for Elementor versions 51.1.56-51.1.80...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Instructor+ Order Status Manipulation vulnerability

Instructor+ Order Status Manipulation vulnerability discovered by Shivamani Vastrala in WordPress Plugin MasterStudy LMS versions 3.7.50...

WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress core versions = 7.1...

WordPress WP Recipe Maker plugin <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Saulo Rafael miquinho miquinho in WordPress Plugin WP Recipe Maker versions = 10.8.1...

WordPress Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Popup Maker versions = 1.24.0...

NPM: Svelte devalue: DoS via malformed input

NPM: Svelte devalue: DoS via malformed input vulnerability discovered by ? in WordPress Npm devalue versions 5.9.1...

WordPress CSS & JavaScript Toolbox plugin <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Kyokito in WordPress Plugin CSS & JavaScript Toolbox versions = 12.0.6...

WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin <= 1.8.44 - Authenticated (Author+) SQL Injection vulnerability

Authenticated Author+ SQL Injection vulnerability discovered by VuxNx in WordPress Plugin Photo Gallery by 10Web versions = 1.8.44...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure vulnerability

Authenticated Custom+ Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure vulnerability discovered by skyv3il, Chirita Catalin-Andrei CC99IE, AmonRa, MrProperCTF in WordPress Plugin LatePoint versions = 5.6.3...

WordPress FileBird – WordPress Media Library Folders & File Manager plugin <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by TruongLV1 From FPT Night Wolf in WordPress Plugin Filebird versions = 6.5.6...

WordPress Kubio AI Page Builder plugin <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Kubio AI Page Builder versions = 2.8.4...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.3.0 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin NEX-Forms versions = 9.3.0...

WordPress WP Easy Pay – Payment and Donation Form Builder for Square plugin <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP EasyPay versions = 4.5.0...

WordPress Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion vulnerability

Authenticated Shop Manager+ Path Traversal to Arbitrary File Read and Arbitrary File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Store Exporter versions = 2.8.0...

WordPress VK All in One Expansion Unit plugin <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Kyokito, Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin VK All in One Expansion Unit versions = 9.118.0...

WordPress Strong Testimonials plugin <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by pbsec in WordPress Plugin Strong Testimonials versions = 3.3.8...

WordPress Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Modification / Site-Wide Template Takeover vulnerability discovered by Wordfence PRISM in WordPress Plugin Magazine Blocks versions = 1.8.6...

WordPress Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Magazine Blocks versions = 1.8.6...

WordPress Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Foxtool All-in-One versions = 2.5.3...

WordPress Filter Gallery plugin <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Modification vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Filter Gallery versions = 1.1.4...

WordPress Download Manager plugin <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Disclosure vulnerability discovered by pbsec in WordPress Plugin Download Manager versions = 3.3.68...

WordPress Divi theme <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution vulnerability

Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Theme Divi versions = 5.11.1...

NPM: ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion

Memory Exhaustion vulnerability discovered by ? in WordPress Npm exifreader versions = 4.41.0...

WordPress CheckView plugin < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass vulnerability

Administrator Account Creation via REST API Authentication Bypass vulnerability discovered by Usama Arshad in WordPress Plugin CheckView Automated Testing versions 2.3.2...

WordPress Custom Fields for WooCommerce plugin < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path Traversal vulnerability

Unauthenticated Arbitrary File Deletion via Path Traversal vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Custom Fields versions 1.5.1...

WordPress Single Sign On For TNG plugin < 2.2.0 - Unauthenticated Arbitrary Password Reset vulnerability

Unauthenticated Arbitrary Password Reset vulnerability discovered by moonge in WordPress Plugin Single Sign On For TNG versions 2.2.0...

WordPress Dataverse Integration plugin < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure vulnerability

Contributor+ Server-Side Template Injection SSTI to Information Disclosure vulnerability discovered by dangnosuy in WordPress Plugin Dataverse Integration versions 2.91...

WordPress Five Star Restaurant Reservations plugin < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR vulnerability

Unauthenticated Payment Bypass and Booking Confirmation via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Five Star Restaurant Reservations versions 2.7.23...

WordPress WP Events Manager plugin < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR vulnerability

Unauthenticated Payment Bypass and Booking Status Update via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Events Manager versions 2.2.5...

WordPress Ninja Forms plugin < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability

Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Ninja Forms versions 3.14.10...