WordPress Polylang Pro plugin < 3.7.4 - Contributor+ PHP Object Injection vulnerability

Contributor+ PHP Object Injection vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Polylang Pro versions 3.7.4...

WordPress Polylang Pro plugin < 3.8.10 - Editor+ PHP Object Injection vulnerability

Editor+ PHP Object Injection vulnerability discovered by Ananda Dhakal in WordPress Plugin Polylang Pro versions 3.8.10...

WordPress MailPoet plugin < 5.14.2 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Mruk in WordPress Plugin MailPoet versions 5.14.2...

WordPress Yoast SEO Premium plugin < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCE vulnerability

Author+ Arbitrary .htaccess Directive Injection to RCE vulnerability discovered by Tin Pham TF1T, Trong Pham dtro, Hao Ngo in WordPress Plugin Yoast SEO Premium versions 27.6.1...

WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetSmartFilters versions = 3.8.6.1...

WordPress WP Crontrol plugin < 1.16.2 - Remote Code Execution vulnerability

Remote Code Execution vulnerability discovered by Calvin Alkan in WordPress Plugin Crontrol versions 1.16.2...

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mroccon in WordPress Plugin APIExperts Square for WooCommerce versions = 4.7.5...

WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mroccon in WordPress Plugin APIExperts Square for WooCommerce versions = 4.7.5...

WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mert Ural in WordPress Plugin Contact Form by Supsystic versions = 1.10.7...

WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Panorama Viewer – 360 Degree Image + Video Viewer versions = 1.8.3...

WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

WordPress Advanced Post Block - Post Grid for WordPress block editor plugin = 2.5.1 - Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Advanced Post Block - Post Grid for WordPress block editor versions = 2.5.1...

WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin B Slider versions = 2.2.2...

WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.5...

WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Deva Parekh in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ayukiab in WordPress Plugin JetEngine versions = 3.9.0...

WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by M. Bal-Ghaoui medblgsec in WordPress Plugin Geo Mashup versions = 1.13.22...

WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by M. Bal-Ghaoui medblgsec in WordPress Plugin Geo Mashup versions = 1.13.22...

WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin Better Post & Filter Widgets for Elementor versions = 1.9.1...

WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin Lazy Load for Videos versions = 2.18.11...

WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Khanh Nguyen in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin Better Post & Filter Widgets for Elementor versions = 1.9.1...

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by yzx001 in WordPress Plugin Ad Inserter versions = 2.8.18...

WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sangho Lee in WordPress Plugin Booking and Rental Manager versions = 2.8.2...

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Anthony Green of Greenhat Security in WordPress Plugin Royal Elementor Addons versions = 1.7.1069...

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Royal Elementor Addons versions = 1.7.1069...

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by yzx001 in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Royal Elementor Addons versions = 1.7.1069...

WordPress YOOtheme Pro theme < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes

Author+ Stored XSS via UIkit Data Attributes vulnerability discovered by Pierre Rudloff in WordPress Theme yootheme versions 5.0.35...

WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mash in WordPress Plugin Bopo – WooCommerce Product Bundle Builder versions = 1.2.3...

WordPress Polylang Pro plugin < 3.8.10 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Intrudify in WordPress Plugin Polylang Pro versions 3.8.10...

WordPress Polylang Pro plugin < 3.8.6 - Contributor+ Private Post Disclosure via Row Update AJAX Actions vulnerability

Contributor+ Private Post Disclosure via Row Update AJAX Actions vulnerability discovered by Ananda Dhakal in WordPress Plugin Polylang Pro versions 3.8.6...

WordPress Polylang Pro plugin < 3.8.8 - Contributor+ Sensitive Information Exposure vulnerability

Contributor+ Sensitive Information Exposure vulnerability discovered by Ananda Dhakal in WordPress Plugin Polylang Pro versions 3.8.8...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.8.0.1...

WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ihsan Saddan in WordPress Plugin Image Gallery block – Create and display photo gallery/photo album. versions = 2.4.1...

WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin WP Discussion Board versions = 2.6.0...

WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by cazy in WordPress Plugin DEPART versions = 1.0.10...

WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by AndrewN in WordPress Plugin FunnelKit Automations versions = 3.8.5.2...

WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ahmad Naseem in WordPress Plugin AI Engine versions = 3.8.6...

WordPress Mintpay for WooCommerce plugin <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation vulnerability

Unauthenticated Order Payment Completion and Cancellation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Mintpay for WooCommerce versions = 2.2.3...

WordPress GiveWP plugin < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass vulnerability

Unauthenticated Donation Amount Restriction Bypass vulnerability discovered by Shirshak in WordPress Plugin GiveWP versions 4.19.0.1...

WordPress Payment Gateway plugin <= 2.2.0 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payment Gateway versions = 2.2.0...

WordPress Eurobank WooCommerce Payment Gateway plugin <= 2.1.1 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Eurobank WooCommerce Payment Gateway versions = 2.1.1...

WordPress CCAvenue Payment Gateway for WooCommerce plugin <= 3.1 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin CCAvenue Payment Gateway for WooCommerce versions = 3.1...

WordPress GeoDirectory plugin < 2.8.194 - Subscriber+ Media File Disclosure and Deletion vulnerability

Subscriber+ Media File Disclosure and Deletion vulnerability discovered by vuxvinh in WordPress Plugin GeoDirectory versions 2.8.194...

WordPress Download Monitor plugin < 5.3.4 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Download Monitor versions 5.3.4...

WordPress MAS Videos plugin <= 1.3.4 - Subscriber+ Arbitrary Post Deletion vulnerability

Subscriber+ Arbitrary Post Deletion vulnerability discovered by JunHee CHO in WordPress Plugin MAS Videos versions = 1.3.4...

WordPress Advanced Custom Fields: Extended PRO plugin 0.9.2.4-0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.4-0.9.2.7...

WordPress Advanced Custom Fields: Extended plugin 0.9.2.4-0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin ACF Extended versions 0.9.2.4-0.9.2.7...

WordPress Datawiza Proxy Auth Plugin plugin < 1.1.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Datawiza Proxy Auth Plugin versions 1.1.1...

WordPress Front End Users plugin <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment vulnerability

Unauthenticated Membership Level and Account Status Self-Assignment vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin Front End Users versions = 3.2.35...