WordPress Postie plugin <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Postie versions = 1.9.87...

WordPress The Innovative Form Builder – IvyForms plugin <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload vulnerability

Authenticated Custom+ Arbitrary File Upload vulnerability discovered by Wordfence PRISM in WordPress Plugin IvyForms versions = 1.5.1...

WordPress Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter vulnerability

Authenticated Shop Manager+ Privilege Escalation to 'page' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin WpEvently versions = 5.7.8...

WordPress Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin <= 17.214.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Knowledge Base for Documentation, FAQs with AI Assistance versions = 17.214.0...

WordPress MxChat – AI Chatbot & Content Generation for WordPress plugin <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin MxChat versions = 3.2.25...

WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ashv4ni in WordPress Plugin My auctions allegro versions = 4.0.3...

WordPress Checkout Files Upload for WooCommerce plugin < 2.4.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Josef Azizov Spoofable in WordPress Plugin Checkout Files Upload for WooCommerce versions 2.4.0...

WordPress GoSMTP plugin < 1.2.5 - Plugin Activator+ Privilege Escalation vulnerability

Plugin Activator+ Privilege Escalation vulnerability discovered by Charles Vosburgh in WordPress Plugin GoSMTP SMTP for WordPress versions 1.2.5...

WordPress Contact Manager plugin <= 9.1.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by sermsak in WordPress Plugin Contact Manager versions = 9.1.2...

WordPress VikRentCar Car Rental Management System plugin <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution vulnerability

Cross-Site Request Forgery to Remote Code Execution vulnerability discovered by Wordfence PRISM in WordPress Plugin VikRentCar versions = 1.4.8...

WordPress Customer Email Verification for WooCommerce plugin <= 2.8.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Wordfence PRISM in WordPress Plugin Customer Email Verification for WooCommerce versions = 2.8.2...

WordPress Product Designer for WooCommerce WordPress | Lumise plugin <= 2.1.2 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Bao Le in WordPress Plugin Lumise Product Designer versions = 2.1.2...

WordPress Recipe Card Blocks Lite plugin 3.5.0-3.6.3 - Contributor+ SQLi vulnerability

Contributor+ SQLi vulnerability discovered by Jasper Weijts in WordPress Plugin Recipe Card Blocks for Gutenberg & Elementor versions 3.5.0-3.6.3...

WordPress Customer Engagement System plugin < 2.0.2 - Unauthenticated SSRF vulnerability

Unauthenticated SSRF vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Popup by Supsystic versions 2.0.2...

WordPress Customer Engagement System plugin < 2.0.2 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Popup by Supsystic versions 2.0.2...

WordPress GeoDirectory plugin < 2.8.195 - Contributor+ Non-Public Listing Disclosure vulnerability

Contributor+ Non-Public Listing Disclosure vulnerability discovered by Jacek Sowiński in WordPress Plugin GeoDirectory versions 2.8.195...

WordPress GeoDirectory plugin < 2.8.196 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin GeoDirectory versions 2.8.196...

WordPress MP3 Audio Player plugin 5.9-5.15 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Hexxed BitHeadz in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions 5.9-5.15...

WordPress Royal MCP plugin < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass vulnerability

Contributor+ Private and Draft Content Disclosure and publishposts Bypass vulnerability discovered by Usama Arshad in WordPress Plugin Royal MCP versions 1.5.10...

WordPress Media Library Assistant plugin < 3.42 - Trashed Attachment Deletion vulnerability

Trashed Attachment Deletion vulnerability discovered by Sobhan Hosseinpour in WordPress Plugin Media LIbrary Assistant versions 3.42...

WordPress Media Library Assistant plugin < 3.42 - Bulk Attachment Deletion vulnerability

Bulk Attachment Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Media LIbrary Assistant versions 3.42...

WordPress Royal MCP plugin 1.4.38-1.5.9 - Subscriber+ Non-Public Post Disclosure vulnerability

Subscriber+ Non-Public Post Disclosure vulnerability discovered by Vincent Cassiau CyberVanguard in WordPress Plugin Royal MCP versions 1.4.38-1.5.9...

WordPress GeoDirectory plugin < 2.8.196 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin GeoDirectory versions 2.8.196...

WordPress Welcart e-Commerce plugin < 2.12.6 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by Osman Hussein in WordPress Plugin Welcart e-Commerce versions 2.12.6...

WordPress Welcart e-Commerce plugin < 2.12.6 - Editor+ SQLi vulnerability

Editor+ SQLi vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Welcart e-Commerce versions 2.12.6...

WordPress Welcart e-Commerce plugin < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure vulnerability

Author+ Arbitrary Product SKU Update and Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Welcart e-Commerce versions 2.12.6...

WordPress Copy Anything to Clipboard for WordPress plugin < 5.5.5 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by John Ryan Albon in WordPress Plugin Copy Anything to Clipboard versions 5.5.5...

WordPress Page Builder by SiteOrigin plugin < 2.38.0 - Contributor+ Sensitive Data Disclosure vulnerability

Contributor+ Sensitive Data Disclosure vulnerability discovered by Karthik in WordPress Plugin Page Builder by SiteOrigin versions 2.38.0...

WordPress Page Builder by SiteOrigin plugin < 2.38.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Page Builder by SiteOrigin versions 2.38.0...

WordPress Essential Addons for Elementor plugin < 6.8.7 - Unauthenticated Private Post Meta Disclosure vulnerability

Unauthenticated Private Post Meta Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Essential Addons for Elementor versions 6.8.7...

WordPress Royal Addons for Elementor plugin 1.3.81-1.7.1069 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Maciek Komorowski in WordPress Plugin Royal Elementor Addons versions 1.3.81-1.7.1069...

WordPress Royal Addons for Elementor plugin 1.7.1037-1.7.1069 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Venkateswara Reddy Challa in WordPress Plugin Royal Elementor Addons versions 1.7.1037-1.7.1069...

WordPress Royal Addons for Elementor plugin 1.3.71-1.7.1069 - Unauthenticated Mailchimp Audience Injection vulnerability

Unauthenticated Mailchimp Audience Injection vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Royal Elementor Addons versions 1.3.71-1.7.1069...

WordPress Royal Addons for Elementor plugin 1.3.68-1.7.1069 - Author+ Form Submission Interception vulnerability

Author+ Form Submission Interception vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Royal Elementor Addons versions 1.3.68-1.7.1069...

WordPress Booking Package plugin < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient vulnerability

Unauthenticated Verification Email Sending to Arbitrary Recipient vulnerability discovered by Pedro Pinho in WordPress Plugin Booking Package versions 1.7.33...

WordPress Court Reservation plugin < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion vulnerability

Unauthenticated Arbitrary Challenge Deletion vulnerability discovered by Daniel Dhaniswara in WordPress Plugin Court Reservation versions 1.12.4...

WordPress Court Reservation plugin < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion vulnerability

Unauthenticated Reservation Type Addition and Deletion vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Court Reservation versions 1.12.4...

WordPress Thrive Automator plugin < 11.2 - Editor+ Blind SQLi vulnerability

Editor+ Blind SQLi vulnerability discovered by Khanh Nguyen in WordPress Plugin Thrive Automator versions 11.2...

WordPress Payconiq plugin <= 1.0.4 - Unauthenticated Order Key Disclosure vulnerability

Unauthenticated Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payconiq versions = 1.0.4...

npm: dd-trace: ReDOS in URL query string obfuscation

npm: dd-trace: ReDOS in URL query string obfuscation vulnerability discovered by ? in WordPress npm dd-trace versions = 2.0.0, 5.131.1...

npm: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

npm: TinyMCE Cross-Site Scripting XSS vulnerability using media plugin data-mce-object serialization discovered by ? in WordPress npm tinymce versions 7.9.3...

npm: CKEditor: Cross-site scripting (XSS) in the engine package

npm: CKEditor: Cross-site scripting XSS in the engine package vulnerability discovered by ? in WordPress npm ckeditor5 versions = 29.0.0, 47.7.4...

npm: CKEditor: Cross-site scripting (XSS) in the engine package

npm: CKEditor: Cross-site scripting XSS in the engine package vulnerability discovered by ? in WordPress npm ckeditor5 versions = 45.0.0, 47.7.4...

npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects vulnerability discovered by ? in WordPress npm undici versions = 7.0.0, 7.30.1...

npm: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

npm: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent vulnerability discovered by ? in WordPress npm undici versions = 4.0.0, 6.29.1...

npm: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

npm: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation vulnerability discovered by ? in WordPress npm undici versions = 4.2.1, 6.29.1...

npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering vulnerability discovered by ? in WordPress npm undici versions = 5.15.0, 6.29.1...

npm: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

npm: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor vulnerability discovered by ? in WordPress npm undici versions = 7.15.0, 7.30.1...

WordPress Enable Media Replace plugin <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification vulnerability

Missing Authorization to Authenticated Author+ Post Content Modification vulnerability discovered by Duy Tran in WordPress Plugin Enable Media Replace versions = 4.2.2...

WordPress Awesome Support – WordPress HelpDesk & Support Plugin plugin <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Matthew Lapinski in WordPress Plugin Awesome Support versions = 6.4.1...