WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Luke Schneider in WordPress Plugin YITH PayPal Express Checkout for WooCommerce versions = 1.62.0...

WordPress All-In-One Security (AIOS) plugin < 5.5.0 - Subscriber+ 2FA Bypass vulnerability

Subscriber+ 2FA Bypass vulnerability discovered by Karol Czubernat in WordPress Plugin All In One WP Security & Firewall versions 5.5.0...

WordPress Automated Import Products to Cart plugin < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion vulnerability

Subscriber+ Arbitrary File Read and Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Automated Import Products to Cart versions 1.0.4...

WordPress vTables plugin < 0.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin vTables versions 0.3...

WordPress Community Events plugin < 1.6.0 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Community Events versions 1.6.0...

WordPress Chat AI with Dispatcher plugin < 2.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Chat AI with Dispatcher versions 2.4...

WordPress PAYCOMET for WooCommerce plugin 5.36-5.45 - Unauthenticated Stored Payment Token Overwrite vulnerability

Unauthenticated Stored Payment Token Overwrite vulnerability discovered by JunHee CHO in WordPress Plugin PAYCOMET for WooCommerce versions 5.36-5.45...

WordPress LogixFast Auth plugin < 1.0.4 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin LogixFast Auth versions 1.0.4...

WordPress ProfileGrid plugin < 6.0.0.5 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by sungbyeongchan in WordPress Plugin ProfileGrid versions 6.0.0.5...

WordPress Frontend Dashboard plugin < 3.0.5 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by sungbyeongchan in WordPress Plugin Frontend Dashboard versions 3.0.5...

WordPress Two Factor Authentication plugin < 1.17.0 - Subscriber+ 2FA Bypass vulnerability

Subscriber+ 2FA Bypass vulnerability discovered by Karol Czubernat in WordPress Plugin Two Factor Authentication versions 1.17.0...

WordPress Hide Price Until Login plugin < 1.1.2 - Unauthenticated Account Creation vulnerability

Unauthenticated Account Creation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Hide Price Until Login versions 1.1.2...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Unauthenticated CRLF / Email Header Injection vulnerability

Unauthenticated CRLF / Email Header Injection vulnerability discovered by Emirhan Sevmez in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

WordPress HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin HT Mega versions = 3.2.7...

WordPress Newsmatic theme <= 1.5.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Kuba in WordPress Theme Newsmatic versions = 1.5.0...

WordPress Mapster WP Maps plugin <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whatm in WordPress Plugin Mapster WP Maps versions = 2.0.5...

WordPress LiteSpeed Cache plugin <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Santh in WordPress Plugin LiteSpeed Cache versions = 7.9.1...

WordPress NewsmanApp plugin <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by poiri3r in WordPress Plugin NewsmanApp versions = 3.7.29...

WordPress Meta Box – A Framework for Dynamic Websites plugin <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Meta Box – WordPress Custom Fields Framework versions = 5.15.2...

WordPress Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin <= 3.6.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Everest Forms versions = 3.6.2...

WordPress LiteSpeed Cache plugin <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin LiteSpeed Cache versions = 7.9.1...

WordPress Greenshift – animation and page builder blocks plugin <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Greenshift versions = 13.2.1...

WordPress Media Library Assistant plugin <= 3.42 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nh4tvd in WordPress Plugin NEX-Forms versions = 9.3.2...

WordPress RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by hamachijp in WordPress Plugin Feedzy versions = 5.2.12...

WordPress Extensions for Leaflet Map plugin <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin Extension for Leaflet Map versions = 5.4...

WordPress Video Player for YouTube plugin < 2.1.4 - Contributor+ Missing Authorization vulnerability

Contributor+ Missing Authorization vulnerability discovered by achmad sonif in WordPress Plugin YT Player versions 2.1.4...

WordPress Photo Engine (Media Organizer & Lightroom) plugin < 6.6.0 - Author+ Arbitrary Content Modification vulnerability

Author+ Arbitrary Content Modification vulnerability discovered by Mahammad Mammadov in WordPress Plugin Photo Engine versions 6.6.0...

WordPress GeoDirectory plugin < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure vulnerability

Unauthenticated Password-Protected Listing Content Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin GeoDirectory versions 2.8.197...

WordPress WP Photo Album Plus plugin < 9.3.04.004 - Photo Comment Deletion vulnerability

Photo Comment Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Photo Album Plus versions 9.3.04.004...

WordPress WP Post Author plugin < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields vulnerability

Unauthenticated Modification of the First User Account's Profile Fields vulnerability discovered by Mutantgun in WordPress Plugin WP Post Author versions 4.2.0...

WordPress WP Post Author plugin < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure vulnerability

Unauthenticated reCAPTCHA Secret Key Disclosure vulnerability discovered by Mutantgun in WordPress Plugin WP Post Author versions 4.2.0...

WordPress Wallet System for WooCommerce plugin < 2.8.2 - Subscriber+ KYC Document Overwrite vulnerability

Subscriber+ KYC Document Overwrite vulnerability discovered by Marcial Diaz in WordPress Plugin Wallet System for WooCommerce versions 2.8.2...

WordPress Enable SVG, WebP, and ICO Upload plugin < 1.1.6 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Enable SVG, WebP & ICO Upload versions 1.1.6...

WordPress Enable SVG, WebP, and ICO Upload plugin 1.1.3-1.1.5 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Shyu Yang in WordPress Plugin Enable SVG, WebP & ICO Upload versions 1.1.3-1.1.5...

WordPress LetterPress plugin < 2.4.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by SANU P.L in WordPress Plugin LetterPress versions 2.4.0...

WordPress Appointment Booking Plugin plugin < 5.7.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin LatePoint versions 5.7.6...

WordPress Link Library plugin < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass vulnerability

Unauthenticated Link Submission Login Requirement Bypass vulnerability discovered by Daria Golikova in WordPress Plugin Link Library versions 7.10.0...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Contact Submission and Statistics Deletion vulnerability

Contact Submission and Statistics Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion vulnerability

Unauthenticated Arbitrary Statistics Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Admin+ SSTI vulnerability

Admin+ SSTI vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

WordPress Link Library plugin < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure vulnerability

Unauthenticated Link Contact and Submitter Information Disclosure vulnerability discovered by Osman Hussein in WordPress Plugin Link Library versions 7.10.0...

WordPress Recipe Card Blocks Lite plugin 2.6.4-3.6.3 - Unauthenticated Unpublished Post Content Disclosure vulnerability

Unauthenticated Unpublished Post Content Disclosure vulnerability discovered by Ryan Fabella in WordPress Plugin Recipe Card Blocks for Gutenberg & Elementor versions 2.6.4-3.6.3...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Arbitrary Plugin Settings Update vulnerability

Arbitrary Plugin Settings Update vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

npm: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks

npm: systeminformation vulnerable to Windows command injection in services through Unicode quotation marks vulnerability discovered by ? in WordPress npm systeminformation versions 5.33.16...

WordPress MW WP Form plugin <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter vulnerability

Unauthenticated Sensitive Information Exposure in 'postid' Parameter vulnerability discovered by RIA Labs in WordPress Plugin MW WP Form versions = 5.1.7...

npm: Seroval: Code injection through a typed array's own constructor property

npm: Seroval: Code injection through a typed array's own constructor property vulnerability discovered by ? in WordPress npm seroval versions = 1.6.0, 1.6.11...

npm: Seroval: Script injection through RegExp sources in serialized output

npm: Seroval: Script injection through RegExp sources in serialized output vulnerability discovered by ? in WordPress npm seroval versions 1.0.0...

npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt unauthenticated event-loop DoS vulnerability discovered by ? in WordPress npm seroval versions = 1.6.7...

npm: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

npm: Seroval fromJSON/fromCrossJSON denial of service via unvalidated array node length vulnerability discovered by ? in WordPress npm seroval versions = 1.4.1, = 1.6.7...