WordPress Gravity Forms plugin <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 3.1.1...

WordPress Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability

Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Formidable Forms versions = 6.35...

WordPress Gravity Forms plugin <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Gravity Forms versions = 3.1.2...

WordPress Gravity Forms plugin <= 3.1.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Tin Pham TF1T, Hao Ngo, Trong Pham in WordPress Plugin Gravity Forms versions = 3.1.2...

WordPress Food Store – Online Food Delivery & Pickup plugin <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by GivMeInJ in WordPress Plugin Food Store – Online Food Delivery & Pickup versions = 1.5.5...

WordPress AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini plugin <= 3.8.6 - Missing Authorization to Administrator Account Takeover vulnerability

Missing Authorization to Administrator Account Takeover vulnerability discovered by satoshigpt2021-sketch in WordPress Plugin AI Engine versions = 3.8.6...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.55.0.2 - Unauthenticated Limited File Deletion vulnerability

Unauthenticated Limited File Deletion vulnerability discovered by Emiliano Versini in WordPress Plugin Forminator versions = 1.55.0.2...

WordPress Export and Import Users and Customers plugin <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin Import Export WordPress Users versions = 2.7.5...

WordPress Content Egg – Affiliate Product Importer & Price Comparison plugin <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation vulnerability

Missing Authorization to Authenticated Author+ Administrator-Authored Post Creation vulnerability discovered by Wordfence PRISM in WordPress Plugin Content Egg versions = 12.0.0...

WordPress Cool FormKit Lite – Advanced Form Builder for Elementor plugin <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cool Formkit Lite versions = 2.7.9...

WordPress Content Egg – Affiliate Product Importer & Price Comparison plugin <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Meta Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Content Egg versions = 12.0.0...

WordPress Events Made Easy plugin <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Events Made Easy versions = 3.3.1...

WordPress JoomSport – for Sports: Team & League, Football, Hockey & more plugin <= 5.7.14 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin JoomSport versions = 5.7.14...

npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs vulnerability discovered by ? in WordPress npm decode-uri-component versions = 0.5.0...

npm: Vite: `server.fs.deny` bypassed with queries

npm: Vite: server.fs.deny bypassed with queries vulnerability discovered by ? in WordPress npm vite versions 6.4.4...

npm: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

npm: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist vulnerability discovered by ? in WordPress npm parse-server versions = 8.6.83...

WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nixxies in WordPress Plugin Document Library Lite versions = 1.3.0...

WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability

Content Injection vulnerability discovered by nh4tvd in WordPress Plugin Kirki versions = 6.4.0...

WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 6.5.3...

WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Happy Addons for Elementor versions = 3.50.1...

WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin WP ERP versions = 1.17.10...

WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin EventPrime versions = 4.3.6.0...

WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mj404error in WordPress Plugin Page Restriction WordPress WP versions = 1.6.1...

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by foehn in WordPress Plugin myCred versions = 4.0.2...

WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Flash & HTML5 Video versions = 2.14.0...

WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by mamgad in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ssophiz in WordPress Plugin Custom Price for WooCommerce versions = 1.1.29...

WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nizar yart D3dC0d in WordPress Plugin Strong Testimonials versions = 3.3.15...

WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Taegyeong Yun in WordPress Plugin Kit formerly ConvertKit versions = 3.4.7...

WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sangho Lee in WordPress Plugin Profile Builder versions = 4.0.5...

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Taxi Booking Manager for WooCommerce versions = 2.1.6...

WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ayukiab in WordPress Plugin Happy Addons for Elementor versions = 3.50.1...

WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by elba.code in WordPress Plugin User Registration versions = 5.3.0...

WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin ShopBuilder – Elementor WooCommerce Builder Addons versions = 3.4.2...

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.3...

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Matthew Lapinski in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin StreamCast versions = 2.4.6...

WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.3...

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Flexible Quantity – Measurement Price Calculator for WooCommerce versions = 2.3.24...

WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.6...

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Je22y in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Luke Schneider in WordPress Plugin SureForms versions = 2.12.9...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by fcc in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.8.0.2...

WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin PublishPress Authors versions = 4.17.0...

WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jayant Kamble in WordPress Plugin MasterStudy LMS versions = 3.7.55...

WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HAIMIN in WordPress Plugin Webba Booking versions = 6.5.4...

WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by elba.code in WordPress Plugin WP User Frontend versions = 4.3.13...

WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mroccon in WordPress Plugin WP User Manager versions = 2.9.26...

WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mroccon in WordPress Plugin WP User Frontend versions = 4.3.13...