WordPress Enable Media Replace plugin 4.1.4-4.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Enable Media Replace versions 4.1.4-4.2.2...

WordPress WP Visitor Statistics (Real Time Traffic) plugin < 8.8 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by an7ln in WordPress Plugin WP Visitor Statistics Real Time Traffic versions 8.8...

WordPress User Frontend plugin < 4.3.14 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Jasper Weijts in WordPress Plugin WP User Frontend versions 4.3.14...

WordPress Security Plugin, Firewall & Malware Scanner with Auto Removal plugin < 2.191 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Karthik in WordPress Plugin Security & Malware scan by CleanTalk versions 2.191...

WordPress Firelight Lightbox plugin < 2.3.23 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Firelight Lightbox versions 2.3.23...

WordPress BuddyForms plugin < 2.10.1 - Subscriber+ Arbitrary Post Modification vulnerability

Subscriber+ Arbitrary Post Modification vulnerability discovered by Furkan Arslan in WordPress Plugin BuddyForms versions 2.10.1...

WordPress BuddyForms plugin < 2.10.3 - Unauthenticated Form Configuration Disclosure vulnerability

Unauthenticated Form Configuration Disclosure vulnerability discovered by Ryan Fabella in WordPress Plugin BuddyForms versions 2.10.3...

WordPress WP Visitor Statistics (Real Time Traffic) plugin < 8.8 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin WP Visitor Statistics Real Time Traffic versions 8.8...

WordPress Fraud Prevention For WooCommerce and EDD plugin < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting vulnerability

Subscriber+ Arbitrary Customer Blacklisting vulnerability discovered by Usama Arshad in WordPress Plugin Fraud Prevention For Woocommerce versions 2.3.6...

WordPress Joinchat plugin 6.3.2-6.4.1 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Qi Qin in WordPress Plugin Joinchat versions 6.3.2-6.4.1...

WordPress Gravity Forms plugin <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 3.1.1...

WordPress Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation vulnerability

Authenticated Subscriber+ Arbitrary Plugin Installation vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Formidable Forms versions = 6.35...

WordPress Gravity Forms plugin <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Gravity Forms versions = 3.1.2...

WordPress Gravity Forms plugin <= 3.1.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Tin Pham TF1T, Hao Ngo, Trong Pham in WordPress Plugin Gravity Forms versions = 3.1.2...

WordPress Food Store – Online Food Delivery & Pickup plugin <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by GivMeInJ in WordPress Plugin Food Store – Online Food Delivery & Pickup versions = 1.5.5...

WordPress AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini plugin <= 3.8.6 - Missing Authorization to Administrator Account Takeover vulnerability

Missing Authorization to Administrator Account Takeover vulnerability discovered by satoshigpt2021-sketch in WordPress Plugin AI Engine versions = 3.8.6...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.55.0.2 - Unauthenticated Limited File Deletion vulnerability

Unauthenticated Limited File Deletion vulnerability discovered by Emiliano Versini in WordPress Plugin Forminator versions = 1.55.0.2...

WordPress Export and Import Users and Customers plugin <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin Import Export WordPress Users versions = 2.7.5...

WordPress Content Egg – Affiliate Product Importer & Price Comparison plugin <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation vulnerability

Missing Authorization to Authenticated Author+ Administrator-Authored Post Creation vulnerability discovered by Wordfence PRISM in WordPress Plugin Content Egg versions = 12.0.0...

WordPress Cool FormKit Lite – Advanced Form Builder for Elementor plugin <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cool Formkit Lite versions = 2.7.9...

WordPress Content Egg – Affiliate Product Importer & Price Comparison plugin <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Meta Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Content Egg versions = 12.0.0...

WordPress Events Made Easy plugin <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Events Made Easy versions = 3.3.1...

WordPress JoomSport – for Sports: Team & League, Football, Hockey & more plugin <= 5.7.14 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin JoomSport versions = 5.7.14...

npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs vulnerability discovered by ? in WordPress npm decode-uri-component versions = 0.5.0...

npm: Vite: `server.fs.deny` bypassed with queries

npm: Vite: server.fs.deny bypassed with queries vulnerability discovered by ? in WordPress npm vite versions 6.4.4...

npm: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist

npm: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist vulnerability discovered by ? in WordPress npm parse-server versions = 8.6.83...

WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability

Content Injection vulnerability discovered by nh4tvd in WordPress Plugin Kirki versions = 6.4.0...

WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nixxies in WordPress Plugin Document Library Lite versions = 1.3.0...

WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin The Plus Addons for Elementor Page Builder Lite versions = 6.5.3...

WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Happy Addons for Elementor versions = 3.50.1...

WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin WP ERP versions = 1.17.10...

WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin EventPrime versions = 4.3.6.0...

WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mj404error in WordPress Plugin Page Restriction WordPress WP versions = 1.6.1...

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by foehn in WordPress Plugin myCred versions = 4.0.2...

WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by mamgad in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Flash & HTML5 Video versions = 2.14.0...

WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ssophiz in WordPress Plugin Custom Price for WooCommerce versions = 1.1.29...

WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nizar yart D3dC0d in WordPress Plugin Strong Testimonials versions = 3.3.15...

WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sangho Lee in WordPress Plugin Profile Builder versions = 4.0.5...

WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Taegyeong Yun in WordPress Plugin Kit formerly ConvertKit versions = 3.4.7...

WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ayukiab in WordPress Plugin Happy Addons for Elementor versions = 3.50.1...

WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by elba.code in WordPress Plugin User Registration versions = 5.3.0...

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Taxi Booking Manager for WooCommerce versions = 2.1.6...

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin ShopBuilder – Elementor WooCommerce Builder Addons versions = 3.4.2...

WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.3...

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Matthew Lapinski in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.3...

WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin StreamCast versions = 2.4.6...

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Flexible Quantity – Measurement Price Calculator for WooCommerce versions = 2.3.24...