WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Paid Member Subscriptions versions = 3.0.7...

WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by qdtad in WordPress Plugin GamiPress versions = 7.9.7...

WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce versions = 2.10.22...

WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin CoCart – Headless ecommerce versions = 4.8.4...

WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin Thrive Product Manager versions = 10.9.2...

WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mitchell in WordPress Plugin Post My CF7 Form versions = 6.2.0...

WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by ParkHyunWoo in WordPress Plugin Relevanssi Light versions = 1.2.2...

WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability

Price Manipulation vulnerability discovered by dodoh4t in WordPress Plugin Booking and Rental Manager versions = 2.7.2...

WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability

Unknown vulnerability discovered by dodoh4t in WordPress Plugin Falcon – WordPress Optimizations & Tweaks versions = 2.10.0...

WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by timomangcut in WordPress Plugin Stripe For WooCommerce versions = 4.0.7...

WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by hivesec in WordPress Plugin Ebook Store versions = 6.19...

WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by VuNBT in WordPress Plugin ShipTime: Discounted Shipping Rates versions = 1.1.1...

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...

WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Hide My WP Ghost versions = 7.0.06...

WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kwayy HTML Sitemap versions = 4.0...

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by testoun in WordPress Plugin Popup for CF7 with Sweet Alert versions = 1.6.5...

WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Machete versions = 5.2...

WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Cyr to Lat reloaded – transliteration of links and file names versions = 1.3.3...

WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin TinyMCE Templates versions = 4.8.1...

WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری versions = 4.4.5...

WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Custom links in Elementor Image Carousel versions = 1.1.1...

WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Smart SEO Tool versions = 4.1.2...

WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Persian Woocommerce SMS versions = 7.2.2...

WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin TemplateSpare versions = 4.2.2...

WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Qubely versions = 1.8.14...

WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Graphina versions = 3.1.12...

WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin BSK PDF Manager versions = 3.8...

WordPress LIQUID SPEECH BALLOON plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LIQUID SPEECH BALLOON versions = 1.2.6...

WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Civi Framework versions = 2.2.0...

WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by ParkHyunWoo in WordPress Plugin Visualizer versions = 4.0.1...

WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bonds in WordPress Plugin Avada Custom Branding versions = 1.2...

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...

WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Social Ninja versions = 4.3.0...

WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Accept Donations with PayPal & Stripe versions = 1.5.5...

WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Photo Gallery versions = 2.7.7.29...

WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Appointment Hour Booking versions = 1.5.86...

WordPress WP Activity Log plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Levon Balyan in WordPress Plugin WP Activity Log versions = 5.6.4...

WordPress WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin <= 43.2 - Cross-Site Request Forgery to Privilege Escalation vulnerability

Cross-Site Request Forgery to Privilege Escalation vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin WPO365 versions = 43.2...

WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Broken Access Control vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by longnv719 in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Derrick Gilliland in WordPress Plugin PeproDev Ultimate Invoice versions = 2.2.6...

WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin Dokan Pro versions = 5.0.3...

WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Expatch in WordPress Plugin Dokan Pro versions = 5.0.2...

WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Expatch in WordPress Plugin Dokan Pro versions = 5.0.2...

WordPress Dokan Pro plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Dokan Pro versions = 5.0.0...

NPM: n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

NPM: n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...

NPM: n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances

NPM: n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...