WordPress Meta-box GalleryMeta plugin <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management vulnerability

Missing Authorization to Authenticated Author+ Gallery Management vulnerability discovered by Kazuma Matsumoto - GMO Cybersecurity by IERAE, Inc. in WordPress Plugin Meta-box GalleryMeta versions = 3.0.1...

WordPress Postalicious plugin <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Plugin Settings vulnerability discovered by 0x34rth in WordPress Plugin Postalicious versions = 3.0.1...

WordPress Meta-box GalleryMeta plugin <= 3.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption vulnerability

Authenticated Editor+ Stored Cross-Site Scripting via Image Caption vulnerability discovered by Kazuma Matsumoto - GMO Cybersecurity by IERAE, Inc. in WordPress Plugin Meta-box GalleryMeta versions = 3.0.1...

WordPress Kama Thumbnail plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Kama Thumbnail versions = 3.5.1...

WordPress WP Subscribe plugin <= 1.2.16 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin WP Subscribe versions = 1.2.16...

WordPress WP FullCalendar plugin <= 1.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nabil Irawan in WordPress Plugin WP FullCalendar versions = 1.6...

WordPress Nexter Blocks plugin <= 4.6.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nabil Irawan in WordPress Plugin Nexter Blocks versions = 4.6.3...

WordPress Tablesome plugin <= 1.2.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Tablesome versions = 1.2.3...

WordPress WiserReview Product Reviews for WooCommerce plugin <= 2.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin WiserReview Product Reviews for WooCommerce versions = 2.9...

WordPress CLP Varnish Cache plugin <= 1.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin CLP Varnish Cache versions = 1.0.2...

WordPress Email Inquiry & Cart Options for WooCommerce plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin Email Inquiry & Cart Options for WooCommerce versions = 3.4.3...

WordPress Nova Blocks plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin Nova Blocks versions = 2.1.9...

WordPress Gallery PhotoBlocks plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin Gallery PhotoBlocks versions = 1.3.2...

WordPress Schedula plugin <= 1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ty5ona in WordPress Plugin Schedula versions = 1.0...

WordPress User Submitted Posts - Enable Users to Submit Posts from the Front End plugin <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field vulnerability

WordPress User Submitted Posts - Enable Users to Submit Posts from the Front End plugin = 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field vulnerability discovered by Balamurugan R in WordPress Plugin User Submitted Posts versions = 20251210...

WordPress MetForm - Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value vulnerability

WordPress MetForm - Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin = 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value vulnerability discovered by type5afe in WordPress Plugin Metform versions = 4.1.0...

WordPress JustClick registration plugin plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELF vulnerability

Reflected Cross-Site Scripting via PHPSELF vulnerability discovered by Abdulsamad Yusuf 0xVenus - Envorasec in WordPress Plugin JustClick registration plugin versions = 0.1...

WordPress Frontis Blocks plugin <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter vulnerability

Unauthenticated Server-Side Request Forgery via 'url' Parameter vulnerability discovered by WordFence in WordPress Plugin Frontis Blocks versions = 1.1.6...

WordPress Kalrav AI Agent plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action vulnerability

Unauthenticated Arbitrary File Upload via kalravuploadfile AJAX Action vulnerability discovered by Ryan Kozak in WordPress Plugin Kalrav AI Agent versions = 2.3.3...

WordPress Quick Restaurant Reservations plugin <= 1.6.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Quick Restaurant Reservations versions = 1.6.7...

WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin CartFlows versions = 2.1.19...

WordPress WebP Conversion plugin <= 2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin WebP Conversion versions = 2.2...

WordPress hCaptcha for WP plugin <= 4.22.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by suyoung kim AhnLab in WordPress Plugin hCaptcha for WP versions = 4.22.0...

WordPress WP Bannerize Pro plugin <= 1.11.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by theviper17 in WordPress Plugin WP Bannerize Pro versions = 1.11.0...

WordPress Prowess theme <= 2.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Prowess versions = 2.3...

WordPress WP Custom Admin Interface plugin <= 7.41 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin WP Custom Admin Interface versions = 7.41...

WordPress SiteLock Security plugin <= 5.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin SiteLock Security – WP Hardening, Login Security & Malware Scans versions = 5.0.2...

WordPress Share This Image plugin <= 2.09 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Share This Image versions = 2.09...

WordPress TOP Table Of Contents plugin <= 1.3.31 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin TOP Table Of Contents versions = 1.3.31...

WordPress Booter plugin <= 1.5.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Booter versions = 1.5.7...

WordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Automatic Featured Images from Videos versions = 1.2.7...

WordPress Hustle plugin <= 7.8.9.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bao - BlueRock in WordPress Plugin Hustle versions = 7.8.9.2...

WordPress Omnipress plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by theviper17 in WordPress Plugin Omnipress versions = 1.6.7...

WordPress Webpushr plugin <= 4.38.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Webpushr versions = 4.38.0...

WordPress FluentForm plugin <= 6.1.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin FluentForm versions = 6.1.14...

WordPress Kentha Elementor Widgets plugin < 3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Kentha Elementor Widgets versions 3.1...

WordPress Omnipress plugin <= 1.6.7 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by theviper17 in WordPress Plugin Omnipress versions = 1.6.7...

WordPress Wired Impact Volunteer Management plugin <= 2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hhhai in WordPress Plugin Wired Impact Volunteer Management versions = 2.8...

WordPress Protección de datos – RGPD plugin <= 0.68 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Protección de datos RGPD versions = 0.68...

WordPress Integrate Google Drive plugin <= 1.5.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Integrate Google Drive versions = 1.5.6...

WordPress Download After Email plugin <= 2.1.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Download After Email versions = 2.1.9...

WordPress WP Term Order plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin WP Term Order versions = 2.1.0...

WordPress WP Job Portal plugin <= 2.4.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nabil Irawan in WordPress Plugin WP Job Portal versions = 2.4.3...

WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Materialis Companion versions = 1.3.52...

WordPress HD Quiz plugin <= 2.0.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin HD Quiz versions = 2.0.9...

WordPress WPElemento Importer plugin <= 0.6.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin WPElemento Importer versions = 0.6.4...

WordPress Moderate Selected Posts plugin <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update vulnerability

Cross-Site Request Forgery to Plugin Settings Update vulnerability discovered by afnaan - SMKN 1 Bantul in WordPress Plugin Moderate Selected Posts versions = 1.4...

WordPress All-in-One Video Gallery plugin 4.1.0-4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited User Meta Update vulnerability discovered by kr0d in WordPress Plugin All-in-One Video Gallery versions 4.1.0-4.6.4...

WordPress CM CSS Columns plugin <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'tag' Shortcode Attribute vulnerability discovered by theviper17y in WordPress Plugin CM CSS Columns versions = 1.2.1...

WordPress AdminQuickbar plugin <= 1.9.3 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Lior Yeshayahu in WordPress Plugin AdminQuickbar versions = 1.9.3...