WordPress Disable Users plugin <= 1.0.5 - Disabled Account Authentication Bypass vulnerability

Disabled Account Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Disable Users versions = 1.0.5...

WordPress SmugMug Embed plugin <= 3.13 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin SmugMug Embed versions = 3.13...

WordPress BuddyPress Instant Chat plugin <= 1.6 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin BuddyPress Instant Chat versions = 1.6...

WordPress Adwised Web Push Notification plugin <= 2.5.7 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Adwised Web Push Notification versions = 2.5.7...

WordPress Adwised Web Push Notification plugin <= 2.5.7 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Adwised Web Push Notification versions = 2.5.7...

WordPress Web Vitals Tracking plugin <= 5.4.2 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Web Vitals Tracking versions = 5.4.2...

WordPress HootBoard plugin <= 3.1.4 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin HootBoard versions = 3.1.4...

WordPress Insurify plugin <= 1.0 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Insurify versions = 1.0...

WordPress Quick quotes plugin <= 1.0.0 - Unauthenticated Integer-Value Option Update vulnerability

Unauthenticated Integer-Value Option Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Quick quotes versions = 1.0.0...

WordPress Crowdfundly plugin <= 2.2.2 - Crowdfundly Manager+ Privilege Escalation vulnerability

Crowdfundly Manager+ Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Crowdfundly versions = 2.2.2...

WordPress Insurify plugin <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite vulnerability

Unauthenticated Arbitrary Option Creation and Overwrite vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Insurify versions = 1.0...

WordPress AI Content Generator Marketing plugin <= 1.0.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin AI Content Generator Marketing versions = 1.0.0...

WordPress Freeton WP plugin <= 1.0.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Freeton WP versions = 1.0.0...

WordPress Mindstien Quick Login plugin <= 1.0 - Unauthenticated Administrator Account Takeover vulnerability

Unauthenticated Administrator Account Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Mindstien Quick Login versions = 1.0...

WordPress click5 CRM add-on to Contact Form 7 plugin <= 1.0.4 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Contact Form 7 versions = 1.0.4...

WordPress click5 CRM add-on to Gravity Forms plugin <= 1.0.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Gravity Forms versions = 1.0.3...

WordPress click5 CRM add-on to WPForms plugin <= 1.0.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to WPForms versions = 1.0.3...

WordPress click5 CRM add-on to Ninja Forms plugin <= 1.0.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Ninja Forms versions = 1.0.1...

WordPress click5 CRM add-on to Contact Form 7 plugin <= 1.0.4 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin click5 CRM add-on to Contact Form 7 versions = 1.0.4...

WordPress click5 CRM add-on to WPForms plugin <= 1.0.3 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin click5 CRM add-on to WPForms versions = 1.0.3...

WordPress click5 CRM add-on to Ninja Forms plugin <= 1.0.1 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin click5 CRM add-on to Ninja Forms versions = 1.0.1...

WordPress Fundiin cho WooCommerce plugin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure vulnerability

Unauthenticated Payment Gateway Settings Update and Credential Disclosure vulnerability discovered by ? in WordPress Plugin Fundiin cho WooCommerce versions = 3.4.0...

WordPress Tcard WP plugin <= 1.8.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Theo Antonio da Fonseca in WordPress Plugin Tcard WP versions = 1.8.0...

WordPress WeddingCity Lite plugin <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion vulnerability

Unauthenticated Arbitrary Post and Attachment Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WeddingCity Lite versions = 1.0.4...

WordPress Envira Gallery plugin < 1.16.2 - Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability

Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Envira Photo Gallery versions 1.16.2...

WordPress Anton Extensions plugin <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE vulnerability

Unauthenticated Arbitrary File Upload to RCE vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Anton Extensions versions = 1.2.2...

WordPress Mobile builder plugin <= 1.4.2 - Subscriber+ Privilege Escalation to Admin vulnerability

Subscriber+ Privilege Escalation to Admin vulnerability discovered by Raphael P. Cigana in WordPress Plugin Mobile builder versions = 1.4.2...

WordPress Mobile builder plugin <= 1.4.2 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Raphael P. Cigana in WordPress Plugin Mobile builder versions = 1.4.2...

WordPress Prenotazioni plugin <= 1.7.5 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Prenotazioni versions = 1.7.5...

WordPress LTL Freight Quotes plugin < 4.2.19 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by achmad sonif in WordPress Plugin LTL Freight Quotes – Old Dominion Edition versions 4.2.19...

WordPress LTL Freight Quotes plugin 4.2.11-4.2.18 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by achmad sonif in WordPress Plugin LTL Freight Quotes – Old Dominion Edition versions 4.2.11-4.2.18...

WordPress Portfolio Filter Gallery plugin 2.0.2-2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion vulnerability

Contributor+ Cross-User Video Thumbnail Deletion vulnerability discovered by blast in WordPress Plugin Portfolio Gallery – Image Gallery Plugin versions 2.0.2-2.2.0...

WordPress Contest Gallery plugin < 33.0.1 - Unauthenticated Email Verification Bypass vulnerability

Unauthenticated Email Verification Bypass vulnerability discovered by Akshat Parikh SN1PER in WordPress Plugin Contest Gallery versions 33.0.1...

WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetEngine versions = 3.8.16...

WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Push Notification for Post and BuddyPress versions = 3.23...

WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin Auction Nudge – Your eBay on Your Site versions = 8.4.0...

WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mor Golan in WordPress Plugin Easy Property Listings versions = 3.5.25...

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Paid Videochat Turnkey Site versions = 7.5.12...

WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by AndrewN in WordPress Plugin Affiliates versions = 7.0.1...

WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Bus Ticket Booking with Seat Reservation versions = 5.9.7...

WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by jydae in WordPress Plugin JetProductTables versions = 1.2.4...

WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

Session Hijacking vulnerability discovered by Peter Tang in WordPress Plugin Broadcast Live Video versions = 7.3.2...

WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Đỗ Trung Kiên in WordPress Plugin Frontend Dashboard versions = 3.0.7...

WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin WP w3all phpBB versions = 3.1.0...

WordPress Marin theme <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Theme Marin versions = 0.1.1...

WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin SureCart versions = 4.9.3...

WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SureCart versions = 4.9.3...

WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Polylang versions = 3.8.9...

WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Viet Tin in WordPress Plugin WP OAuth Server versions = 6.4.0...

WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Aarush Gaur in WordPress Plugin Modern Events Calendar Lite versions 7.37.0...