WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Filmax versions = 1.1.11...

WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Mission versions = 1.22...

WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Motorix versions = 1.11...

WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Muzicon versions = 1.15...

WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Nuts versions = 1.12...

WordPress HireZoot plugin < 4.0.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin WP Job Openings versions 4.0.0...

WordPress Hotel Booking plugin <= 3.8 - Booking Order Creation, Deletion, and Modification vulnerability

Booking Order Creation, Deletion, and Modification vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Hotel Booking versions = 3.8...

WordPress Hotel Booking plugin <= 3.8 - Subscriber+ Booking Order PII Disclosure vulnerability

Subscriber+ Booking Order PII Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Hotel Booking versions = 3.8...

WordPress WP-Invoice plugin <= 4.3.1 - Subscriber+ User PII Disclosure vulnerability

Subscriber+ User PII Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WP Invoice versions = 4.3.1...

WordPress Simple Membership plugin < 4.8.3 - Newly Registered Member Password Disclosure vulnerability

Newly Registered Member Password Disclosure vulnerability discovered by Rafael Honorato in WordPress Plugin Simple Membership versions 4.8.3...

WordPress click5 CRM add-on to Gravity Forms plugin <= 1.0.3 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin click5 CRM add-on to Gravity Forms versions = 1.0.3...

WordPress Robo Gallery plugin < 5.2.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Robo Gallery versions 5.2.6...

WordPress Robo Gallery plugin < 5.2.6 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Robo Gallery versions 5.2.6...

WordPress Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure vulnerability

Vendor+ Cross-Vendor Commission Settings Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Dokan versions 5.2.0...

WordPress Robo Gallery plugin < 5.2.6 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Robo Gallery versions 5.2.6...

WordPress Robo Gallery plugin < 5.2.6 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Kenneth Billones in WordPress Plugin Robo Gallery versions 5.2.6...

WordPress Envira Gallery plugin < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure vulnerability

Author+ Non-Public Post Title and Excerpt Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Envira Photo Gallery versions 1.16.2...

WordPress Envira Gallery plugin < 1.16.2 - Contributor Missing Authorization vulnerability

Contributor Missing Authorization vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Envira Photo Gallery versions 1.16.2...

WordPress Squadeno plugin < 1.12.0 - Trainer+ Section and Age Group Reassignment vulnerability

Trainer+ Section and Age Group Reassignment vulnerability discovered by Doston Abdullayev in WordPress Plugin Squadeno versions 1.12.0...

WordPress Envira Gallery plugin < 1.16.2 - Author+ IDOR vulnerability

Author+ IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Envira Photo Gallery versions 1.16.2...

WordPress Post Snippets plugin <= 4.2.4 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Post Snippets versions = 4.2.4...

WordPress MemberHero plugin <= 6.9 - Subscriber+ Arbitrary Email Sending vulnerability

Subscriber+ Arbitrary Email Sending vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simple User Registration versions = 6.9...

WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Je22y in WordPress Plugin ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce versions = 2.2.4...

WordPress Gallery PhotoBlocks plugin <= 1.3.5 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Andy Urlep in WordPress Plugin Gallery PhotoBlocks versions = 1.3.5...

WordPress Tutor LMS plugin 4.0.5-4.1.0 - Instructor+ Arbitrary Post Reparenting vulnerability

Instructor+ Arbitrary Post Reparenting vulnerability discovered by vuxvinh in WordPress Plugin Tutor LMS versions 4.0.5-4.1.0...

WordPress W3 Total Cache plugin < 2.10.6 - Author+ Path Traversal vulnerability

Author+ Path Traversal vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin W3 Total Cache versions 2.10.6...

WordPress Accept PayPal Payments using Contact Form 7 plugin < 4.0.7 - Unauthenticated PII Disclosure vulnerability

Unauthenticated PII Disclosure vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Accept PayPal Payments using Contact Form 7 versions 4.0.7...

WordPress Portfolio Filter Gallery plugin < 2.2.1 - Contributor+ Missing Authorization vulnerability

Contributor+ Missing Authorization vulnerability discovered by Artus KG in WordPress Plugin Portfolio Gallery – Image Gallery Plugin versions 2.2.1...

WordPress Booking Package plugin < 1.7.30 - Unauthenticated Booking Customer PII Disclosure vulnerability

Unauthenticated Booking Customer PII Disclosure vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Booking Package versions 1.7.30...

WordPress Rank Math SEO plugin < 1.0.280 - Admin+ Arbitrary File Upload to RCE vulnerability

Admin+ Arbitrary File Upload to RCE vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Rank Math SEO versions 1.0.280...

WordPress Rank Math SEO plugin < 1.0.280 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Rank Math SEO versions 1.0.280...

WordPress Rank Math SEO plugin < 1.0.280 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Rank Math SEO versions 1.0.280...

WordPress MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin <= 5.0.19 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by George Chen in WordPress Plugin MultiVendorX versions = 5.0.19...

NPM: TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

NPM: TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment vulnerability discovered by ? in WordPress Npm tinacms versions = 3.13.0...

WordPress Divi Plus plugin <= 2.4.0 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by ShinThink in WordPress Plugin Divi Plus versions = 2.4.0...

WordPress Avada | Website Builder For WordPress & WooCommerce theme <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Muhamad Visat in WordPress Theme Avada versions = 7.16.1...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin HivePress versions = 1.7.31...

WordPress SureDash – Community, Courses & Member Dashboard plugin <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by dzaku in WordPress Plugin SureDash versions = 1.12.1...

WordPress WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin <= 44.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin WPO365 versions = 44.1...

WordPress Email Marketing for WordPress and WooCommerce – Retainful plugin <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Trithem in WordPress Plugin Email Marketing for WordPress and WooCommerce – Retainful versions = 1.0.10...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin LatePoint versions = 5.7.2...

WordPress FunnelKit – Funnel Builder for WooCommerce Checkout plugin <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Funnel Builder by FunnelKit versions = 3.16.0.5...

WordPress Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Molongui versions = 5.2.12...

WordPress Motors – Car Dealership & Classified Listings Plugin plugin <= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Kamil B. in WordPress Plugin Motors versions = 1.4.125...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by dzaku in WordPress Plugin Kirki versions = 6.3.1...

WordPress WP Meteor Website Speed Optimization Addon plugin <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin WP Meteor Page Speed Optimization Topping versions = 3.4.18...

WordPress WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin <= 44.1 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Wordfence PRISM in WordPress Plugin WPO365 versions = 44.1...

WordPress WP Directory Kit plugin <= 1.5.9 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP Directory Kit versions = 1.5.9...

WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access vulnerability discovered by Brian Mungai in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 5.0.2...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WPDM – Premium Packages versions = 7.2.6...