WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by CoryRoo in WordPress Plugin Hash Form versions = 1.4.2...

WordPress Forminator Forms plugin < 1.57.0.7 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by Thanh Lam Tang in WordPress Plugin Forminator versions 1.57.0.7...

WordPress Booking for Appointments and Events Calendar plugin 9.0-9.7 - Provider+ Arbitrary Provider Password Update vulnerability

Provider+ Arbitrary Provider Password Update vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 9.0-9.7...

WordPress Events Manager plugin <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter vulnerability

Reflected Cross-Site Scripting via 'headerformat' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Events Manager versions = 7.4.0.1...

WordPress All-in-One WP Migration Unlimited Extension plugin <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'ai1wmbackupspath' Parameter vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin All-in-One WP Migration Unlimited Extension versions = 2.84...

WordPress Return Refund and Exchange For WooCommerce plugin < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation vulnerability

Unauthenticated Guest Order Message Disclosure and Manipulation vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Return Refund and Exchange For WooCommerce versions 4.6.4...

WordPress Customer Reviews for WooCommerce plugin <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form vulnerability

Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form vulnerability discovered by daroo in WordPress Plugin Customer Reviews for WooCommerce versions = 5.106.0...

WordPress Squeeze plugin < 1.7.12 - Author+ Arbitrary File Upload vulnerability

Author+ Arbitrary File Upload vulnerability discovered by Ezekiel Victor in WordPress Plugin Squeeze versions 1.7.12...

WordPress Pods plugin 3.1.0-3.3.9.1 - Author+ RCE vulnerability

Author+ RCE vulnerability discovered by Tyler Chin in WordPress Plugin Pods versions 3.3.9.1...

WordPress 12 Step Meeting List plugin 3.17-3.19.16 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Huseyn in WordPress Plugin 12 Step Meeting List versions 3.17-3.19.16...

WordPress AI Engine plugin 3.4.0-3.7.1 - Unauthenticated Arbitrary AI Query Execution vulnerability

Unauthenticated Arbitrary AI Query Execution vulnerability discovered by Abdullah Kareem in WordPress Plugin AI Engine versions 3.4.0-3.7.1...

WordPress CMP plugin < 4.1.18 - Editor+ Privilege Escalation vulnerability

Editor+ Privilege Escalation vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.18...

WordPress Document Embedder plugin < 2.3.1 - Unauthenticated Private Document Download vulnerability

Unauthenticated Private Document Download vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Document Embedder versions 2.3.1...

WordPress Order Tip for WooCommerce plugin < 1.6.0 - Shop Manager+ Arbitrary File Deletion vulnerability

Shop Manager+ Arbitrary File Deletion vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Order Tip for WooCommerce versions 1.6.0...

WordPress TranslatePress plugin <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via Approved Comment Body in Translation Editor vulnerability discovered by momopon1415 in WordPress Plugin TranslatePress versions = 3.2.6...

WordPress Content Mask plugin 1.8.0-1.8.5.4 - Contributor Publish Capability Bypass vulnerability

Contributor Publish Capability Bypass vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin Content Mask versions 1.8.0-1.8.5.4...

WordPress Brave plugin < 0.8.6 - Unauthenticated Reflected XSS vulnerability

Unauthenticated Reflected XSS vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Brave versions 0.8.6...

WordPress Slider Hero with Video Background, Animation plugin < 9.1.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Slider Hero versions 9.1.3...

WordPress Tutor LMS plugin < 4.0.6 - Instructor+ Arbitrary File Read vulnerability

Instructor+ Arbitrary File Read vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Tutor LMS versions 4.0.6...

WordPress ProfilePress plugin < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name vulnerability

Unauthenticated Arbitrary Shortcode Execution via Display Name vulnerability discovered by Jakub Herman in WordPress Plugin ProfilePress versions 4.17.1...

WordPress ProSolution WP Client plugin < 2.0.11 - Reflected XSS via 'page' Parameter vulnerability

Reflected XSS via 'page' Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin ProSolution WP Client versions 2.0.11...

WordPress ProSolution WP Client plugin < 2.0.11 - Reflected XSS via Multiple Parameters vulnerability

Reflected XSS via Multiple Parameters vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.11...

WordPress Dokan plugin < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API vulnerability

Shop Manager+ Arbitrary Plugin Installation/Activation via REST API vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Dokan versions 5.0.14...

WordPress NextScripts: Social Networks Auto-Poster plugin < 4.4.8 - Reflected XSS via Facebook OAuth Callback vulnerability

Reflected XSS via Facebook OAuth Callback vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin NextScripts versions 4.4.8...

WordPress Welcart e-Commerce plugin < 2.12.1 - Session Fixation via uscesid Parameter vulnerability

Session Fixation via uscesid Parameter vulnerability discovered by bRpsd in WordPress Plugin Welcart e-Commerce versions 2.12.1...

WordPress Animation Addons for Elementor plugin < 2.7.2 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Seongwon Lee in WordPress Plugin Animation Addons for Elementor versions 2.7.2...

WordPress WooMS plugin <= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure vulnerability

Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure vulnerability discovered by dangnosuy in WordPress Plugin WooMS versions = 9.14...

WordPress JetEngine plugin < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) vulnerability

Unauthenticated Stored XSS via Form File Upload SVG vulnerability discovered by Nguyễn Đức Hòa in WordPress Plugin JetEngine versions 3.8.13.1...

WordPress LWS Optimize plugin < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring vulnerability

Unauthenticated Stored XSS via Real User Monitoring vulnerability discovered by Artus KG in WordPress Plugin LWS Optimize versions 4.1.2...

WordPress wpDiscuz plugin < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion vulnerability

Unauthenticated Stored XSS via Image URL Conversion vulnerability discovered by hieus in WordPress Plugin wpDiscuz versions 7.6.60...

WordPress Simple Membership plugin < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name vulnerability

Unauthenticated Stored XSS via PayPal Subscription Subscriber Name vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simple Membership versions 4.7.8...

WordPress WP Maps plugin < 4.9.7 - Subscriber+ Local File Inclusion vulnerability

Subscriber+ Local File Inclusion vulnerability discovered by Jakub Herman in WordPress Plugin WP Maps versions 4.9.7...

WordPress WP Maps Pro plugin < 6.1.3 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Jakub Herman in WordPress Plugin Advanced Google Maps versions 6.1.3...

WordPress Content Views plugin < 4.5 - Subscriber+ SQL Injection via preview_request vulnerability

Subscriber+ SQL Injection via previewrequest vulnerability discovered by Jakub Herman in WordPress Plugin Content Views versions 4.5...

WordPress Library Management System plugin < 3.6.7 - Subscriber+ SQL Injection via Filter Value vulnerability

Subscriber+ SQL Injection via Filter Value vulnerability discovered by João Ramos Maciel in WordPress Plugin Library Management System versions 3.6.7...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 8.5-8.9.2 - Subscriber+ Arbitrary Image Move vulnerability

Subscriber+ Arbitrary Image Move vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Directorist versions 8.5-8.9.2...

WordPress Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates plugin < 3.7.1 - Unauthenticated API Secret Disclosure vulnerability

Unauthenticated API Secret Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin WPLegalPages versions 3.7.1...

WordPress Events Manager plugin < 7.4.1 - Unauthenticated Privilege Escalation to Administrator vulnerability

Unauthenticated Privilege Escalation to Administrator vulnerability discovered by Jakub Herman in WordPress Plugin Events Manager versions 7.4.1...

WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure vulnerability

Unauthenticated OAuth Token and User Data Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WP OAuth Server versions 6.3.1...

WordPress StoreGrowth plugin < 2.1.2 - Unauthenticated Arbitrary Price Manipulation vulnerability

Unauthenticated Arbitrary Price Manipulation vulnerability discovered by Shikhali Jamalzade in WordPress Plugin StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart versions 2.1.2...

WordPress Advanced File Manager plugin < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui vulnerability

Authenticated Arbitrary File Read and Write via fmaloadfmaui vulnerability discovered by Christian Kold Jensen in WordPress Plugin Advanced File Manager versions 5.4.13...

WordPress Firebase Authentication plugin < 1.7.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Abdullah Kareem in WordPress Plugin Firebase Authentication versions 1.7.1...

WordPress WPMU DEV Dashboard plugin <= 5.0.1 - Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion vulnerability

Authentication Bypass to Administrator via SSO HMAC Canonicalization Confusion vulnerability discovered by WordFence in WordPress Plugin WPMU DEV Dashboard versions = 5.0.1...

WordPress Product Input Fields for WooCommerce plugin < 2.0.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Farid Narimanov in WordPress Plugin Product Input Fields for WooCommerce versions 2.0.2...

WordPress Bit File Manager plugin < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch vulnerability

Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch vulnerability discovered by Artus KG in WordPress Plugin Bit File Manager versions 6.9.1...

WordPress Forminator Forms plugin < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation vulnerability

Unauthenticated Multisite Site Creation and Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Forminator versions 1.57.1...

WordPress Everest Forms plugin <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' vulnerability

Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value' vulnerability discovered by h0xilo in WordPress Plugin Everest Forms versions = 3.4.4...

WordPress Shared Files Pro plugin < 1.7.68 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files Pro versions 1.7.68...

WordPress Shared Files plugin < 1.7.67 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files versions 1.7.67...

WordPress User Frontend plugin < 4.3.10 - Editor+ PHP Object Injection vulnerability

Editor+ PHP Object Injection vulnerability discovered by Hijun Kim in WordPress Plugin WP User Frontend versions 4.3.10...