WordPress WPCOM Member plugin <= 1.7.27 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Mohamed Khater in WordPress Plugin WPCOM Member versions = 1.7.27...

WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 2.0.2.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Contact Form by WPForms versions = 2.0.2.1...

WordPress User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP User Frontend versions = 4.3.12...

WordPress WP Photo Album Plus plugin <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nh4tvd in WordPress Plugin WP Photo Album Plus versions = 9.3.03.002...

WordPress PeproDev Ultimate Profile Solutions plugin <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin PeproDev Ultimate Profile Solutions versions = 8.2.36...

WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Listdom versions = 6.1.2...

WordPress AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin AutomatorWP versions = 5.8.4...

WordPress WP File Download plugin <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Deletion/Modification vulnerability discovered by t4g0 in WordPress Plugin WP File Download versions = 6.3.9...

WordPress Post Grid Gutenberg Blocks – PostX plugin <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by dzaku in WordPress Plugin PostX versions = 5.1.0...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions = 2.34.8...

WordPress Presto Player plugin <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by 20kilograma in WordPress Plugin Presto Player versions = 4.5.1...

WordPress LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Rocket Lazy Load versions = 2.4.0...

WordPress Payment Plugins for Stripe WooCommerce plugin <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Stripe For WooCommerce versions = 4.0.17...

WordPress Simple Membership plugin <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Maciej Komorowski in WordPress Plugin Simple Membership versions = 4.8.4...

WordPress Noptin – Newsletter, New Post Notifications & Email Automation plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Noptin versions = 4.3.10...

WordPress Podlove Podcast Publisher plugin <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin Podlove Podcast Publisher versions = 4.5.6...

WordPress WP Booking System – Booking Calendar plugin <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Spy0x7 in WordPress Plugin WP Booking System versions = 2.1.0.1...

WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 34.0.10 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by whatm in WordPress Plugin PPOM for WooCommerce versions = 34.0.10...

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions = 1.8.15...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter vulnerability

Authenticated Custom+ Privilege Escalation to 'settingsdefaultwproleforcustomer' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin LatePoint versions = 5.7.3...

WordPress GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Supakiad S. m3ez in WordPress Plugin GamiPress versions = 7.9.4...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion vulnerability

Unauthenticated Privilege Escalation to Support User Identity Confusion vulnerability discovered by Wordfence PRISM in WordPress Plugin Groundhogg versions = 4.8.3...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter vulnerability

Authenticated Custom+ Privilege Escalation to 'user' Parameter vulnerability discovered by Wordfence PRISM in WordPress Plugin Groundhogg versions = 4.9...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Zenith-sec in WordPress Plugin JetFormBuilder versions = 3.6.6...

WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification vulnerability

Missing Authorization to Authenticated Custom+ Sensitive Data Exposure and Modification vulnerability discovered by Nadir Şensoy in WordPress Plugin FluentForm versions = 6.2.5...

WordPress Download Manager plugin <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting vulnerability

Unauthenticated DOM-Based Reflected Cross-Site Scripting vulnerability discovered by Yuvraj Tomar in WordPress Plugin Download Manager versions = 3.3.57...

WordPress Frontend Admin by DynamiApps plugin <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Frontend Admin by DynamiApps versions = 3.28.36...

WordPress Graphene theme <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Theme Graphene versions = 2.9.4...

WordPress Real Estate Manager – Property Listing and Agent Management plugin <= 7.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Morato Antoine in WordPress Plugin Real Estate Manager versions = 7.3...

WordPress Church Admin plugin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by 刀 妖 in WordPress Plugin Church Admin versions = 5.1.2...

WordPress Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by skyv3il, AmonRa in WordPress Plugin Easy Digital Downloads versions = 3.6.9...

WordPress FooSales – Point of Sale (POS) for WooCommerce plugin <= 1.43.0 - Authenticated (Custom+) Privilege Escalation vulnerability

Authenticated Custom+ Privilege Escalation vulnerability discovered by Supakiad S. m3ez in WordPress Plugin FooSales versions = 1.43.0...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.187 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin GeoDirectory versions = 2.8.187...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin HivePress versions = 1.7.31...

WordPress FV Player 8 plugin <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Supakiad S. m3ez in WordPress Plugin FV Player 8 versions = 8.1.7...

WordPress Team – Team Members Showcase Plugin plugin <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Team versions = 6.0.2...

WordPress SpeedyCache – Cache, Optimization, Performance plugin <= 1.4.2 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Kuba in WordPress Plugin SpeedyCache versions = 1.4.2...

WordPress SiteOrigin Widgets Bundle plugin <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read vulnerability

Authenticated Contributor+ Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin SiteOrigin Widgets Bundle versions = 1.74.3...

WordPress Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin <= 6.88 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Maciej Komorowski in WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk versions = 6.88...

WordPress Responsive Lightbox & Gallery plugin <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by Jakub Herman in WordPress Plugin Responsive Lightbox versions = 2.7.9...

WordPress Post Export Import with Media plugin <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin Post Export Import with Media versions = 1.17.1...

WordPress Smart Popup by Supsystic plugin <= 1.13.2 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Popup by Supsystic versions = 1.13.2...

WordPress Order Export & Order Import for WooCommerce plugin <= 2.7.8 - Unauthenticated Sensitive File Exposure vulnerability

Unauthenticated Sensitive File Exposure vulnerability discovered by Boluwatife Opeyemi tcyph3r in WordPress Plugin Order Export & Order Import for WooCommerce versions = 2.7.8...

WordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.14.2...

WordPress LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin <= 10.2.1 - Authenticated (Custom+) PHP Object Injection vulnerability

Authenticated Custom+ PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin LifterLMS versions = 10.2.1...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin LatePoint versions = 5.7.2...

WordPress Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.12...

WordPress Avada (Fusion) Builder plugin <= 3.16.1 - Unauthenticated Arbitrary WordPress Action Invocation vulnerability

Unauthenticated Arbitrary WordPress Action Invocation vulnerability discovered by Chloe Chamberland, Wordfence Argus in WordPress Plugin Fusion Builder versions = 3.16.1...

WordPress AI Puffer – AI Chatbot, AI Writer & Automation plugin <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Semantic Search Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin GPT3 AI Content Writer versions = 2.4.89...

WordPress AI Puffer – AI Chatbot, AI Writer & Automation plugin <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Global Plugin Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin GPT3 AI Content Writer versions = 2.4.89...