52658 matches found
WordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin GiveWP versions = 4.17.0...
WordPress Advanced IP Blocker plugin <= 8.13.13 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced IP Blocker versions = 8.13.13...
WordPress Blocksy Companion plugin <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter vulnerability
Unauthenticated Privilege Escalation to 'role' Parameter vulnerability discovered by Sawyer in WordPress Plugin Blocksy Companion versions = 2.1.58...
WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.14 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Santh in WordPress Plugin FluentForm versions = 6.2.14...
WordPress Getwid – Gutenberg Blocks plugin <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin Getwid versions = 3.0.1...
WordPress Table Field Add-on for ACF and SCF plugin <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Table Field Add-on for ACF and SCF versions = 1.3.35...
WordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Deva Parekh in WordPress Plugin Embed Any Document versions = 2.7.13...
WordPress Booking Calendar plugin <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action vulnerability
Unauthenticated Sensitive Information Exposure in 'WPBCFLEXTIMELINENAV' AJAX Action vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Booking Calendar versions = 11.4.3...
WordPress Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.48 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Form Maker by 10Web versions = 1.15.48...
WordPress Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin <= 3.4.5 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin Extensions For CF7 versions = 3.4.5...
WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.6 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Filter Everything — WordPress & WooCommerce Filters versions = 1.9.6...
WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation vulnerability
Insecure Direct Object Reference to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin Bookly versions = 28.4...
WordPress Data Tables Generator by Supsystic plugin <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by braintx in WordPress Plugin Data Tables Generator by Supsystic versions = 1.15.1...
WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Tai Ha superx in WordPress Plugin GeoDirectory versions = 2.8.188...
WordPress 3D Product configurator for WooCommerce plugin <= 2.16.2 - Unauthenticated Remote Code Execution vulnerability
Unauthenticated Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin 3D Product configurator for WooCommerce versions = 2.16.2...
WordPress Brizy – Page Builder plugin <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Brizy versions = 2.8.18...
WordPress Data Tables Generator by Supsystic plugin <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Data Tables Generator by Supsystic versions = 1.12.03...
WordPress Table Field Add-on for ACF and SCF plugin < 1.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via Table Field Value vulnerability discovered by Kuba in WordPress Plugin Table Field Add-on for ACF and SCF versions 1.4.1...
WordPress Download Manager plugin <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Download Manager versions = 3.3.58...
WordPress Hello Plus plugin <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation vulnerability
Authenticated Contributor+ Missing Authorization to Template Activation vulnerability discovered by normaandersonfrank in WordPress Plugin Hello Plus versions = 1.7.7...
WordPress Advanced Form Integration plugin <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action vulnerability
Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action vulnerability discovered by wachiss - Datafarm Co., Ltd. in WordPress Plugin Advanced Form Integration versions = 2.9.0...
WordPress FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin <= 3.1.13 - Authenticated (Author+) SQL Injection vulnerability
Authenticated Author+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin FireBox versions = 3.1.13...
WordPress RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Feedzy versions = 5.2.10...
WordPress Fastcache by Host.it plugin <= 1.7.4 - Authenticated (Administrator+) Code Injection vulnerability
Authenticated Administrator+ Code Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Fastcache by Host.it versions = 1.7.4...
WordPress Download Manager plugin <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure vulnerability
Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Sawyer in WordPress Plugin Download Manager versions = 3.3.71...
WordPress Download Manager plugin <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Download Manager versions = 3.3.71...
WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details vulnerability
Unauthenticated Sensitive Information Exposure in 'phone' Parameter to booklyrenderdetails vulnerability discovered by R3D in WordPress Plugin Bookly versions = 28.4...
WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme TouchUp versions 1.4...
WordPress Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint vulnerability
Authenticated Custom+ Privilege Escalation to addchild REST endpoint vulnerability discovered by Wordfence PRISM in WordPress Plugin Academy LMS versions = 4.0.3...
WordPress Livees Checkout plugin 6.8-7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure vulnerability
Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Livees Checkout versions 6.8-7.0.2...
WordPress Shipping for Nova Poshta plugin 1.18.7-1.19.8 - Unauthenticated Order Shipment Record Deletion vulnerability
Unauthenticated Order Shipment Record Deletion vulnerability discovered by Emiliano Carrizo in WordPress Plugin Shipping for Nova Poshta versions 1.18.7-1.19.8...
WordPress Testimonials by BestWebSoft plugin 1.0.5-1.0.8 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Testimonials by BestWebSoft versions 1.0.5-1.0.8...
WordPress UnitechPay plugin <= 1.0.6.3 - Unauthenticated Order Payment Bypass vulnerability
Unauthenticated Order Payment Bypass vulnerability discovered by Timur in WordPress Plugin UnitechPay versions = 1.0.6.3...
WordPress SKU Error Fixer for WooCommerce plugin <= 1.0 - Unauthenticated Orphaned Product Variation Deletion vulnerability
Unauthenticated Orphaned Product Variation Deletion vulnerability discovered by Naoki Kawahigashi in WordPress Plugin SKU Error Fixer for WooCommerce versions = 1.0...
WordPress FooSales plugin < 1.43.3 - Cashier+ Privilege Escalation vulnerability
Cashier+ Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin FooSales versions 1.43.3...
WordPress Advanced Classifieds & Directory Pro plugin <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability
Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin Advanced Classifieds & Directory Pro versions = 3.4.4...
WordPress Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion vulnerability
Missing Authorization to Authenticated Custom+ Arbitrary Academy Comment Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Academy LMS versions = 4.0.3...
WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Angio versions = 1.1.1...
WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Tonda Membership versions = 1.0.1...
WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by JunHee CHO in WordPress Plugin CodeBard Help Desk versions = 1.1.2...
WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by JunHee CHO in WordPress Plugin MicroPayments versions = 3.2.9...
WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by V1T in WordPress Plugin Tailored Tools versions = 3.0.3...
WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by JunHee CHO in WordPress Plugin Dashboard Notes versions = 1.0.3...
WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Asim Alshaya in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.7...
WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by endy in WordPress Plugin uListing versions = 2.2.0...
WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin eRoom versions = 1.7.1...
WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Team Section Block versions = 2.0.4...
WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Asim Alshaya in WordPress Plugin StreamCast versions = 2.4.6...
WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Document Embedder versions = 2.4.0...