WordPress Ultimate Member plugin 2.6.7-2.12.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Ultimate Member versions 2.6.7-2.12.1...

WordPress WP Rocket plugin <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint vulnerability

Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocketbeacon Endpoint vulnerability discovered by WordFence in WordPress Plugin WP Rocket versions = 3.21.0.1...

WordPress WP Rocket plugin 3.23.1-3.23.3.2 - Unauthenticated Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure vulnerability discovered by Unknown in WordPress Plugin WP Rocket versions 3.23.1-3.23.3.2...

WordPress User Registration & Membership plugin < 5.2.6 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by Artus KG in WordPress Plugin User Registration versions 5.2.6...

WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by JunHee CHO in WordPress Plugin WPBulky versions = 1.2.2...

WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability

Other vulnerability Type vulnerability discovered by Ahmed Hassan in WordPress Plugin Forminator versions = 1.57.1...

WordPress Shared Files plugin < 1.7.67 - Unauthenticated Limited File Upload vulnerability

Unauthenticated Limited File Upload vulnerability discovered by hoangphuong in WordPress Plugin Shared Files versions 1.7.67...

WordPress Shared Files Pro plugin < 1.7.70 - Unauthenticated Limited File Upload vulnerability

Unauthenticated Limited File Upload vulnerability discovered by hoangphuong in WordPress Plugin Shared Files Pro versions 1.7.70...

WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Udin Chan in WordPress Plugin GiveWP versions = 4.16.7.1...

WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jiemook in WordPress Plugin Throws SPAM Away versions = 3.8.2...

WordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by JunHee CHO in WordPress Plugin Simple Payment versions = 2.5.2...

WordPress Booking for Appointments and Events Calendar plugin <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission vulnerability

Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission vulnerability discovered by Lucas Montes NiRoX in WordPress Plugin Amelia versions = 2.2...

WordPress wpForo Forum plugin <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter vulnerability

Unauthenticated SQL Injection via 'referer' Parameter vulnerability discovered by Leonid Semenenko lsemenenko in WordPress Plugin wpForo Forum versions = 2.4.17...

WordPress ElementsKit Pro plugin <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 's' Parameter vulnerability discovered by Ren Voza in WordPress Plugin ElementsKit Pro versions = 4.10.1...

WordPress Tutor LMS plugin <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability

Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability discovered by Slopothecary in WordPress Plugin Tutor LMS versions = 4.0.5...

WordPress One User Avatar | User Profile Picture plugin <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via wpua-file Parameter vulnerability discovered by Dthangws - PTIT in WordPress Plugin One User Avatar versions = 2.5.4...

WordPress LiteSpeed Cache plugin <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability discovered by Jack Taylor in WordPress Plugin LiteSpeed Cache versions = 7.8.1...

WordPress Forminator Forms plugin <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability

Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.57.0.1...

WordPress TranslatePress plugin <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser vulnerability discovered by daroo in WordPress Plugin TranslatePress versions = 3.3.3...

WordPress Optimole plugin <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'a' abovefoldimages Parameter vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Optimole versions = 4.2.10...

WordPress Envira Gallery plugin <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Gallery Description vulnerability discovered by lord willmore - self in WordPress Plugin Envira Photo Gallery versions = 1.12.4...

WordPress GiveWP plugin <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by daroo in WordPress Plugin GiveWP versions = 4.14.4...

WordPress Breeze Cache plugin < 2.5.13 - Unauthenticated Limited File Creation vulnerability

Unauthenticated Limited File Creation vulnerability discovered by Jakub Herman in WordPress Plugin Breeze versions 2.5.13...

WordPress Quiz and Survey Master (QSM) plugin < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure vulnerability

Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Quiz And Survey Master versions 11.2.4...

WordPress User Registration & Membership plugin < 5.2.5 - Subscriber+ Pending Email Change Cancellation vulnerability

Subscriber+ Pending Email Change Cancellation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin User Registration versions 5.2.5...

WordPress User Frontend plugin < 4.3.10 - Unauthenticated User Email and Phone Disclosure vulnerability

Unauthenticated User Email and Phone Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP User Frontend versions 4.3.10...

WordPress WCFM Marketplace plugin < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders vulnerability

Unauthenticated Refund Request Creation on Guest Orders vulnerability discovered by Shikhali Jamalzade in WordPress Plugin WCFM Marketplace versions 3.8.2...

WordPress Avada (Fusion) Builder plugin <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'size' Shortcode Attribute vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Plugin Fusion Builder versions = 3.15.6...

WordPress LiteSpeed Cache plugin <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes vulnerability

Authenticated Author+ Stored Cross-Site Scripting via img Tag Attributes vulnerability discovered by stealthcopter in WordPress Plugin LiteSpeed Cache versions = 7.7...

WordPress Smart Slider 3 plugin <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'slider' Block Attribute vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Smart Slider 3 versions = 3.5.1.38...

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write vulnerability discovered by ? in WordPress Npm libreoffice-convert versions 1.8.2...

NPM: n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

NPM: n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path dbpath parameter vulnerability discovered by ? in WordPress Npm n8n-nodes-sqlite3 versions 1.0.0...

WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Theme Uncode versions = 2.12.7...

WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jiemook in WordPress Plugin Email Subscribers & Newsletters versions = 5.9.33...

WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14.2...

WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Asim Alshaya in WordPress Plugin Smush Image Compression and Optimization versions = 4.2.0...

WordPress Essential Addons for Elementor plugin <= 6.8.0 - Bypass vulnerability vulnerability

Bypass vulnerability vulnerability discovered by Gaurav popalghat in WordPress Plugin Essential Addons for Elementor versions = 6.8.0...

WordPress Rank Math SEO plugin <= 1.0.276 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Rank Math SEO versions = 1.0.276...

WordPress FoodBoxBooker plugin < 1.0.7 - Unauthenticated Arbitrary Password Reset vulnerability

Unauthenticated Arbitrary Password Reset vulnerability discovered by moonge in WordPress Plugin FoodBoxBooker versions 1.0.7...

WordPress AI Engine plugin 3.3.3-3.7.2 - 3.7.1 - Subscriber+ Arbitrary File Read vulnerability

WordPress AI Engine plugin 3.3.3-3.7.2 - 3.7.1 - Subscriber+ Arbitrary File Read vulnerability discovered by Jashid Sany in WordPress Plugin AI Engine versions 3.3.3-3.7.1...

WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Read vulnerability

Subscriber+ Arbitrary File Read vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...

WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Deletion vulnerability

Subscriber+ Arbitrary File Deletion vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin Workeera versions 1.0.6...

WordPress Workeera plugin < 1.0.6 - Subscriber+ Arbitrary File Upload vulnerability

Subscriber+ Arbitrary File Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin Workeera versions 1.0.6...

WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...

WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by sungbyeongchan in WordPress Plugin WpEvently versions = 5.5.0...

WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Md Mehedi Hasan in WordPress Plugin WP Job Portal versions = 2.5.9...

WordPress RestrictMate plugin < 1.3.0 - Unauthenticated Privilege Escalation to Administrator vulnerability

Unauthenticated Privilege Escalation to Administrator vulnerability discovered by João Ramos Maciel in WordPress Plugin RestrictMate versions 1.3.0...

WordPress WPCargo Track & Trace plugin < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number vulnerability

Unauthenticated SQL Injection via wpcargotrackingnumber vulnerability discovered by Shivamani Vastrala in WordPress Plugin WPCargo Track & Trace versions 8.0.4...

WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ACF Extended versions = 0.9.2.6...

WordPress All-in-One Video Gallery plugin < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter vulnerability

Subscriber+ Server-Side Request Forgery via 'vdl' Parameter vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin All-in-One Video Gallery versions 4.9.2...