WordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Eduma versions = 5.7.6...

WordPress Booster for WooCommerce plugin <= 7.3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Booster for WooCommerce versions = 7.3.2...

WordPress WP Last Modified Info plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin WP Last Modified Info versions = 1.9.2...

WordPress DirectoryPress plugin <= 3.6.25 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin DirectoryPress versions = 3.6.25...

WordPress Related Posts Lite plugin <= 1.12 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Tst23@1 in WordPress Plugin Related Posts Lite versions = 1.12...

WordPress Theme Editor plugin <= 3.0 - Cross-Site Request Forgery to Remote Code Execution vulnerability

Cross-Site Request Forgery to Remote Code Execution vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Theme Editor versions = 3.0...

WordPress Kognetiks Chatbot plugin <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing vulnerability

Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Kognetiks Chatbot for WordPress versions = 2.3.5...

WordPress PowerBI Embed Reports plugin <= 1.2.0 - Unauthenticated Sensitive Information Disclosure vulnerability

Unauthenticated Sensitive Information Disclosure vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin PowerBI Embed Reports versions = 1.2.0...

WordPress LearnPress plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation vulnerability

Missing Authorization to Unauthenticated Database Table Manipulation vulnerability discovered by Lucas Montes Nirox in WordPress Plugin LearnPress versions = 4.2.9.3...

WordPress Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Essential Blocks for Gutenberg versions = 5.7.1...

WordPress WPC Smart Quick View for WooCommerce plugin <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure vulnerability

Insecure Direct Object Reference to Unauthenticated Private Product Exposure vulnerability discovered by Lucas Montes Nirox in WordPress Plugin WPC Smart Quick View for WooCommerce versions = 4.2.5...

WordPress FileBird plugin <= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset vulnerability

Improper Authorization to Authenticated Author+ Settings Reset vulnerability discovered by fuchong jun in WordPress Plugin Filebird versions = 6.4.9...

WordPress WPBakery Page Builder plugin <= 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by stealthcopter in WordPress Plugin WPBakery Page Builder versions = 8.6...

WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 33.0.15 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Talal Nasraddeen in WordPress Plugin PPOM for WooCommerce versions = 33.0.15...

WordPress PPOM – Product Addons & Custom Fields for WooCommerce plugin <= 33.0.15 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Talal Nasraddeen in WordPress Plugin PPOM for WooCommerce versions = 33.0.15...

WordPress Event Tickets and Registration plugin <= 5.26.5 - Unauthenticated Ticket Payment Bypass vulnerability

Unauthenticated Ticket Payment Bypass vulnerability discovered by Jack Pas Dark. in WordPress Plugin Event Tickets versions = 5.26.5...

WordPress Image optimization service by Optimole plugin <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload vulnerability

Insecure Direct Object Reference to Authenticated Author+ Media Offload vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Optimole versions = 4.1.0...

WordPress GSpeech TTS – WordPress Text To Speech Plugin plugin <= 3.17.13 - Authenticated (Admin+) SQL injection vulnerability

Authenticated Admin+ SQL injection vulnerability discovered by Moose Love in WordPress Plugin GSpeech TTS versions = 3.17.3...

WordPress WP Go Maps (formerly WP Google Maps) plugin <= 9.0.48 - Unauthenticated Cache Poisoning vulnerability

Unauthenticated Cache Poisoning vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin WP Go Maps versions = 9.0.48...

WordPress Redirection for Contact Form 7 plugin <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via qsdate Shortcode vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Redirection for Contact Form 7 versions = 3.2.6...

WordPress WPC Smart Wishlist for WooCommerce plugin <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Information Exposure vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin WPC Smart Wishlist for WooCommerce versions = 5.0.4...

WordPress Media Library Assistant plugin <= 3.29 - Unauthenticated Limited File Read vulnerability

Unauthenticated Limited File Read vulnerability discovered by Lucas Montes Nirox in WordPress Plugin Media LIbrary Assistant versions = 3.29...

WordPress XX2WP Integration Tools plugin <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin XX2WP Integration Tools versions = 1.9.9...

WordPress Essential Blocks plugin <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery vulnerability

Authenticated Author+ Server-Side Request Forgery vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Essential Blocks for Gutenberg versions = 5.7.1...

WordPress ShortPixel Image Optimizer plugin <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export vulnerability

Authenticated Contributor+ Settings Import/Export vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin ShortPixel Image Optimizer versions = 6.3.4...

WordPress GoCache plugin <= 1.3.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin GoCache versions = 1.3.6...

WordPress XStore Core plugin < 5.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin XStore Core versions 5.6...

WordPress Memberlite Shortcodes plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by zaim in WordPress Plugin Memberlite Shortcodes versions = 1.4.1...

WordPress Admin Management Xtended plugin <= 2.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Admin Management Xtended versions = 2.5.1...

WordPress Sale! Immigration law, Visa services support, Migration Agent Consulting theme <= 1.5.8 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Sale! Immigration law, Visa services support, Migration Agent Consulting versions = 1.5.8...

WordPress MDTF plugin <= 1.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by D01EXPLOIT in WordPress Plugin MDTF versions = 1.3.5...

WordPress KALLYAS theme < 4.25.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme KALLYAS versions 4.25.0...

WordPress Binary MLM Plan plugin <= 5.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Binary MLM Plan versions = 5.0...

WordPress Booking Manager plugin < 2.1.15 - Contributor+ Booking Deletion vulnerability

Contributor+ Booking Deletion vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Booking Manager versions 2.1.15...

WordPress WP Private Content Plus plugin <= 3.6.2 - Password Protection Bypass vulnerability

Password Protection Bypass vulnerability discovered by Lorenzo Camilli in WordPress Plugin WP Private Content Plus versions = 3.6.2...

WordPress Ally plugin <= 3.8.0 - Cross-Site Request Forgery to plugin Settings Update vulnerability

Cross-Site Request Forgery to plugin Settings Update vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Ally versions = 3.8.0...

WordPress SureRank plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ? in WordPress Plugin SureRank versions = 1.3.2...

WordPress Estatik plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Estatik versions = 4.3.0...

WordPress CloudSearch plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin CloudSearch versions = 3.0.0...

WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability

WordPress Houzez Theme - Functionality plugin 4.2.0 - Cross Site Scripting XSS vulnerability discovered by ? in WordPress Plugin Houzez Theme - Functionality versions 4.2.0...

WordPress MeetingHub plugin <= 1.23.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin MeetingHub versions = 1.23.9...

WordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Front End Users versions = 3.2.33...

WordPress Social proof testimonials and reviews by Repuso plugin <= 5.29 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Social proof testimonials and reviews by Repuso versions = 5.29...

WordPress WowRevenue plugin <= 1.2.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin WowRevenue versions = 1.2.13...

WordPress MDTF plugin <= 1.3.3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin MDTF versions = 1.3.3.8...

WordPress e2pdf plugin <= 1.28.09 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin e2pdf versions = 1.28.09...

WordPress WP Travel Gutenberg Blocks plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin WP Travel Gutenberg Blocks versions = 3.9.2...

WordPress Easy Post Submission plugin <= 1.7.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nabil Irawan in WordPress Plugin Easy Post Submission versions = 1.7.0...

WordPress Product Catalog Simple plugin <= 1.8.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Product Catalog Simple versions = 1.8.4...

WordPress Tab Ultimate plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin Tab Ultimate versions = 1.8...