WordPress Snap Finance plugin <= 3.11.0 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Ryan Fabella in WordPress Plugin Snap Finance versions = 3.12.0...

WordPress ElementsReady Addons for Elementor plugin <= 6.7.2 - Subscriber+ Plugin Settings Overwrite vulnerability

Subscriber+ Plugin Settings Overwrite vulnerability discovered by Stefan Spasic in WordPress Plugin ElementsReady Addons for Elementor versions = 6.7.2...

WordPress ElementsReady Addons for Elementor plugin <= 6.7.2 - Unauthenticated Paid Download Access Bypass vulnerability

Unauthenticated Paid Download Access Bypass vulnerability discovered by ryan fabella in WordPress Plugin ElementsReady Addons for Elementor versions = 6.7.2...

WordPress FormFlow for GoHighLevel (GHL) plugin <= 1.0.0 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Ehab M.Kandah in WordPress Plugin FormFlow for GoHighLevel GHL versions = 1.0.0...

WordPress Blaze Demo Importer plugin < 1.0.17 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Luis Schlegel in WordPress Plugin Blaze Demo Importer versions 1.0.17...

WordPress Gateway for Vantiv on WC plugin <= 1.0.1 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Gateway for Vantiv on WC versions = 1.0.1...

WordPress ActiveTrail for WooCommerce plugin <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation vulnerability

Unauthenticated Arbitrary Coupon Creation vulnerability discovered by Ryan Fabella in WordPress Plugin ActiveTrail for WooCommerce versions = 1.2.6...

WordPress AI Engine plugin < 3.7.9 - Editor+ Arbitrary Post Modification vulnerability

Editor+ Arbitrary Post Modification vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin AI Engine versions 3.7.9...

WordPress AI Engine plugin < 3.7.9 - Editor+ Arbitrary Post Deletion vulnerability

Editor+ Arbitrary Post Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin AI Engine versions 3.7.9...

WordPress Modern Events Calendar Lite plugin < 7.37.0 - Subscriber+ Sensitive Data Disclosure vulnerability

Subscriber+ Sensitive Data Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Modern Events Calendar Lite versions 7.37.0...

WordPress Salon Booking System plugin < 10.31.11 - Subscriber+ Coupon Code Disclosure vulnerability

Subscriber+ Coupon Code Disclosure vulnerability discovered by Andy Urlep in WordPress Plugin Salon booking system versions 10.31.11...

WordPress Salon Booking System plugin < 10.31.11 - Salon Staff+ Stored XSS and SSRF vulnerability

Salon Staff+ Stored XSS and SSRF vulnerability discovered by vuxvinh in WordPress Plugin Salon booking system versions 10.31.11...

WordPress Tasty Recipes Lite plugin 1.2-1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion vulnerability

Contributor+ Taxonomy Term Creation, Renaming and Deletion vulnerability discovered by Usama Arshad in WordPress Plugin Tasty Recipes Lite versions 1.2-1.2.10...

WordPress Otter Blocks plugin < 3.2.3 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by John Ryan Albon in WordPress Plugin Otter - Gutenberg Block versions 3.2.3...

WordPress PickPlugins Product Designer for WooCommerce plugin <= 1.0.40 - Unauthenticated Design Template Data Injection vulnerability

Unauthenticated Design Template Data Injection vulnerability discovered by Valida Abdullayeva in WordPress Plugin Product Designer versions = 1.0.40...

WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by AndrewN in WordPress Plugin HivePress versions = 1.7.32...

WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by hhhai in WordPress Plugin MapSVG versions = 8.16.1...

WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin Essential Addons for Elementor versions = 6.8.5...

WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by jydae in WordPress Plugin Tutor LMS versions = 4.1.2...

WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ihsan Saddan in WordPress Plugin Quiz And Survey Master versions = 11.2.7...

WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Taegyeong Yun in WordPress Plugin Quiz Maker versions = 6.7.1.91...

WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Peter Tang in WordPress Plugin MapSVG versions = 8.16.1...

WordPress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Passakorn Yookindee in WordPress Plugin User Registration versions = 5.2.8...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Kirki versions = 6.3.2...

WordPress YMC Filter plugin <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Author+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Filter & Grids versions = 3.12.19...

WordPress Rank Math SEO PRO plugin 3.0.123 - Unauthenticated Embedded Malicious Code vulnerability

Unauthenticated Embedded Malicious Code vulnerability discovered by ? in WordPress Plugin Rank Math SEO PRO versions 3.0.123...

WordPress Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin GetPaid versions = 2.8.61...

WordPress European VAT Compliance Assistant for WooCommerce plugin <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin European VAT Compliance Assistant for WooCommerce versions = 1.36.10...

WordPress weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin <= 1.6.28 - Unauthenticated Limited Media File Deletion vulnerability

Unauthenticated Limited Media File Deletion vulnerability discovered by Kuba in WordPress Plugin weForms versions = 1.6.28...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration vulnerability

Missing Authorization to Authenticated Subscriber+ Email Address Enumeration vulnerability discovered by Kuba in WordPress Plugin LearnPress versions = 4.4.10...

WordPress ACF Frontend Admin by DynamiApps plugin <= 3.29.13 - Unauthenticated ACF Options Page Field Update vulnerability

Unauthenticated ACF Options Page Field Update vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.13...

WordPress ACF Frontend Admin by DynamiApps plugin <= 3.29.13 - Admin+ PHP Object Injection vulnerability

Admin+ PHP Object Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.13...

WordPress Patreon WordPress plugin < 1.10.0 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Patreon WordPress versions 1.10.0...

WordPress WP Data Access plugin < 5.5.88 - Subscriber+ SSRF vulnerability

Subscriber+ SSRF vulnerability discovered by Raphael P. Cigana in WordPress Plugin WP Data Access versions 5.5.88...

WordPress Ukr-To-Lat plugin <= 1.3.5 - Contributor+ SQLi vulnerability

Contributor+ SQLi vulnerability discovered by Seongwon Lee in WordPress Plugin Ukr-To-Lat versions = 1.3.5...

WordPress PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) plugin 1.117.9-1.120.69 - Unauthenticated Order Key Disclosure vulnerability

Unauthenticated Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PeachPay Payments versions 1.117.9-1.120.69...

WordPress Patreon WordPress plugin < 1.10.0 - Patreon Integration Takeover vulnerability

Patreon Integration Takeover vulnerability discovered by JunHee CHO in WordPress Plugin Patreon WordPress versions 1.10.0...

WordPress BSK PDF Manager plugin <= 3.8.1 - Contributor+ SQLi vulnerability

Contributor+ SQLi vulnerability discovered by Mohamed Bassia in WordPress Plugin BSK PDF Manager versions = 3.8.1...

WordPress Patreon WordPress plugin < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration vulnerability

Unauthenticated Taxonomy and Term Enumeration vulnerability discovered by JunHee CHO in WordPress Plugin Patreon WordPress versions 1.10.0...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.4 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Ekene Umegakwe in WordPress Plugin LatePoint versions = 5.7.4...

WordPress WP Booking System – Booking Calendar plugin <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Booking System versions = 2.1.0.3...

WordPress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin User Registration versions = 5.2.8...

WordPress EU VAT Assistant for WooCommerce plugin <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Afifudin Maarif in WordPress Plugin WooCommerce EU VAT Assistant versions = 2.1.30.260413...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin LearnPress versions = 4.4.10...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.10 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin LearnPress versions = 4.4.10...

WordPress WP Booking System – Booking Calendar plugin <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation vulnerability

Missing Authorization to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Booking System versions = 2.1.0.3...

WordPress WP Booking System – Booking Calendar plugin <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Booking System versions = 2.1.0.3...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover vulnerability

Insecure Direct Object Reference to Authenticated Author+ Arbitrary Course Modification and Ownership Takeover vulnerability discovered by owlmind in WordPress Plugin Tutor LMS versions = 4.1.0...

WordPress xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN versions = 1.4.2...

WordPress Post Export Import with Media plugin <= 1.17.2 - Authenticated (Administrator+) Path Traversal vulnerability

Authenticated Administrator+ Path Traversal vulnerability discovered by Wordfence PRISM in WordPress Plugin Post Export Import with Media versions = 1.17.2...