WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by rajukani100 in WordPress Plugin InstaWP Connect versions = 0.1.3.7...

WordPress Eventin plugin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint vulnerability

Unauthenticated Account Creation via Waiting List Endpoint vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress KiviCare plugin < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability

Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.2...

WordPress Eventin plugin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR vulnerability

Contributor+ Order Information Disclosure via IDOR vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress Eventin plugin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API vulnerability

Contributor+ Customer PII Disclosure via REST API vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress LearnPress plugin < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant vulnerability

Subscriber+ Sensitive Information Exposure via AI Assistant vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin LearnPress versions 4.4.4...

WordPress tourmaster plugin < 5.4.8 - Stored XSS vulnerability

Stored XSS vulnerability discovered by ? in WordPress Plugin Tourmaster versions 5.4.8...

WordPress WP Photo Album Plus plugin < 9.2.04.003 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Photo Album Plus versions 9.2.04.003...

WordPress CubeWP Framework plugin <= 1.1.30 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Louis Deschanel JeanJeanLeHaxor, Pascal SUN in WordPress Plugin CubeWP versions = 1.1.30...

WordPress Core <= 7.0.3 - Authenticated (Author+) File Type Confusion to Remote Code Execution vulnerability

Authenticated Author+ File Type Confusion to Remote Code Execution vulnerability discovered by pwn.ai in WordPress core versions = 7.0.3...

WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin GiveWP versions 4.16.6...

WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Lee chul woong in WordPress Plugin Revolut Gateway for WooCommerce versions 4.22.10...

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin GiveWP versions 4.16.6...

WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MailChimp For WooCommerce versions 6.2...

WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Data Access versions = 5.5.79...

WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Featured Image from URL versions = 5.3.3...

WordPress Ninja Tables Pro plugin 5.2.11 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Ninja Tables Pro versions 5.2.11...

WordPress Fluent Forms Pro Add On Pack plugin 6.2.7 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Fluent Forms Pro Add On Pack versions 6.2.7...

WordPress Formidable Digital Signatures plugin <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field vulnerability

Unauthenticated Arbitrary File Deletion via Signature Field vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Formidable Digital Signatures versions = 3.0.6...

WordPress Social Login, Passkeys, Magic Link & Email OTP - Passwordless Login by VentraConnect plugin <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback vulnerability

WordPress Social Login, Passkeys, Magic Link & Email OTP - Passwordless Login by VentraConnect plugin = 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback vulnerability discovered by Civitasmass in WordPress Plugin Passwordless Login by VentraConnect versions = 1.4.3...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token vulnerability

Authenticated Subscriber+ Arbitrary Password Reset via Encrypted Object Token vulnerability discovered by daroo in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.9...

WordPress Ray Enterprise Translation plugin <= 1.7.3 - Subscriber+ Language Addition and Deletion vulnerability

Subscriber+ Language Addition and Deletion vulnerability discovered by Akshat Parikh in WordPress Plugin Ray Enterprise Translation versions = 1.7.3...

WordPress GeoDirectory plugin <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via 'posttype' Parameter via Query-String Bypass in geodirsavepost + geodirdeleterevision vulnerability discovered by mak3bread in WordPress Plugin GeoDirectory versions = 2.8.169...

WordPress InstaWP Connect plugin <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure vulnerability

Unauthenticated Cryptographic Key Disclosure vulnerability discovered by 0xsabre in WordPress Plugin InstaWP Connect versions = 0.1.3.6...

WordPress AcyMailing plugin <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update vulnerability

Authenticated Subscriber+ Missing Authorization to Account Takeover via Notification Template Update vulnerability discovered by d.v4ns3c in WordPress Plugin AcyMailing SMTP Newsletter versions = 10.11.1...

WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dahmani Toumi pegaSUS in WordPress Plugin Solace Extra versions = 1.6.0...

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by VDsec in WordPress Plugin miniorange otp verification versions = 5.5.1...

WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Mrs Skelli in WordPress Plugin Listdom versions = 5.6.0...

WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by buitu in WordPress Plugin WP BASE Booking versions = 6.3.0...

WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Steven Julian in WordPress Plugin Vehica Core versions = 1.0.104...

WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Evan NR in WordPress Plugin MultiParcels Shipping For WooCommerce versions = 1.30.36...

WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Barista versions = 2.5.1...

WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Foton Core versions = 1.1.1...

WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Biagiotti Core versions = 2.1.1...

WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Phat RiO in WordPress Plugin Reviewer versions = 3.14.2...

WordPress Tablesome plugin <= 1.2.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Tablesome versions = 1.2.9...

WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dodoh4t in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions = 2.5.1...

WordPress Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor plugin <= 3.0.7 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.7...

WordPress Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons plugin <= 8.7.14 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Element Pack Elementor Addons versions = 8.7.14...

WordPress Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator plugin <= 1.5.4 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Live Copy Paste for Elementor versions = 1.5.4...

WordPress Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin <= 2.1.14 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Pixel Gallery Addons for Elementor versions = 2.1.14...

WordPress Ultimate Post Kit Addons for Elementor plugin <= 4.2.0 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Ultimate Post Kit versions = 4.2.0...

WordPress Smart Admin Assistant – Dashboard and Site Enhancements plugin <= 2.2.0 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Smart Admin Assistant versions = 2.2.0...

WordPress Prime Slider Addons for Elementor – Widgets, Templates & Elementor Addons plugin <= 4.4.5 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Prime Slider – Addons For Elementor versions = 4.4.5...

WordPress FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin <= 1.9.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin FormGent versions = 1.9.2...

WordPress Stream – Activity Log & Audit Trail plugin <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Yat in WordPress Plugin Stream versions = 4.2.0...

WordPress < 7.0.3 - Email Confirmation Bypass vulnerability

Email Confirmation Bypass vulnerability discovered by 0ways in WordPress core versions 7.0.3...

WordPress UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin UsersWP versions = 1.2.69...

WordPress TrueBooker – Appointment Booking and Scheduler System plugin <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset vulnerability

Missing Authorization to Unauthenticated Arbitrary Password Reset vulnerability discovered by thevietronin in WordPress Plugin TrueBooker versions = 1.2.3...

WordPress AI Copilot – Content Generator plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by d.v4ns3c in WordPress Plugin AIWU versions = 1.5.6...