WordPress Product Configurator for WooCommerce plugin < 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc_get_data vulnerability

Unauthenticated Private/Draft Product Data Disclosure via pcgetdata vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin Product Configurator for WooCommerce versions 1.7.3...

WordPress Masteriyo LMS plugin < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion vulnerability

Unauthenticated Course Progress Disclosure and Deletion vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Masteriyo - LMS versions 2.2.1...

WordPress WS Form LITE plugin < 1.11.8 - Subscriber+ Arbitrary Settings Update vulnerability

Subscriber+ Arbitrary Settings Update vulnerability discovered by Mustafa Ahmed in WordPress Plugin WS Form LITE versions 1.11.8...

WordPress HUSKY plugin < 1.4.1 - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion vulnerability

WordPress HUSKY plugin 1.4.1 - Products Filter Professional for WooCommerce 1.4.1 - Shop Manager+ Local File Inclusion vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin HUSKY versions 1.4.1...

WordPress FluentCRM Pro plugin <= 3.1.12 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...

WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by lanlv - HPT Vietnam Coporation in WordPress Plugin WP w3all phpBB versions = 3.0.6...

WordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Plugin Mobile App for WooCommerce versions = 0.4.62...

WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability

WordPress ACPT Pro - Custom Post Types Plugin for WordPress plugin = 2.0.63 - SQL Injection vulnerability discovered by VDsec in WordPress Plugin ACPT Pro - Custom Post Types Plugin for WordPress versions = 2.0.63...

WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - Privilege Escalation vulnerability

WordPress ACPT Pro - Custom Post Types Plugin for WordPress plugin = 2.0.63 - Privilege Escalation vulnerability discovered by VDsec in WordPress Plugin ACPT Pro - Custom Post Types Plugin for WordPress versions = 2.0.63...

WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Music Player for WooCommerce versions = 1.8.9...

WordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin Kadence Shop Kit versions = 3.0.6...

WordPress Geo Controller plugin <= 8.9.8 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Geo Controller versions = 8.9.8...

WordPress Booking and Rental Manager plugin <= 2.7.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

WordPress Beautiful Taxonomy Filters plugin <= 2.4.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by JunHee CHO in WordPress Plugin Beautiful Taxonomy Filters versions = 2.4.6...

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.17...

WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Aydan Arabadzha in WordPress Plugin Realtyna Organic IDX plugin versions = 5.4.1...

WordPress Hash Form plugin <= 1.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Hash Form versions = 1.4.1...

WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin CP Media Player versions = 1.3.0...

WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Lee chul woong in WordPress Plugin Epayco versions = 8.4.6...

WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by G0053 in WordPress Theme CozyStay versions = 1.10.0...

WordPress Like Button Rating plugin <= 2.6.61 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin Like Button Rating versions = 2.6.61...

WordPress tagDiv Composer plugin <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Truoc Phan in WordPress Plugin tagDiv Composer versions = 5.4.5...

WordPress Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Gutenverse versions = 4.0.2...

WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...

WordPress Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cozy Blocks versions = 2.2.16...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update vulnerability

Missing Authorization to Authenticated Editor+ Limited Option Update vulnerability discovered by Wordfence PRISM in WordPress Plugin LearnPress versions = 4.4.4...

WordPress PPWP – Password Protect Pages plugin <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin PPWP versions = 1.9.21...

WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by molten bit in WordPress Plugin Events Manager versions = 7.4.0...

WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.4.0 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Events Manager versions = 7.4.0...

WordPress BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Short URL Creation vulnerability discovered by Wordfence PRISM in WordPress Plugin BetterLinks versions = 3.1.0...

WordPress WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Custom+ Sensitive Information Disclosure vulnerability discovered by Vapour in WordPress Plugin WP Courses LMS versions = 3.2.29...

WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin WP Project Manager versions = 4.0.6...

WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Toolset Blocks versions = 1.6.26...

WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ugur Ozer in WordPress Plugin AutomatorWP versions = 5.8.3...

WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by 20kilograma in WordPress Plugin MasterStudy LMS versions = 3.7.42...

WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by LevinityCyber in WordPress Plugin Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads versions = 1.2.0...

WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by HieuPenguinnn in WordPress Plugin WPLegalPages versions = 3.7.0...

WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Que Thanh Tuan in WordPress Plugin Style Kits versions = 2.6.5...

WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Stripe Payments versions = 2.1.2...

WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by ChuongVN in WordPress Plugin TranslatePress versions = 3.3.2...

WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Udin Chan in WordPress Plugin Event Tickets versions = 5.29.2.1...

WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Udin Chan in WordPress Plugin The Events Calendar versions = 6.17.2...

WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

WordPress ACPT Pro - Custom Post Types Plugin for WordPress plugin = 2.0.63 - PHP Object Injection vulnerability discovered by VDsec in WordPress Plugin ACPT Pro - Custom Post Types Plugin for WordPress versions = 2.0.63...

WordPress AllCoach plugin < 1.0.2 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin AllCoach versions 1.0.2...

WordPress YMC Smart Filter plugin < 3.11.3 - Unauthenticated Private/Draft Post Disclosure vulnerability

Unauthenticated Private/Draft Post Disclosure vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin Filter & Grids versions 3.11.3...

WordPress BookingPress plugin < 1.5.6 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Sanjar Tulkinov in WordPress Plugin BookingPress versions 1.5.6...

WordPress ProfilePress plugin < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR vulnerability

Subscriber+ Subscription Cancellation via IDOR vulnerability discovered by Haitam Lazaar in WordPress Plugin ProfilePress versions 4.16.17...

WordPress WP Support Plus Responsive Ticket System plugin <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array Keys vulnerability

Unauthenticated SQL Injection via filterelements Array Keys vulnerability discovered by Ayush Srivastava in WordPress Plugin WP Support Plus Responsive Ticket System versions = 9.1.2...

WordPress Everest Forms plugin < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints vulnerability

Unauthenticated Missing Authorization via Site Assistant REST Endpoints vulnerability discovered by Pedro Pinho in WordPress Plugin Everest Forms versions 3.5.0...

WordPress SALESmanago & Leadoo plugin < 3.11.3 - Subscriber+ SQL Injection vulnerability

Subscriber+ SQL Injection vulnerability discovered by Alberto Ucendo Martínez in WordPress Plugin SALESmanago & Leadoo versions 3.11.3...