WordPress BookingPress plugin < 1.5.6 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Sanjar Tulkinov in WordPress Plugin BookingPress versions 1.5.6...

WordPress ProfilePress plugin < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR vulnerability

Subscriber+ Subscription Cancellation via IDOR vulnerability discovered by Haitam Lazaar in WordPress Plugin ProfilePress versions 4.16.17...

WordPress WP Support Plus Responsive Ticket System plugin <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array Keys vulnerability

Unauthenticated SQL Injection via filterelements Array Keys vulnerability discovered by Ayush Srivastava in WordPress Plugin WP Support Plus Responsive Ticket System versions = 9.1.2...

WordPress Everest Forms plugin < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints vulnerability

Unauthenticated Missing Authorization via Site Assistant REST Endpoints vulnerability discovered by Pedro Pinho in WordPress Plugin Everest Forms versions 3.5.0...

WordPress SALESmanago & Leadoo plugin < 3.11.3 - Subscriber+ SQL Injection vulnerability

Subscriber+ SQL Injection vulnerability discovered by Alberto Ucendo Martínez in WordPress Plugin SALESmanago & Leadoo versions 3.11.3...

WordPress Royal MCP plugin < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools vulnerability

Subscriber+ Insufficient Authorization in MCP Tools vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin Royal MCP versions 1.4.26...

WordPress WANotifier plugin < 2.6 - Subscriber+ LFI vulnerability

Subscriber+ LFI vulnerability discovered by Project Black in WordPress Plugin Notifier versions 2.6...

WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.5.1 - Path Traversal vulnerability

Path Traversal vulnerability discovered by D01EXPLOIT OFFICIAL in WordPress Plugin Printcart Web to Print Product Designer for WooCommerce versions = 2.5.1...

WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Booking Hub versions = 1.3.0...

WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Plugin UltimateAI versions = 3.1.0...

WordPress Content Protector (Passster) plugin < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass vulnerability

Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass vulnerability discovered by Erwan LR WPScan in WordPress Plugin Passster versions 4.3.9...

WordPress Charitable plugin < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability

Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Charitable versions 1.8.12...

WordPress myCred plugin < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED vulnerability

Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin myCred versions 3.2.5...

WordPress LitExtension: Store to WooCommerce Migration plugin <= 1.2.5 - Connector Token Takeover via CSRF vulnerability

Connector Token Takeover via CSRF vulnerability discovered by marim00 in WordPress Plugin LitExtension: WooCommerce Migration Plugin versions = 1.2.6...

WordPress Eventin plugin < 4.1.21 - Contributor+ Server-Side Request Forgery vulnerability

Contributor+ Server-Side Request Forgery vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Event SOlution versions 4.1.21...

WordPress AI Engine plugin 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools vulnerability

WordPress AI Engine plugin 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools vulnerability discovered by Charles Vosburgh in WordPress Plugin AI Engine versions = 3.6.0...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass vulnerability

Unauthenticated RCE via Control Character Filename Bypass vulnerability discovered by Jakub Herman in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...

WordPress Copy & Delete Posts plugin < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure vulnerability

Authenticated Arbitrary Post Content and Password Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

WordPress Copy & Delete Posts plugin < 1.5.6 - Author+ Password-Protected Post Content Disclosure vulnerability

Author+ Password-Protected Post Content Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability

WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin = 1.4 - Local File Inclusion vulnerability discovered by Jamaal ahmed in WordPress Plugin MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator versions = 1.4...

WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Boost versions = 2.0.4...

WordPress Tamara Checkout plugin <= 1.9.9.20 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Ezekiel Victor in WordPress Plugin Tamara Checkout versions = 1.9.9.20...

WordPress Media Library Assistant plugin < 3.40 - Author+ SQL Injection via mla_search_connector vulnerability

Author+ SQL Injection via mlasearchconnector vulnerability discovered by João Ramos Maciel in WordPress Plugin Media LIbrary Assistant versions 3.40...

WordPress Dokan plugin < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount vulnerability

Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin Dokan versions 5.0.14...

WordPress Dokan plugin < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint vulnerability

Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint vulnerability discovered by Usama Arshad in WordPress Plugin Dokan versions 5.0.14...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting vulnerability

Admin+ Stored XSS via dragndropheadingtag Setting vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...

WordPress Link Whisper plugin < 0.9.7 - Editor+ SQL Injection via domain Parameter vulnerability

Editor+ SQL Injection via domain Parameter vulnerability discovered by huytqtq in WordPress Plugin Link Whisper Free versions 0.9.7...

WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by luc in WordPress Plugin Boost versions = 2.0.4...

WordPress NewPath WildApricotPress Add-on - Member Directory plugin <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API vulnerability

WordPress NewPath WildApricotPress Add-on - Member Directory plugin = 1.0.0 - Unauthenticated Member PII Disclosure via REST API vulnerability discovered by Huynh Kien Minh in WordPress Plugin NewPath WildApricotPress Add-on for Member Directory versions = 1.0.0...

WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Luis Koleski in WordPress Plugin WooBeWoo Product Filter Pro versions = 3.1.8...

WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin RepairBuddy versions = 4.1223...

WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sungbyeongchan in WordPress Plugin Magazine Blocks versions = 1.8.6...

WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by sanghyeok Kim in WordPress Plugin Hash Form versions = 1.4.0...

WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...

WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...

WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Cem Bas in WordPress Plugin Shared Files versions = 1.7.69...

WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by qdtad in WordPress Plugin Woo Essential versions = 4.3.0...

WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Jamaal ahmed in WordPress Plugin ShopBuilder Pro – Elementor WooCommerce Builder Addons versions = 2.2.0...

WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Brave Conversion Engine PRO versions = 0.8.6...

WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jamaal ahmed in WordPress Plugin ProLancer Element versions = 1.4.8...

WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jamaal ahmed in WordPress Plugin ProLancer Element versions = 1.4.8...

WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Jamaal ahmed in WordPress Plugin WooCommerce File Approval versions = 10.7...

WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by VanTastic in WordPress Plugin Super Forms versions = 6.3.315...

WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability

WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin = 8.9.1 - Privilege Escalation vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Affiliate Pro - Affiliate Program for WooCommerce & WordPress versions = 8.9.1...

WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin TourMaster Plugin versions = 5.4.9...

WordPress Templately plugin < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite vulnerability

Unauthenticated Administrator Templately Cloud Connection Overwrite vulnerability discovered by Shivamani Vastrala in WordPress Plugin Templately versions 3.7.1...