WordPress Classified Listing plugin < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search vulnerability

Contributor+ Store Revenue Total Disclosure via rtclrevenueordersearch vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Classified Listing versions 5.4.4...

WordPress Contest Gallery plugin < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts vulnerability

Subscriber+ OpenAI Prompt History Disclosure via postcggetopenaiprompts vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Contest Gallery versions 30.0.7...

WordPress Valen - Sport, Fashion WooCommerce WordPress Theme theme <= 2.4 - Cross Site Scripting (XSS) vulnerability

WordPress Valen - Sport, Fashion WooCommerce WordPress Theme theme = 2.4 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Valen - Sport, Fashion WooCommerce WordPress Theme versions = 2.4...

WordPress MBStore - Digital WooCommerce WordPress Theme theme <= 2.3 - Cross Site Scripting (XSS) vulnerability

WordPress MBStore - Digital WooCommerce WordPress Theme theme = 2.3 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme MBStore - Digital WooCommerce WordPress Theme versions = 2.3...

WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme theme <= 2.3 - Cross Site Scripting (XSS) vulnerability

WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme theme = 2.3 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme BodyCenter - Gym, Fitness WooCommerce WordPress Theme versions = 2.3...

WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by hhhai in WordPress Plugin Query Wrangler versions = 1.5.57...

WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Khanh Nguyen in WordPress Plugin WP w3all phpBB versions = 3.0.5...

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Taylsec in WordPress Plugin FundEngine versions = 1.7.9...

WordPress Easy Dropbox Integration plugin < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX vulnerability

Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Easy Integration for Dropbox versions 2.2.0...

WordPress miniOrange 2FA plugin < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send vulnerability

Subscriber+ Arbitrary-Recipient OTP Send vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin miniOrange's Google Authenticator versions 6.2.7...

WordPress Meow Gallery plugin < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text vulnerability

Author+ Stored XSS via Attachment Alt-Text vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Meow Gallery versions 5.5.2...

WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Theme Koji versions = 2.2.1...

WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Leyka versions = 3.32.3...

WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin SmartSMTP versions = 1.2.0...

WordPress Ajax Load More plugin < 8.0.1 - Unauthenticated SQL Injection via custom_args vulnerability

Unauthenticated SQL Injection via customargs vulnerability discovered by Jakub Herman in WordPress Plugin Ajax Load More versions 8.0.1...

WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Theme Chaplin versions = 2.6.8...

WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability

Account Takeover vulnerability discovered by 0xd4rk5id3 in WordPress Plugin User Registration & Membership Pro versions = 5.4.5...

WordPress BNE Testimonials plugin < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode vulnerability

Contributor+ Stored XSS via Slider Shortcode vulnerability discovered by testoun in WordPress Plugin BNE Testimonials versions 2.0.8.2...

WordPress HUSKY - Products Filter Professional for WooCommerce plugin < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view vulnerability

WordPress HUSKY - Products Filter Professional for WooCommerce plugin 1.4.1 - Shop Manager+ Local File Inclusion via metafilter searchview vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin HUSKY versions 1.4.1...

WordPress s2Member plugin < 260805 - Contributor+ Stored XSS via Shortcode vulnerability

Contributor+ Stored XSS via Shortcode vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin s2Member versions 260805...

WordPress Nested Pages plugin < 3.2.15 - Editor+ Stored XSS via Post Title vulnerability

Editor+ Stored XSS via Post Title vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Nested Pages versions 3.2.15...

WordPress Customer Reviews for WooCommerce plugin < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions vulnerability

Subscriber+ Missing Authorization via Multiple Settings AJAX Actions vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Customer Reviews for WooCommerce versions 5.116.0...

WordPress Database for Contact Form 7, WPforms, Elementor forms plugin < 1.5.5 - Authenticated SQL Injection via id Parameter vulnerability

Authenticated SQL Injection via id Parameter vulnerability discovered by Andrew Lyons in WordPress Plugin Contact Form Entries versions 1.5.5...

WordPress Quiz And Survey Master plugin < 11.2.2 - Contributor+ Stored XSS via Polar Question vulnerability

Contributor+ Stored XSS via Polar Question vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Quiz And Survey Master versions 11.2.2...

WordPress Google Authenticator plugin < 0.56 - 2FA Secret Overwrite via CSRF vulnerability

2FA Secret Overwrite via CSRF vulnerability discovered by Miguel Mendez Z in WordPress Plugin Google Authenticator versions 0.56...

WordPress Advanced Excerpt plugin < 4.5 - Admin+ Stored XSS via Ellipsis Setting vulnerability

Admin+ Stored XSS via Ellipsis Setting vulnerability discovered by Mustafa Ahmed in WordPress Plugin Advanced Excerpt versions 4.5...

WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Podlove Podcast Publisher versions = 4.5.4...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Aydan Arabadzha in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.7.11...

WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...

WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Altair versions = 5.2.2...

WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Golo Framework versions 1.7.5...

WordPress Wiso plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Wiso versions = 1.3.5...

WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Swatchly – WooCommerce Variation Swatches for Products versions = 1.4.13...

WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WordPress Persistent Login versions = 3.1.0...

WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Theme TheGem Elementor versions = 5.12.3...

WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Advance Product Search versions = 1.4.8...

WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dunvu0 in WordPress Plugin GeoDirectory versions = 2.8.173...

WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin B2BKing Premium versions = 5.6.07...

WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by doc4cash in WordPress Plugin WP Data Access versions = 5.5.80...

WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Tagembed versions = 7.4...

WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Noman Riffat in WordPress Plugin Security & Malware scan by CleanTalk versions = 2.184...

WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin SEO Plugin by Squirrly SEO versions = 14.2.2...

WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Elijah Chia in WordPress Plugin Form Maker by 10Web versions = 1.15.46...

WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Media LIbrary Assistant versions = 3.39...

WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14.1...

WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Quentin Lamour in WordPress Plugin TranslatePress versions = 3.3.2...

WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ahmed Hassan in WordPress Plugin Forminator versions = 1.57.0...

WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by nh4tvd in WordPress Plugin Media LIbrary Assistant versions = 3.39...

WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin wpDataTables versions = 6.5.1.4...

WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...