WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin TaxoPress versions = 3.51.0...

WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Newsletter versions = 9.3.3...

WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by dutafi in WordPress Plugin JetEngine versions = 3.8.14...

WordPress Stitch Express plugin <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin Stitch Express versions = 1.9.1...

WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...

WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...

WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Kalles Addons versions = 1.0.6...

WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Nikstore Core versions = 1.5...

WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nabil Irawan in WordPress Plugin Track Geolocation Of Users Using Contact Form 7 versions = 3.0.2...

WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Resido versions = 1.5...

WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Outranking Plugin Options versions = 1.1.3...

WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Thaer Assfour in WordPress Plugin Taxi Booking Manager for WooCommerce versions 2.0.8...

WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nabil Irawan in WordPress Plugin Pay with Contact Form 7 versions = 1.0.4...

WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Van Phuc in WordPress Plugin Flexible Subscriptions versions = 1.8.1...

WordPress SAML Single Sign On plugin 4.8.85-5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite vulnerability

Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite vulnerability discovered by Suhayb Ahmed in WordPress Plugin SAML Single Sign On – SSO Login versions 4.8.85-5.4.6...

WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Van Phuc in WordPress Plugin Taxi Booking Manager for WooCommerce versions 2.0.8...

WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin SimplyRETS Real Estate IDX versions = 3.2.8...

WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Yukusawa18 in WordPress Plugin Community by PeepSo versions = 9.0.5.2...

WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin TrueBooker versions = 1.2.6...

WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jarno Vos jrn5151 in WordPress Plugin NGG Smart Image Search versions 4.0.0...

WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin BBQ Pro versions = 3.9...

WordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability

SQL Injection vulnerability discovered by johska in WordPress Plugin Maps Marker Pro versions = 4.32...

WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Global Gallery versions = 11.1.2...

WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Thaer Assfour in WordPress Plugin Contest Gallery versions = 30.0.5...

WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by PPzzAArr in WordPress Plugin PublishPress Series versions = 2.17.0...

WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin B2BKing versions = 5.2.30...

WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Media LIbrary Assistant versions = 3.39...

WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Brian Willows in WordPress Plugin HashBar – WordPress Notification Bar versions = 2.0.0...

WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Draft List versions = 2.6.4...

NPM: MeshCentral has unsanitized data fields

NPM: MeshCentral has unsanitized data fields vulnerability discovered by ? in WordPress Npm meshcentral versions 1.1.60...

NPM: MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

NPM: MagicMirror socket payload secret placeholder expansion can disclose SECRET environment variables vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

NPM: MagicMirror: ssrf calendar .js

NPM: MagicMirror: ssrf calendar .js vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

NPM: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

NPM: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

WordPress WP Travel Engine plugin <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'bookingid' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin WP Travel Engine versions = 6.8.4...

WordPress StoreEngine plugin <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability

Authenticated Vendor+ Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability discovered by zickzick2 - Sejong University of cyber security student in WordPress Plugin StoreEngine versions = 2.1.1...

WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ SSRF via proSol_url_validate vulnerability

Subscriber+ SSRF via proSolurlvalidate vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...

WordPress WPC Admin Columns plugin < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability

Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WPC Admin Columns versions 2.3.4...

WordPress WP Photo Album Plus plugin < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability

Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...

WordPress WP Photo Album Plus plugin < 9.2.07.002 - Reflected XSS via lbstart vulnerability

Reflected XSS via lbstart vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...

WordPress WP Travel Engine plugin < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart vulnerability

Unauthenticated Booking Details Disclosure and Modification via wteaddtriptocart vulnerability discovered by Usama Arshad in WordPress Plugin WP Travel Engine versions 6.8.5...

WordPress KiviCare plugin < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability

Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability discovered by Mokksh Parekh in WordPress Plugin KiviCare versions 4.5.2...

WordPress RT Mega Menu plugin < 1.5.2 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Shivamani Vastrala in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions 1.5.2...

WordPress wpForo Forum plugin < 3.1.2 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin wpForo Forum versions 3.1.2...

WordPress Gallery for Google Photos plugin < 1.2.1 - Unauthenticated Google OAuth Token Disclosure vulnerability

Unauthenticated Google OAuth Token Disclosure vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin Gallery For Google Photos versions 1.2.1...

WordPress WP Directory Kit plugin < 1.5.6 - Subscriber+ SQL Injection via section Parameter vulnerability

Subscriber+ SQL Injection via section Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.6...

WordPress WP Directory Kit plugin < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category vulnerability

Unauthenticated SQL Injection via searchlocation and searchcategory vulnerability discovered by Pedro Pinho in WordPress Plugin WP Directory Kit versions 1.5.6...

WordPress Ezoic plugin < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes vulnerability

Unauthenticated Database Export via Content Export REST Routes vulnerability discovered by Usama Arshad in WordPress Plugin Ezoic versions 2.23.1...

WordPress The School Management plugin <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter vulnerability

Authenticated Custom+ SQL Injection via 'order0dir' Parameter vulnerability discovered by j4ck13ch4n in WordPress Plugin The School Management – Education & Learning Management versions = 5.4...

WordPress WPAdverts – Classifieds Plugin plugin <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Deva Parekh in WordPress Plugin WPAdverts versions = 2.3.2...