WordPress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() vulnerability

Cross-Site Request Forgery to triggerbulkaction vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin User Registration versions = 5.2.8...

WordPress Themify Popup plugin <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Themify Popup versions = 1.4.7...

WordPress Themify Builder plugin <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Themify Builder versions = 7.8.2...

WordPress Welcart e-Commerce plugin <= 2.12.4 - Authenticated (Editor+) SQL Injection vulnerability

Authenticated Editor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Welcart e-Commerce versions = 2.12.4...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure vulnerability

Unauthenticated Sensitive Information Disclosure vulnerability discovered by Jiří Fryjauf jfryjauf in WordPress Plugin LatePoint versions = 5.7.4...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Kirki versions = 6.3.2...

WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by mamgad in WordPress Plugin aThemeArt Theme Helper versions = 1.0.8...

WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by azqzazq1 in WordPress Plugin Passster versions = 4.3.18...

WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin PowerPack Addons for Elementor versions = 3.1.0...

WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by cazy in WordPress Plugin Advanced Post Manager versions = 4.5.6...

WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin YITH PayPal Express Checkout for WooCommerce versions = 1.61.0...

WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin The Events Calendar versions = 6.18.1...

WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Alpaslan Fatih Sözer in WordPress Plugin BookIt versions = 2.6.0.5...

WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by AndrewN in WordPress Plugin SmartCrawl versions = 3.16.4...

WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin WP Event Solution versions = 4.1.26...

WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by hhhai in WordPress Plugin MapSVG versions = 8.16.1...

WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Prakrit in WordPress Plugin MapSVG versions = 8.16.1...

WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Nixxies in WordPress Plugin MapSVG versions = 8.16.1...

WordPress Squeeze plugin < 1.8.1 - Subscriber+ Missing Authorization vulnerability

Subscriber+ Missing Authorization vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Squeeze versions 1.8.1...

WordPress MAIO plugin < 7.3.22 - Unauthenticated Crawl Analytics Disclosure vulnerability

Unauthenticated Crawl Analytics Disclosure vulnerability discovered by Ryan Fabella in WordPress Plugin MAIO The new AI GEO / SEO tool versions 7.3.22...

WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability

SQL Injection vulnerability discovered by DERISK in WordPress Plugin Support Genix versions = 1.4.54...

WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ayukiab in WordPress Plugin Strong Testimonials versions = 3.3.12...

WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Peter Tang in WordPress Plugin Login with phone number versions = 1.8.77...

WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin Kit formerly ConvertKit versions = 3.4.6...

WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by hinhlx in WordPress Plugin Conversational Forms for ChatBot versions = 1.5.1...

WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Booktics versions = 1.0.29...

WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dzaku in WordPress Plugin Booktics versions = 1.0.29...

WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Anatoly Gorbounov x1will in WordPress Plugin 2Way VideoCalls and Random Chat versions = 6.1.5...

WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Oly Hossen in WordPress Plugin Electronic Signature Add-on for Fluent Forms versions = 2.0.5...

WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin PowerPack Lite for Beaver Builder versions = 1.3.1...

WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Peter Tang in WordPress Plugin OttoKit versions = 1.1.40...

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khanh Nguyen in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...

WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Theme eStore versions = 1.6.13...

WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability

Content Injection vulnerability discovered by changsheng in WordPress Plugin HivePress versions = 1.7.32...

WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin Advanced File Manager versions = 5.4.14...

WordPress GoSMTP Pro plugin <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Rafie Muhammad in WordPress Plugin GoSMTP Pro versions = 1.2.3...

WordPress Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Tourfic versions = 3.0.1...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin GeoDirectory versions = 2.8.191...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin ProfilePress versions = 4.17.5...

WordPress SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by R3D in WordPress Plugin SureCart versions = 4.9.4...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by lhking in WordPress Plugin Tutor LMS versions = 4.1.0...

WordPress User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by andrea bocchetti in WordPress Plugin User Registration & Membership Pro versions = 6.2.9...

WordPress Vulnity Security plugin <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator vulnerability

Unauthenticated Authentication Bypass to Administrator vulnerability discovered by Décio Brandão in WordPress Plugin Vulnity Security versions = 1.4.3...

WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by caussao in WordPress Plugin WP Sessions Time Monitoring Full Automatic versions = 1.1.5...

WordPress Events Made Easy plugin <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Jacek Sowiński dzaku in WordPress Plugin Events Made Easy versions = 3.2.22...

WordPress SureDash – Community, Courses & Member Dashboard plugin <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jacek Sowiński dzaku in WordPress Plugin SureDash versions = 1.12.0...

WordPress Social Share Buttons plugin <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by chimerascope in WordPress Plugin Social Share Buttons versions = 1.30...

WordPress Mobile builder plugin <= 1.4.2 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Raphael P. Cigana in WordPress Plugin Mobile builder versions = 1.4.2...

WordPress DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by wachirapong kamphapong wachiss in WordPress Plugin DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More versions = 1.5.1...

WordPress Subscribe to Comments plugin < 2.3.3 - Unauthenticated Subscription Management Key Disclosure vulnerability

Unauthenticated Subscription Management Key Disclosure vulnerability discovered by Het Kalariya in WordPress Plugin Subscribe to Comments versions 2.3.3...