WordPress TheCartPress eCommerce Shopping Cart plugin <= 1.5.3.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by spacehen in WordPress Plugin TheCartPress versions = 1.5.3.6...

WordPress Backup and Staging by WP Time Capsule plugin < 1.21.16 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by WebARX Security in WordPress Plugin Backup and Staging by WP Time Capsule versions 1.21.16...

WordPress Cherry Framework theme <= 3.1.4 - Unauthenticated Backup Download vulnerability

Unauthenticated Backup Download vulnerability discovered by ? in WordPress Theme Cherry Framework versions = 3.1.4...

WordPress WP Super Edit plugin <= 2.5.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by h4shur in WordPress Plugin WP Super Edit versions = 2.5.4...

WordPress Backup and Restore plugin – WordPress plugin <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Murat DEMIRCI in WordPress Plugin Backup and Restore versions = 1.0.3...

WordPress Baggage Freight Shipping Australia plugin <= 0.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Kaimi in WordPress Plugin Baggage Freight Shipping Australia versions = 0.1.0...

WordPress IMDB Profile Widget plugin <= 1.0.8 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by CrashBandicot @DosPerl in WordPress Plugin IMDb Profile Widget versions = 1.0.8...

WordPress Mac Photo Gallery plugin <= 3.0 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Ihsan Sencan in WordPress Plugin Mac Photo Gallery versions = 3.0...

WordPress HB Audio Gallery Lite plugin <= 1.0.0 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by CrashBandicot in WordPress Plugin HB Audio Gallery Lite versions = 1.0.0...

WordPress Background Image Cropper plugin <= 1.2 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Milad karimi in WordPress Plugin Background Image Cropper versions = 1.2...

WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.9.0 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Nox Axter in WordPress Plugin Admin and Site Enhancements ASE Pro versions = 8.9.0...

WordPress Backup by Supsystic plugin <= 2.3.9 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Erik David Martin in WordPress Plugin Backup by Supsystic versions = 2.3.9...

WordPress Apptha Slider Gallery plugin <= 1.0 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by Ihsan Sencan in WordPress Plugin Apptha Slider Gallery versions = 1.0...

WordPress Simple Fields plugin <= 0.3.5 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Graeme Robinson in WordPress Plugin Simple Fields versions = 0.3.5...

WordPress miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin < 7.8.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Lyris Vale in WordPress Plugin WordPress Social Login and Register versions 7.8.0...

WordPress Streamit theme <= 4.5.0 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Erwan LR WPScan in WordPress Theme Streamit versions = 4.5.0...

WordPress wp-media-folder-addon plugin <= 4.1.6 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Media folder Addon versions = 4.1.6...

WordPress Extra Checkout Options - addon for Extra Product Options plugin plugin <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings vulnerability

WordPress Extra Checkout Options - addon for Extra Product Options plugin plugin = 2.3.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary File Upload in ecosavesettings vulnerability discovered by bashu in WordPress Plugin Extra Checkout Options - addon for Extra Product Options...

WordPress Cost Calculator Builder PRO plugin <= 4.0.3 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Nox Axter in WordPress Plugin Cost Calculator Builder Pro versions = 4.0.3...

WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation vulnerability

Missing Authorization to Unauthenticated Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions = 2.4.37...

WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by AeonRisk in WordPress Plugin MountDev AI MCP Connector for WordPress versions = 1.6.1...

WordPress SAML Single Sign On – SSO Login plugin <= 5.4.4 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Supakiad S. m3ez in WordPress Plugin SAML SP Single Sign On versions = 5.4.4...

WordPress WPForms Pro plugin <= 1.10.1.1 - Unauthenticated Arbitrary File Write vulnerability

Unauthenticated Arbitrary File Write vulnerability discovered by lhking in WordPress Plugin WPForms Pro versions = 1.10.1.1...

WordPress EventON Action User plugin <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation vulnerability

Missing Authorization to Unauthenticated Privilege Escalation vulnerability discovered by Vincent Szopa bioflavonoid in WordPress Plugin EventON Action User versions = 2.5.14...

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover vulnerability

Unauthenticated Authentication Bypass to Account Takeover vulnerability discovered by Civitasmass in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

WordPress WP Password Policy plugin <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by zickzick2 in WordPress Plugin WP Password Policy versions = 3.7.1...

WordPress Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Nia in WordPress Plugin Eazy Plugin Manager versions = 4.4.1...

WordPress TrueBooker plugin < 1.2.4 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin TrueBooker versions 1.2.4...

WordPress BookingPress Pro plugin < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering vulnerability

Unauthenticated Customer PII Disclosure and Booking Tampering vulnerability discovered by Kolja Zuelsdorf in WordPress Plugin BookingPress Appointment Booking Pro versions 5.7.3...

WordPress Tutor LMS plugin < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection vulnerability

Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Tutor LMS versions 4.0.0...

WordPress Essential Addons for Elementor plugin < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure vulnerability

Unauthenticated Draft/Private WooCommerce Product Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Essential Addons for Elementor versions 6.6.10...

WordPress WP Delicious plugin < 1.10.2 - Unauthenticated Arbitrary Post Meta Update vulnerability

Unauthenticated Arbitrary Post Meta Update vulnerability discovered by Pedro Pinho in WordPress Plugin WP Delicious versions 1.10.2...

WordPress Essential Addons for Elementor plugin < 6.6.10 - Lite < 6.6.10 - Contributor+ Stored XSS vulnerability

WordPress Essential Addons for Elementor plugin 6.6.10 - Lite 6.6.10 - Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Essential Addons for Elementor versions 6.6.10...

WordPress WP Travel plugin < 11.8.1 - Subscriber+ Booking PII Disclosure vulnerability

Subscriber+ Booking PII Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 11.8.1...

WordPress Animation Addons for Elementor plugin < 2.7.0 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Animation Addons for Elementor versions 2.7.0...

WordPress Fluent Forms plugin < 6.2.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin FluentForm versions 6.2.6...

WordPress Search Atlas SEO plugin < 2.6.12 - Subscriber+ Google Indexing API Access vulnerability

Subscriber+ Google Indexing API Access vulnerability discovered by LevinityCyber in WordPress Plugin Search Atlas SEO versions 2.6.12...

WordPress RegistrationMagic plugin < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification vulnerability

Unauthenticated Form Submission and User Profile Modification vulnerability discovered by Jonatan Buskila in WordPress Plugin RegistrationMagic versions 6.0.9.4...

WordPress RegistrationMagic plugin < 6.0.9.4 - Unauthenticated Form Submission Disclosure vulnerability

Unauthenticated Form Submission Disclosure vulnerability discovered by Jonatan Buskila in WordPress Plugin RegistrationMagic versions 6.0.9.4...

WordPress LifterLMS plugin < 10.0.10 - Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability discovered by Daniel Púa - devploit in WordPress Plugin LifterLMS versions 10.0.10...

WordPress LifterLMS plugin <= 10.0.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mustafa Ahmed in WordPress Plugin LifterLMS versions = 10.0.9...

WordPress GiveWP plugin < 4.16.3 - GiveWP Worker+ Stored XSS vulnerability

GiveWP Worker+ Stored XSS vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin GiveWP versions 4.16.3...

WordPress WP Hotel Booking plugin < 2.3.2 - Hotel Manager+ SQL Injection vulnerability

Hotel Manager+ SQL Injection vulnerability discovered by Mokksh Parekh in WordPress Plugin WP Hotel Booking versions 2.3.2...

WordPress Bit Form plugin < 3.1.2 - Unauthenticated Inactive Form Submission vulnerability

Unauthenticated Inactive Form Submission vulnerability discovered by Charles Vosburgh in WordPress Plugin Bit Form versions 3.1.2...

WordPress Easy Appointments plugin <= 3.12.26 - Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability discovered by Phyo Ko Ko in WordPress Plugin Easy Appointments versions = 3.12.26...

WordPress Sync Post With Other Site plugin < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification vulnerability

Contributor+ Arbitrary Page Creation/Modification vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Sync Post With Other Site versions 1.9.3...

WordPress Easy Appointments plugin <= 3.12.26 - Contributor+ Customer Data Disclosure vulnerability

Contributor+ Customer Data Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Easy Appointments versions = 3.12.26...

WordPress Easy Appointments plugin <= 3.12.26 - Contributor+ Appointment Data Disclosure & Modification vulnerability

Contributor+ Appointment Data Disclosure & Modification vulnerability discovered by Youssef massoudi in WordPress Plugin Easy Appointments versions = 3.12.26...

WordPress Easy Appointments plugin <= 3.12.26 - Contributor+ Connection Deletion vulnerability

Contributor+ Connection Deletion vulnerability discovered by WEI HSIANG WANG in WordPress Plugin Easy Appointments versions = 3.12.26...

WordPress Easy Appointments plugin <= 3.12.26 - Subscriber+ Customer PII Disclosure vulnerability

Subscriber+ Customer PII Disclosure vulnerability discovered by Mark Moore in WordPress Plugin Easy Appointments versions = 3.12.26...