WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by johska in WordPress Plugin Cwicly versions = 1.4.4...

WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Mayosis Core versions = 5.4.7...

WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Doan Dinh Van in WordPress Plugin FormyChat versions = 2.15.7...

WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin SSL Zen versions = 4.7.43...

WordPress TrueBooker plugin <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter vulnerability

Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebookerwpuserid' Parameter vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin TrueBooker versions = 1.2.6...

WordPress Wholesale Market plugin <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via 'rolerequired' Parameter vulnerability discovered by SEONGWON CHO - Chung-ang University in WordPress Plugin Wholesale Market versions = 2.2.2...

WordPress KiviCare plugin <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter vulnerability

Authenticated Doctor+ SQL Injection via 'searchTerm' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin KiviCare versions = 4.5.1...

WordPress Groundhogg plugin <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter vulnerability

Authenticated Vendor+ SQL Injection via 'tagquery' Parameter vulnerability discovered by Jonathan Dersch - Jonathan Dersch - Bug Bounty in WordPress Plugin Groundhogg versions = 4.5.14...

WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability discovered by Ivaylo in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...

WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values vulnerability

Authenticated Editor+ SQL Injection via Pattern JSON Keys/Values vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...

WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter vulnerability

Authenticated Editor+ SQL Injection via 'key' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...

WordPress Form Maker by 10Web plugin <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause vulnerability

Authenticated Subscriber+ SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause vulnerability discovered by R4mbb in WordPress Plugin Form Maker by 10Web versions = 1.15.44...

WordPress Hydra Booking plugin <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter vulnerability

Authenticated Host+ Stored Cross-Site Scripting via 'firstname' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Hydra Booking versions = 1.2.2...

WordPress Cookie Banner for GDPR / CCPA plugin <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.5...

WordPress Contest Gallery plugin <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' vulnerability

Authenticated Author+ Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Contest Gallery versions = 30.0.7...

WordPress Beaver Builder Page Builder plugin <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Button Module 'button' Parameter vulnerability discovered by a1batr0ss in WordPress Plugin Beaver Builder versions = 2.10.2.2...

WordPress Image Uploader for Welcart plugin <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter vulnerability

Authenticated Author+ SQL Injection via Attachment 'posttitle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Image Uploader for Welcart versions = 1.4.6...

WordPress Pinpoint Booking System plugin <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter vulnerability

Unauthenticated Improper Input Validation to Price Manipulation via 'cartdata' Parameter vulnerability discovered by WordFence in WordPress Plugin Pinpoint Booking System versions = 2.9.9.6.8...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action vulnerability

Missing Authorization to Unauthenticated Arbitrary Modification via wpdevartpayment AJAX Action vulnerability discovered by Raihan Adi Arba in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress Propovoice: All-in-One Client Management System plugin <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter vulnerability

Authenticated ndpvmanager+ Privilege Escalation via 'role' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Propovoice CRM versions = 1.7.8...

WordPress MaxUpload plugin <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability discovered by JIWOONG LEE kimchunbok - Hyundai Red Team in WordPress Plugin MaxUpload versions = 1.4.0...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via REST API 'businessid' Parameter vulnerability discovered by MatilJ in WordPress Plugin Online Booking & Scheduling Calendar for WordPress by vcita versions = 4.6.0...

WordPress User Profile Builder plugin <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability

Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Profile Builder versions = 3.16.4...

WordPress Object Sync for Salesforce plugin <= 2.2.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Object Sync for Salesforce versions = 2.2.13...

WordPress 6Storage Rentals plugin <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter vulnerability

Unauthenticated Account Takeover via 'email' Parameter vulnerability discovered by WordFence in WordPress Plugin 6Storage Rentals versions = 2.27.0...

WordPress bLoyal: Loyalty & Promotions by bLoyal plugin <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings vulnerability

Authenticated Subscriber+ Privilege Escalation via Unprotected AJAX API URL Settings vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin bLoyal versions = 3.1.611.78...

WordPress RapiSafe plugin <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters vulnerability

Unauthenticated Arbitrary File Deletion via 'rsmfcf7session' and 'filename' Parameters vulnerability discovered by Spy0x7 in WordPress Plugin RapiSafe – Secure Multi File Upload for Contact Form 7 versions = 1.0.4...

WordPress User Session Synchronizer plugin <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters vulnerability

Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters vulnerability discovered by WordFence in WordPress Plugin User Session Synchronizer versions = 1.4.0...

WordPress Frontend Admin by DynamiApps plugin < 3.29.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Frontend Admin by DynamiApps versions 3.29.9...

WordPress Kirki plugin < 6.0.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Hermanhms in WordPress Plugin Kirki versions 6.0.13...

WordPress miniOrange 2FA plugin < 6.2.6 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Shivamani Vastrala in WordPress Plugin miniOrange's Google Authenticator versions 6.2.6...

WordPress Pods plugin <= 3.3.9 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Nhien Pham nhienit - GalaxyOne in WordPress Plugin Pods versions 3.3-3.3.9...

WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin Extra Product Options & Add-Ons for WooCommerce versions 7.6...

WordPress Essential Real Estate plugin <= 5.3.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Steven Julian in WordPress Plugin Essential Real Estate versions = 5.3.3...

WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin FundEngine versions = 1.7.9...

WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Steven Julian in WordPress Plugin Theme Test Drive versions = 2.9.1...

WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Vavo Core versions = 2.3.0...

WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Quill Forms versions = 5.7.1...

WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hhhai in WordPress Plugin WP Sort Order versions = 1.3.5...

WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by DmTomHe in WordPress Plugin User Registration versions = 5.2.6...

WordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by Asim Alshaya in WordPress Plugin Starter Templates by Kadence WP versions = 2.3.3...

WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin Site Reviews versions = 8.2.0...

WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin CTX Feed versions = 6.6.47...

WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Abduvoris Karimov in WordPress Plugin OttoKit versions = 1.1.35...

WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin GiveWP versions = 4.16.5.1...

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin GiveWP versions 4.16.6...

WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Asim Alshaya in WordPress Plugin Breeze versions = 2.5.12...

WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Templately versions = 3.7.1...

WordPress Epeken All Kurir plugin <= 2.1.2 - Unauthenticated Order Payment Confirmation Forgery vulnerability

Unauthenticated Order Payment Confirmation Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin Epeken All Kurir versions = 2.1.2...

WordPress Paymob for WooCommerce plugin < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability

Unauthenticated SQL Injection via Paymob Callback Pixel Lookup vulnerability discovered by Artus KG in WordPress Plugin Paymob for WooCommerce versions 4.1.9...