52802 matches found
WordPress Unlimited Elements for Elementor plugin < 2.0.21 - Authenticated Arbitrary File Write vulnerability
Authenticated Arbitrary File Write vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.21...
WordPress WP Ultimate CSV Importer plugin 7.17-9.1 - Admin+ Stored XSS vulnerability
Admin+ Stored XSS vulnerability discovered by kawagishi kouhei in WordPress Plugin WP Ultimate CSV Importer versions 7.17-9.1...
WordPress WP Ultimate Review plugin < 2.4.4 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Alban Roche in WordPress Plugin Wp Ultimate Review versions 2.4.4...
NPM: probe-image-size: Quadratic-time Denial of Service in the SVG Parser
NPM: probe-image-size: Quadratic-time Denial of Service in the SVG Parser vulnerability discovered by ? in WordPress Npm probe-image-size versions = 7.3.0...
NPM: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
NPM: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.8...
NPM: Trigger.dev: Cross-environment deployment cancel
NPM: Trigger.dev: Cross-environment deployment cancel vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.5...
NPM: Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
NPM: Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler POST /api/v1/query via unsanitized window-function name vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.5...
NPM: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
NPM: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.4...
NPM: Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
NPM: Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.5...
NPM: figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
NPM: figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width vulnerability discovered by ? in WordPress Npm figlet versions 1.11.3...
NPM: Trigger.dev: V1 coordinator default-secret unauth Socket.IO
NPM: Trigger.dev: V1 coordinator default-secret unauth Socket.IO vulnerability discovered by ? in WordPress Npm trigger.dev versions 4.5.4...
NPM: Trigger.dev: Blind SSRF via alert-channel webhook
NPM: Trigger.dev: Blind SSRF via alert-channel webhook vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.1...
NPM: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
NPM: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution IDOR vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.1...
WordPress Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin Real Cookie Banner versions = 5.3.5...
WordPress Wp Social Login and Register Social Counter plugin <= 3.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jakub Herman in WordPress Plugin Wp Social versions = 3.2.1...
WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.17.4 - Authenticated (Subscriber+) Sensitive Information Exposure vulnerability
Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Jakub Herman in WordPress Plugin ProfilePress versions = 4.17.4...
WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.17.4 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin ProfilePress versions = 4.17.4...
WordPress Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin <= 3.2.19 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Dthangws in WordPress Plugin Jeg Kit for Elementor versions = 3.2.19...
WordPress SEOPress – AI SEO Plugin & On-site SEO plugin <= 10.2 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin SEOPress versions = 10.2...
WordPress Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin <= 3.7.1 - Improper Authentication to Account Persistence vulnerability
Improper Authentication to Account Persistence vulnerability discovered by crow in WordPress Plugin Burst Statistics versions = 3.7.1...
WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Samuele Santonicola in WordPress Plugin Beaver Builder versions = 2.11.0.5...
WordPress Rich Showcase for Google Reviews plugin <= 7.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jakub Herman in WordPress Plugin Rich Showcase for Google Reviews versions = 7.1.3...
NPM: Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
NPM: Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL vulnerability discovered by ? in WordPress Npm trigger.dev versions 4.5.2...
NPM: Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
NPM: Trigger.dev: Run replay injects a task run into an attacker-chosen environment cross-tenant write vulnerability discovered by ? in WordPress Npm trigger.dev versions 4.5.2...
WordPress WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion vulnerability
Authenticated Contributor+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin WPCafe versions = 3.0.18...
WordPress Simple Membership plugin <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure vulnerability
Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure vulnerability discovered by Kuba in WordPress Plugin Simple Membership versions = 4.8.3...
WordPress Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) plugin <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation vulnerability
Authenticated Subscriber+ SQL Injection to Privilege Escalation vulnerability discovered by lhking in WordPress Plugin Smart Manager versions = 8.97.0...
WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.9 - Authenticated (Sales Person+) Privilege Escalation vulnerability
Authenticated Sales Person+ Privilege Escalation vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Groundhogg versions = 4.9...
WordPress VikAppointments Services Booking Calendar plugin <= 1.2.21 - Unauthenticated Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion vulnerability discovered by zickzick2 in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.21...
WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by ashv4ni in WordPress Theme Wallstreet versions = 2.8.6...
WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.7 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Nox Axter in WordPress Plugin WP Visitor Statistics Real Time Traffic versions = 8.7...
WordPress WPC Estimated Delivery Date for WooCommerce plugin <= 4.0.1 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin WPC Estimated Delivery Date for WooCommerce versions = 4.0.1...
WordPress WP Ultimate Review plugin <= 2.4.3 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by walid213 in WordPress Plugin Wp Ultimate Review versions = 2.4.3...
WordPress Twenty20 Image Before-After plugin <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Twenty20 Image Before-After versions = 2.0.5...
WordPress Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Reusable Message Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Nelio Content versions = 4.5.0...
WordPress WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete vulnerability
Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete vulnerability discovered by Niv Kochan in WordPress Plugin WPCafe versions = 3.0.19...
WordPress Responsive Starter Templates – Elementor Templates & Starter Sites plugin <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Responsive Plus versions = 3.5.3...
WordPress SEOPress – AI SEO Plugin & On-site SEO plugin <= 10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by braintx in WordPress Plugin SEOPress versions = 10.2...
WordPress Ultra Addons Lite for Elementor plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Abu Hurayra HurayraIIT in WordPress Plugin Ultra Addons Lite for Elementor versions = 1.3.2...
WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion vulnerability
Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary Ticket Response Deletion vulnerability discovered by Saruul in WordPress Plugin Helpdesk Support Ticket System for WooCommerce versions = 2.1.6...
WordPress WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin <= 4.7.3 - Unauthenticated Sensitive Information Disclosure vulnerability
Unauthenticated Sensitive Information Disclosure vulnerability discovered by walid213 in WordPress Plugin Social Icons Widget & Block by WPZOOM versions = 4.7.3...
WordPress Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Post Content Modification vulnerability discovered by Webbernaut in WordPress Plugin Download Alt Text AI versions = 1.10.41...
WordPress LearnPress plugin <= 4.4.9.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LearnPress versions = 4.4.9.1...
WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Mindio Magic MCP versions = 0.5.6...
WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability
Race Condition vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Booking Calendar versions = 11.8.4...
WordPress Aculect AI Companion plugin <= 0.8.1 - Unvalidated Redirects and Forwards vulnerability
Unvalidated Redirects and Forwards vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Aculect AI Companion versions = 0.8.1...
WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WDS MCP Content Manager versions = 3.10.4...
WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by dcs in WordPress Plugin PublishPress Series versions = 3.1.3...
WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WebSamurai versions = 1.0.7...
WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Airano MCP Bridge versions = 2.11.0...