WordPress Smart One Click Setup – Complete Demo Import &amp; Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Smart One Click Setup – Complete Demo Import & Export versions = 1.4.3...

WordPress IATO MCP plugin <= 1.11.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin IATO MCP versions = 1.11.0...

WordPress EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin EmbedPress versions = 4.6.6...

WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Beaver Builder versions = 2.11.0.5...

WordPress SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin <= 3.5.3 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Adrien Brunner in WordPress Plugin SupportCandy versions = 3.5.3...

WordPress Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure vulnerability discovered by Mutantgun in WordPress Plugin Ultimate Member versions = 2.13.1...

WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions = 2.46.0...

WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions = 2.46.0...

WordPress OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin < 6.3.11 - Unauthenticated DoS vulnerability

Unauthenticated DoS vulnerability discovered by Ángel Santana in WordPress Plugin OMGF | Host Google Fonts Locally versions 6.3.11...

WordPress CMP – Coming Soon & Maintenance plugin < 4.1.20 - Unauthenticated Maintenance Mode Bypass vulnerability

Unauthenticated Maintenance Mode Bypass vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin CMP – Coming Soon & Maintenance versions 4.1.20...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin JetFormBuilder versions = 3.6.5.4...

WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LearnPress versions = 4.4.9...

WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Advanced Ads versions = 2.0.26...

WordPress Download Manager plugin <= 3.3.70 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Download Manager versions = 3.3.70...

WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability

SQL Injection vulnerability discovered by neurotx in WordPress Plugin WP Data Access versions = 5.5.82...

WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Intrudify in WordPress Plugin Cost Calculator Builder versions = 4.0.17...

WordPress W3 Total Cache plugin <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin W3 Total Cache versions = 2.10.6...

WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Theme WPLMS versions = 4.973...

WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin WPLMS versions 1.9.9.8.2...

WordPress CMB2 plugin <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin CMB2 versions = 2.13.1...

WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dthangws in WordPress Plugin HUSKY versions = 1.4.3.2...

WordPress DoFollow Case by Case plugin <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin DoFollow Case by Case versions = 3.6.0...

WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin Everest Forms versions = 3.6.1...

WordPress BA Book Everything plugin <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin BA Book Everything versions = 1.8.28...

WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin Disable and Remove Google Fonts | GDPR & DSGVO friendly versions = 2.0.2...

WordPress Greenshift – animation and page builder blocks plugin <= 13.2.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Jiemook in WordPress Plugin Greenshift versions = 13.2.0...

WordPress MW WP Form plugin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin MW WP Form versions = 5.1.7...

WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin UpSolution Core versions = 9.3...

WordPress GSpeech TTS – WordPress Text To Speech Plugin plugin <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin GSpeech TTS versions = 3.22.0...

WordPress Customer Reviews for WooCommerce plugin <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Customer Reviews for WooCommerce versions = 5.122.0...

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Amelia versions = 2.4.10...

WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ProfilePress versions = 4.17.3...

WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ProfilePress versions = 4.17.3...

WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability

Payment Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin GiveWP versions = 4.16.8.1...

WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin FiboSearch versions = 1.34.1...

WordPress Autoptimize plugin <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Autoptimize versions = 3.1.15.1...

WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate Member versions = 2.13.1...

WordPress Visitor Traffic Real Time Statistics pro plugin <= 11.22 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Rafie Muhammad in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.22...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

SQL Injection vulnerability discovered by b1ue0cean in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ayukiab in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.19...

WordPress SiteOrigin Widgets Bundle plugin <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by kiemtiendinhau in WordPress Plugin SiteOrigin Widgets Bundle versions = 1.73.2...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.20...

WordPress JetAppointment plugin <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Rafie Muhammad in WordPress Plugin JetAppointment versions = 2.5.2.1...

WordPress Avada | Website Builder For WordPress & WooCommerce theme <= 7.16.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by daroo in WordPress Theme Avada versions = 7.16.1...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ayukiab in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.19...

WordPress MStore API plugin 4.21.1-4.22.0 - Subscriber+ Payment Bypass vulnerability

Subscriber+ Payment Bypass vulnerability discovered by cyberkareem in WordPress Plugin MStore API versions 4.21.1-4.22.0...

WordPress Unlimited Elements for Elementor plugin < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution vulnerability

Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.21...

WordPress Easy PayPal & Stripe Buy Now Button plugin 1.8-2.0.5 - Unauthenticated Payment Amount Manipulation vulnerability

Unauthenticated Payment Amount Manipulation vulnerability discovered by JunHee CHO in WordPress Plugin Easy PayPal Buy Now Button versions 1.8-2.0.5...

WordPress WebToffee Gift Cards for WooCommerce plugin < 1.3.1 - Unauthenticated Gift Card Amount Manipulation vulnerability

Unauthenticated Gift Card Amount Manipulation vulnerability discovered by berke bodur in WordPress Plugin WebToffee Gift Cards for WooCommerce versions 1.3.1...

WordPress WP Edit Password Protected plugin 2.0.0-2.0.6 - Unauthenticated Site-Wide Access Mode Bypass vulnerability

Unauthenticated Site-Wide Access Mode Bypass vulnerability discovered by Artus KG in WordPress Plugin Wp Edit Password Protected – Create Member/User Only Page & Design Password Protected Form versions 2.0.0-2.0.6...