WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Icegram versions = 3.1.31...

WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Ultimate CSV Importer versions = 9.1...

WordPress bbp style pack plugin <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin bbp style pack versions = 6.4.8...

WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Andy Urlep in WordPress Plugin WordPress File Upload versions = 5.1.10...

WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure vulnerability

Unauthenticated Payment Gateway Credentials Disclosure vulnerability discovered by Animesh Gaurav WPScan in WordPress Plugin Payments for Hubtel versions 1.0.2...

WordPress Pro Like Button plugin < 2.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Pro Like Button versions 2.0...

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by V1T in WordPress Plugin Photo Reviews for WooCommerce versions = 1.2.30...

WordPress Paytm Payment Gateway plugin < 2.8.9 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Paytm Payment Gateway versions 2.8.9...

WordPress BackupSheep WordPress Backup Plugin plugin <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration vulnerability

Unauthenticated Arbitrary File Deletion and Backup Exfiltration vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin BackupSheep WordPress Backup Plugin versions = 1.8...

WordPress Cache Enabler plugin < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion vulnerability

Unauthenticated Arbitrary File and Directory Deletion vulnerability discovered by Jakub Herman in WordPress Plugin Cache Enabler versions 1.8.17...

WordPress Appointment Hour Booking – Booking Calendar plugin <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Zackary Loevseth in WordPress Plugin Appointment Hour Booking versions = 1.5.97...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by tiborisaak in WordPress Plugin Forminator versions = 1.57.2...

WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by MYUNGYONG LEE in WordPress Plugin FluentForm versions = 6.2.14...

WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin WooCommerce PDF Invoices & Packing Slips versions = 5.16.1...

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by JunHee CHO in WordPress Plugin LA-Studio Element Kit for Elementor versions = 1.6.2...

WordPress Redux Framework plugin <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Redux Framework versions = 4.5.14...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.3...

WordPress Autoptimize plugin <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by lhking in WordPress Plugin Autoptimize versions = 3.1.15.1...

WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Muhamad Visat in WordPress Plugin Social Media & Share Icons versions = 3.0.1...

WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by jtb75 in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.31...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by hashiramasenju333 in WordPress Plugin LatePoint versions = 5.7.0...

WordPress Redux Framework plugin <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Attachment Deletion vulnerability discovered by Eunho Kim in WordPress Plugin Redux Framework versions = 4.5.14...

WordPress Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Improper Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin Advanced Woo Labels versions = 2.51...

WordPress AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whale120 in WordPress Plugin AI Engine versions = 3.8.0...

WordPress Extendify plugin <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Jack Taylor in WordPress Plugin Extendify versions = 3.1.6...

WordPress ClearSale Total plugin <= 3.4.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Catalin Oancea 0x4D5A in WordPress Plugin ClearSale Total versions = 3.4.2...

WordPress Simply Schedule Appointments plugin <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.32...

WordPress Zella Theme theme < 2.6.3 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Mike Gozdiskowski in WordPress Theme Zella Theme versions 2.6.3...

WordPress User Frontend plugin 3.5.29-4.3.11 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Murad Akhmedov in WordPress Plugin WP User Frontend versions 3.5.29-4.3.11...

WordPress ByteCoreStack – MCP Connector for AI Tools plugin <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Décio Brandão in WordPress Plugin ByteCoreStack MCP Connector for AI Tools versions = 1.2.3...

WordPress Super Forms – Drag & Drop Form Builder plugin <= 6.3.316 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by d.v4ns3c in WordPress Plugin Super Forms versions = 6.3.316...

WordPress Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin <= 2.15.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by zickzick2 in WordPress Plugin Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform versions = 2.15.0...

WordPress WPC Shop as a Customer for WooCommerce plugin <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by clever in WordPress Plugin WPC Shop as a Customer for WooCommerce versions = 2.0.0...

WordPress Super Forms – Drag & Drop Form Builder plugin <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion vulnerability

Authenticated Subscriber+ Arbitrary File/Directory Deletion vulnerability discovered by d.v4ns3c in WordPress Plugin Super Forms versions = 6.3.316...

WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Payments for Hubtel versions 1.0.2...

WordPress WP Fusion Lite plugin < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion vulnerability

Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion vulnerability discovered by Artus KG in WordPress Plugin WP Fusion Lite versions 3.48.0...

WordPress WP Fusion Lite plugin < 3.48.0 - Unauthenticated CRM Integration Settings Update vulnerability

Unauthenticated CRM Integration Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin WP Fusion Lite versions 3.48.0...

WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Order Key Disclosure vulnerability

Unauthenticated Order Key Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payments for Hubtel versions 1.0.2...

WordPress Download Manager plugin < 3.3.71 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Mark Moore in WordPress Plugin Download Manager versions 3.3.71...

WordPress If-So Dynamic Content plugin 1.9.9-1.10.1 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Kaan Özbek in WordPress Plugin If-So Dynamic Content Personalization versions 1.9.9-1.10.1...

WordPress Featured Image from URL (FIFU) Premium plugin 6.8.0-8.2.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU Premium versions 6.8.0-8.2.7...

WordPress Featured Image from URL (FIFU) plugin 6.0.0-6.0.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU versions 6.0.0-6.0.7...

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

NPM: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses vulnerability discovered by ? in WordPress Npm fastify versions 5.12.5...

NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS

NPM: hono/jsx renders plain strings unescaped in boundary components, leading to XSS vulnerability discovered by ? in WordPress Npm hono versions 4.13.7...

NPM: fastify vulnerable to request body replacement via an async validation result collision

NPM: fastify vulnerable to request body replacement via an async validation result collision vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

NPM: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

NPM: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers vulnerability discovered by ? in WordPress Npm fastify versions = 4.0.0, 5.12.2...

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas

NPM: fastify vulnerable to request validation bypass via skipped boolean false schemas vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization

NPM: fastify vulnerable to header validation bypass via incomplete schema case normalization vulnerability discovered by ? in WordPress Npm fastify versions 5.12.2...

WordPress Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Essential Blocks for Gutenberg versions = 6.4.5...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.3...