WordPress Salon Booking System plugin < 10.31.9 - Unauthenticated Salon REST API Access vulnerability

Unauthenticated Salon REST API Access vulnerability discovered by vuxvinh in WordPress Plugin Salon booking system versions 10.31.9...

WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action vulnerability

Authenticated Custom+ Command Injection via 'value' Parameter crop item in update-photo AJAX Action vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Photo Album Plus versions = 9.3.02.002...

WordPress CP Multi View Events Calendar plugin <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Supakiad S. m3ez in WordPress Plugin CP Multi View Event Calendar versions = 1.4.42...

WordPress Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin <= 3.7.4 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Sunshine Photo Cart versions = 3.7.4...

WordPress Vitepos – Point of Sale (POS) for WooCommerce plugin <= 3.5.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Muboriz in WordPress Plugin Vitepos versions = 3.5.1...

WordPress FiboSearch – Ajax Search for WooCommerce plugin <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin FiboSearch versions = 1.34.2...

WordPress WX Subscribe 微信支付付费订阅 plugin <= 1.2.1 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin WX Subscribe 微信支付付费订阅 versions = 1.2.1...

WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Profile Builder versions = 4.0.3...

WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Adam Spaček in WordPress Plugin Site Reviews versions = 8.3.4...

WordPress Product Delivery Date for WooCommerce plugin < 3.3.2 - Contributor+ Order Information Disclosure vulnerability

Contributor+ Order Information Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Product Delivery Date for WooCommerce – Lite versions 3.3.2...

WordPress Smush plugin < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite vulnerability

Admin+ Network-Wide Plugin Settings Update on Multisite vulnerability discovered by Erwan LR WPScan in WordPress Plugin Smush Image Compression and Optimization versions 4.3.4...

WordPress affiliate-toolkit plugin < 3.8.9 - Editor+ SQL Injection vulnerability

Editor+ SQL Injection vulnerability discovered by Pedro Pinho in WordPress Plugin affiliate-toolkit versions 3.8.9...

WordPress MB Custom Post Types & Custom Taxonomies plugin < 2.12.2 - Subscriber+ Missing Authorization vulnerability

Subscriber+ Missing Authorization vulnerability discovered by Naoki Kawahigashi in WordPress Plugin MB Custom Post Types & Custom Taxonomies versions 2.12.2...

WordPress Salon Booking System plugin < 10.31.9 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Raphael P. Cigana in WordPress Plugin Salon booking system versions 10.31.9...

WordPress Salon Booking System plugin < 10.31.3 - Subscriber+ Booking PII Disclosure vulnerability

Subscriber+ Booking PII Disclosure vulnerability discovered by Andy Urlep in WordPress Plugin Salon booking system versions 10.31.3...

WordPress Salon Booking System plugin < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status vulnerability

Unauthenticated Booking Creation with Arbitrary Customer ID and Status vulnerability discovered by Raphael P. Cigana in WordPress Plugin Salon booking system versions 10.31.9...

WordPress Document Gallery plugin <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure vulnerability

Unauthenticated Non-Public Attachment Disclosure vulnerability discovered by a0yark in WordPress Plugin Document Gallery versions = 5.1.1...

WordPress Visual Form Builder plugin <= 3.1 - Subscriber+ Sensitive Data Disclosure vulnerability

Subscriber+ Sensitive Data Disclosure vulnerability discovered by Het Kalariya in WordPress Plugin Visual Form Builder versions = 3.1...

WordPress Visual Form Builder plugin <= 3.1 - Subscriber+ Arbitrary Form Field Reordering vulnerability

Subscriber+ Arbitrary Form Field Reordering vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin Visual Form Builder versions = 3.1...

WordPress Coinsnap Bitcoin Crowdfunding plugin <= 1.2.0 - Unauthenticated Payment Record Forgery vulnerability

Unauthenticated Payment Record Forgery vulnerability discovered by Pedro Pinho in WordPress Plugin Coinsnap Bitcoin Crowdfunding versions = 1.2.0...

WordPress Fastcache by Host.it plugin <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary .htaccess Page-Cache Block Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Fastcache by Host.it versions = 1.7.5...

NPM: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

NPM: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes vulnerability discovered by ? in WordPress Npm nuxt-og-image versions = 6.2.5, 6.7.0...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WPDM – Premium Packages versions = 7.2.8...

WordPress Schema & Structured Data for WP & AMP plugin <= 1.67 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by r3foxx in WordPress Plugin Schema & Structured Data for WP & AMP versions = 1.67...

WordPress SiteOrigin CSS plugin <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by poiri3r in WordPress Plugin SiteOrigin CSS versions = 1.6.7...

WordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin PlanetStudio Payment Gateway versions = 1.3.3...

WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peter Tang in WordPress Plugin Infinite Uploads versions = 3.4.1...

WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Khubab Ahmed in WordPress Plugin SMS Alert Order Notifications versions = 4.0.1...

WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Presto Player versions = 4.5.3...

WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin Login with phone number versions = 1.8.77...

WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.54...

WordPress SQL Chart Builder plugin <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by rwcpower100 in WordPress Plugin SQL Chart Builder versions = 3.0.6...

WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin Knowledge Base versions = 3.2.0...

WordPress WPConsent plugin <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration mXSS vulnerability discovered by daroo in WordPress Plugin WPConsent versions = 1.1.9...

WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Download Monitor versions = 5.3.3...

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.23 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin Flexible Quantity – Measurement Price Calculator for WooCommerce versions = 2.3.23...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin HivePress versions = 1.7.32...

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...

WordPress GeoDirectory plugin <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'twitterusername' Custom Field vulnerability discovered by OKISO - OKISO in WordPress Plugin GeoDirectory versions = 2.8.192...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin TranslatePress versions = 3.3.7...

WordPress YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Wordfence PRISM in WordPress Plugin YaySMTP versions = 2.7.7...

WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rodrigo Cabo Igneva Solutions, S.L. in WordPress Plugin Sunshine Photo Cart versions = 3.7.4...

WordPress Photo Engine (Media Organizer & Lightroom) plugin <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload vulnerability

Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload vulnerability discovered by Wordfence PRISM in WordPress Plugin Photo Engine versions = 6.5.6...

WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Alex J. in WordPress Plugin Ajax Search Lite versions = 4.14.5...

WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by GOOKBOB in WordPress Plugin Strong Testimonials versions = 3.3.12...

WordPress WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents plugin <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin WSP MCP AI Agents Connector versions = 2.9.5...

WordPress WPeMatico RSS Feed Fetcher plugin <= 2.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Elieve in WordPress Plugin WPeMatico RSS Feed Fetcher versions = 2.9...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by braintx in WordPress Plugin HivePress versions = 1.7.32...

WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Oly Hossen in WordPress Plugin Ninja Forms Signature Contract Add-On versions = 3.2.5...

WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin WP EasyPay versions = 4.5.4...