NPM: swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

NPM: swagger-typescript-api vulnerable to authorization-token exfiltration via spec $ref vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...

WordPress المنتور فارسی plugin <= 2.8.1 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Chiao-Lin Yu Steven Meow in WordPress Plugin المنتور فارسی versions = 2.8.1...

WordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Taylsec in WordPress Plugin AnsPress – Question and answer versions 4.4.4...

WordPress myCred plugin <= 3.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Riyas M S in WordPress Plugin myCred versions = 3.1.2...

WordPress Spider Analyser – WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Spider Analyser WordPress搜索引擎蜘蛛分析插件 versions = 2.1.3...

WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Addons for Elementor versions = 1.45.2...

WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by TurboNexic in WordPress Plugin Colissimo Officiel : Méthodes de livraison pour WooCommerce versions = 2.10.0...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.8...

WordPress WP Compress plugin < 7.10.04 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Lubin Regnault in WordPress Plugin WP Compress versions 7.10.04...

WordPress Sina Extension for Elementor plugin < 3.10.2 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Mustafa Ahmed in WordPress Plugin Sina Extension for Elementor versions 3.10.2...

WordPress MPG plugin < 4.1.8 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by João Ramos Maciel in WordPress Plugin MPG versions 4.1.8...

WordPress Simply Schedule Appointments plugin < 1.6.12.4 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Simply Schedule Appointments versions 1.6.12.4...

WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Dokan versions = 5.0.10...

WordPress WowOptin: Next-Gen Popup Maker plugin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row Injection vulnerability

Unauthenticated Opt-in Deactivation and Template Row Injection vulnerability discovered by Pedro Pinho in WordPress Plugin WowOptin versions 1.4.38...

WordPress Project Management, Bug and Issue Tracking Plugin plugin < 5.1.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Mokksh Parekh in WordPress Plugin Software Issue Manager versions 5.1.0...

WordPress Document Gallery plugin < 5.1.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by João Ramos Maciel in WordPress Plugin Document Gallery versions 5.1.1...

WordPress Praison AI SEO plugin < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure) vulnerability

Unauthenticated Multiple Missing Authorization Post Permalink Modification, Plugin Settings Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Praison SEO WordPress versions 5.0.7...

WordPress CAFEHAUS API plugin <= 1.0.0 - Unauthenticated Arbitrary User Password Reset vulnerability

Unauthenticated Arbitrary User Password Reset vulnerability discovered by moonge in WordPress Plugin CAFEHAUS API versions = 1.0.0...

WordPress ProfileGrid plugin < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership vulnerability

Unauthenticated Payment Bypass and Forced Group Membership vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin ProfileGrid versions 5.9.9.7...

WordPress Clover Payment Gateway by Zaytech for WooCommerce plugin < 1.3.6 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin WooCommerce Clover Payment Gateway versions 1.3.6...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content plugin < 4.16.18 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin ProfilePress versions 4.16.18...

WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Profile Builder versions = 3.16.5...

WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MailOptin versions = 1.2.78.0...

WordPress Masteriyo LMS plugin < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service) vulnerability

Unauthenticated Arbitrary User Session Termination Denial of Service vulnerability discovered by Nakata Christian in WordPress Plugin Masteriyo - LMS versions 2.3.1...

WordPress security-ninja-premium plugin < 5.290 - Two-Factor Authentication Bypass vulnerability

Two-Factor Authentication Bypass vulnerability discovered by Adam Clinch in WordPress Plugin security-ninja-premium versions 5.290...

WordPress 微信二维码登陆 plugin <= 1.3 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by João Ramos Maciel in WordPress Plugin 微信二维码登陆 versions = 1.3...

WordPress FacturaONE para WooCommerce con VeriFactu plugin < 5.37 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Pedro Pinho in WordPress Plugin FacturaONE para WooCommerce con VeriFactu versions 5.37...

WordPress Realtyna Organic IDX plugin + WPL Real Estate plugin < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution vulnerability

Unauthenticated Arbitrary File Upload to Remote Code Execution vulnerability discovered by Thom Stackhouse in WordPress Plugin Realtyna Organic IDX plugin versions 5.3.0...

WordPress Post Status Notifier Lite plugin < 1.13.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Luca Jungnickel in WordPress Plugin Post Status Notifier Lite versions 1.13.0...

WordPress Custom Fields Account Registration For Woocommerce plugin < 1.4 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Huynh Kien Minh in WordPress Plugin Custom Fields Account Registration For Woocommerce versions 1.4...

WordPress Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter vulnerability

Unauthenticated Authentication Bypass via Hardcoded Backdoor in 'wplogin' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Advanced Responsive Video Embedder versions 10.8.7...

WordPress MemberGlut plugin < 1.1.5 - Unauthenticated Privilege Escalation to Administrator vulnerability

Unauthenticated Privilege Escalation to Administrator vulnerability discovered by moonge in WordPress Plugin MemberGlut versions 1.1.5...

WordPress Printcart Web to Print Product Designer for WooCommerce plugin < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery vulnerability

Unauthenticated Arbitrary File Read and Server-Side Request Forgery vulnerability discovered by D01EXPLOIT OFFICIAL in WordPress Plugin Printcart Web to Print Product Designer for WooCommerce versions 2.5.3...

WordPress MainWP Child plugin < 6.1.2 - Unauthenticated Administrator Authentication Bypass vulnerability

Unauthenticated Administrator Authentication Bypass vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin MainWP Child versions 6.1.2...

WordPress Easy Appointments plugin <= 3.12.26 - Subscriber+ Cross-User Appointment Data Modification vulnerability

Subscriber+ Cross-User Appointment Data Modification vulnerability discovered by Duy Tran in WordPress Plugin Easy Appointments versions = 3.12.26...

WordPress PhotoSwipe plugin <= 4.1.1.1 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin PhotoSwipe versions = 4.1.1.1...

WordPress PayU CommercePro Plugin plugin <= 3.8.9 - Unauthenticated Order Tampering vulnerability

Unauthenticated Order Tampering vulnerability discovered by J4ck13Ch4n in WordPress Plugin PayU India versions = 3.8.9...

WordPress ShinyStat Analytics plugin 1.0.12-1.0.17 - Unauthenticated Non-Published Product Information Disclosure vulnerability

Unauthenticated Non-Published Product Information Disclosure vulnerability discovered by Que Thanh Tuan in WordPress Plugin ShinyStat Analytics versions 1.0.12-1.0.17...

NPM: Style Dictionary - Prototype Pollution in convertTokenData utility function

Prototype Pollution in convertTokenData utility function vulnerability discovered by ? in WordPress Npm style-dictionary versions = 4.3.0, 5.4.4...

WordPress Advanced Shipment Tracking for WooCommerce plugin <= 3.9 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Nguyen Truong Roll in WordPress Plugin Advanced Shipment Tracking for WooCommerce versions = 3.9...

WordPress WPC Badge Management for WooCommerce plugin <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin WPC Badge Management for WooCommerce versions = 3.1.6...

WordPress MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.7.23 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion vulnerability

Insecure Direct Object Reference to Authenticated Instructor+ Arbitrary Attachment Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin MasterStudy LMS versions = 3.7.23...

WordPress FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle vulnerability

Cross-Site Request Forgery to Sync Rule Status Toggle vulnerability discovered by Deadbee in WordPress Plugin FuseWP versions = 1.1.24.2...

WordPress WP CTA – Call Now Button, Sticky Button & Call to Action Builder plugin 2.1.2-2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery vulnerability

Authenticated Administrator+ Server-Side Request Forgery vulnerability discovered by Nguyen Quang Truong, Chu Thao Mai in WordPress Plugin WordPress CTA versions 2.1.2-2.1.2...

WordPress Klubraum Membership Request plugin <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update vulnerability

Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Klubraum Membership Request versions = 1.1.0...

WordPress Facturación Electrónica Costa Rica plugin <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update vulnerability

Cross-Site Request Forgery to Plugin Settings Update vulnerability discovered by swat in WordPress Plugin Facturación Electrónica Costa Rica versions = 2.0.2...

WordPress WP-Lister Lite for eBay plugin <= 3.8.8 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Yousof Nahya, Hamza Nour, Yousof Nahya whoami03 in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.8...

NPM: QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

NPM: QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECTREQUEST forwarding vulnerability discovered by ? in WordPress Npm qti-neon versions 1.0.0...

WordPress WP Photo Album Plus plugin <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Photo Album Plus versions = 9.2.04.002...

WordPress Contact Form to Any API plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Contact Form to Any API versions = 3.0.6...