WordPress Subscriptions for WooCommerce plugin <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation vulnerability

Authenticated Contributor+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin Subscriptions for WooCommerce versions = 2.0.0...

WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Bonds in WordPress Plugin Type Hub versions = 2.0.6...

WordPress Easy Property Listings plugin <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Easy Property Listings versions = 3.5.24...

WordPress Download Manager plugin < 3.3.66 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Download Manager versions 3.3.66...

WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin < 5.0.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by João Ramos Maciel in WordPress Plugin Dynamic Pricing With Discount Rules for WooCommerce versions 5.0.0...

WordPress Material Dashboard plugin <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability

Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Material Dashboard versions = 1.4.10...

WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Mercado Pago payments for WooCommerce versions = 8.9.0...

WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FiboSearch versions = 1.33.0...

WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Powerkit versions = 3.1.0...

WordPress WPFormify – Stripe Payments with Form and Checkout plugin <= 1.1.1 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Legion Hunter in WordPress Plugin WPFormify – Stripe Payments with Form and Checkout versions = 1.1.1...

WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by timomangcut in WordPress Plugin Tracking Code Manager versions = 2.6.0...

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.19 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.19...

WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Que Thanh Tuan in WordPress Plugin YITH WooCommerce Zoom Magnifier versions = 2.52.0...

WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability discovered by Riski Gana Prasetya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.8...

WordPress WP Activity Log Premium plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Levon Balyan in WordPress Plugin WP Activity Log Premium versions = 5.6.4...

WordPress Database Collation Fix plugin <= 1.2.10 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Nabil Irawan in WordPress Plugin Database Collation Fix versions = 1.2.10...

WordPress User Access Manager plugin <= 2.3.15 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Supakiad S. m3ez in WordPress Plugin User Access Manager versions = 2.3.15...

WordPress Participants Database plugin < 2.7.8.4 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by João Ramos Maciel in WordPress Plugin Participants Database versions 2.7.8.4...

WordPress Direct Payments for WooCommerce plugin < 2.5.3 - Unauthenticated Cross-Customer Order Tampering vulnerability

Unauthenticated Cross-Customer Order Tampering vulnerability discovered by Pedro Pinho in WordPress Plugin Direct Payments for WooCommerce versions 2.5.3...

WordPress Contact Form Extender for Divi – Submissions DB & Extra Fields plugin <= 1.0.6 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by KEVIN LEE crattack in WordPress Plugin Contact Form Extender for Divi Save Entries, File Upload & Country Code Field versions = 1.0.6...

WordPress Pronamic Pay plugin <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Afan, moonge in WordPress Plugin Pronamic Pay versions = 10.1.0...

WordPress Kali Forms — Contact Form & Drag-and-Drop Builder plugin <= 2.4.20 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Wordfence PRISM in WordPress Plugin Kali Forms versions = 2.4.20...

WordPress Ultimate Member plugin < 2.12.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Haitam Lazaar in WordPress Plugin Ultimate Member versions 2.12.1...

WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.9.0 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by daroo in WordPress Plugin Bit Integrations versions = 2.9.0...

WordPress CubeWP Framework plugin <= 1.1.30 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Nhien Pham nhienit in WordPress Plugin CubeWP versions = 1.1.30...

WordPress WooCommerce - Social Login plugin <= 2.8.7 - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass vulnerability

WordPress WooCommerce - Social Login plugin = 2.8.7 - Social Login = 2.8.7 - Unauthenticated Authentication Bypass vulnerability discovered by Rafie Muhammad in WordPress Plugin WooCommerce Social Login versions = 2.8.7...

WordPress Single Sign On For TNG plugin <= 2.0.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by andrea bocchetti in WordPress Plugin Single Sign On For TNG versions = 2.0.0...

WordPress FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin <= 1.9.2 - FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion vulnerability

FormGent = 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin FormGent versions = 1.9.2...

WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion vulnerability

Store Owner+ Cross-Vendor Store Takeover and Deletion vulnerability discovered by Pedro Pinho in WordPress Plugin MultiVendorX versions 5.0.11...

WordPress Passster plugin < 4.3.6 - Unauthenticated Protected Content Disclosure vulnerability

Unauthenticated Protected Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature

NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature vulnerability discovered by ? in WordPress Npm ghost versions = 6.27.0, 6.44.0...

NPM: Ghost: Member existence leak via magic link sign-in response

NPM: Ghost: Member existence leak via magic link sign-in response vulnerability discovered by ? in WordPress Npm ghost versions = 5.18.0, 6.21.1...

NPM: Ghost: Session Fixation in Ghost Admin

NPM: Ghost: Session Fixation in Ghost Admin vulnerability discovered by ? in WordPress Npm ghost versions = 2.2.0, 6.54.1...

NPM: Ghost: Theme Upload Path Traversal

NPM: Ghost: Theme Upload Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...

NPM: Ghost: Database Backup Path Traversal

NPM: Ghost: Database Backup Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 1.20.1, 6.54.1...

NPM: Ghost: Server-Side Request Forgery in Image Fetching

NPM: Ghost: Server-Side Request Forgery in Image Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions 6.54.1...

NPM: Ghost: Mobiledoc image-size fetch SSRF

NPM: Ghost: Mobiledoc image-size fetch SSRF vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...

NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling

NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, 6.21.1...

NPM: Ghost: Private IP filtering bypass to make server-side requests to internal services

NPM: Ghost: Private IP filtering bypass to make server-side requests to internal services vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, = 6.21.0...

NPM: Ghost: Archived Offers can be Redeemed

NPM: Ghost: Archived Offers can be Redeemed vulnerability discovered by ? in WordPress Npm ghost versions = 4.22.0, 6.54.1...

NPM: Ghost: File Upload Content-Type Spoofing

NPM: Ghost: File Upload Content-Type Spoofing vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...

NPM: Ghost: Cross-Site Scripting in Universal Import

NPM: Ghost: Cross-Site Scripting in Universal Import vulnerability discovered by ? in WordPress Npm ghost versions = 5.26.0, 6.54.1...

NPM: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

NPM: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

WordPress WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin <= 3.9.1 - Authenticated (Author+) SQL Injection vulnerability

Authenticated Author+ SQL Injection vulnerability discovered by Ryoma Nishioka in WordPress Plugin WP Post Author versions = 3.9.1...

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

NPM: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.3...