WordPress Bluff Post plugin <= 1.1.1 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by João Ramos Maciel in WordPress Plugin Bluff Post versions = 1.1.1...

WordPress SPS-Suite plugin <= 1.4.0 - Unauthenticated Time-Based SQLi vulnerability

Unauthenticated Time-Based SQLi vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin SPS-Suite versions = 1.4.0...

WordPress Post Voting System plugin <= 1.0 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Post Voting System versions = 1.0...

WordPress Testimonials Widget plugin <= 4.0.4 - Unauthenticated Arbitrary Post Update vulnerability

Unauthenticated Arbitrary Post Update vulnerability discovered by Naiches in WordPress Plugin Testimonials Widget versions = 4.0.4...

WordPress WP Review Slider Pro plugin < 12.7.12 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Review Slider Pro versions 12.7.12...

WordPress Groups – Memberships and Access Control plugin <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Groups versions = 4.6.0...

WordPress Request a Quote for WooCommerce plugin <= 2.9.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by t4g0 in WordPress Plugin Request a Quote for WooCommerce versions = 2.9.2...

WordPress miniOrange OTP Login, Verification and SMS Notifications plugin <= 5.5.5 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Supakiad S. m3ez in WordPress Plugin miniorange otp verification versions = 5.5.5...

WordPress Ad Inserter plugin 2.8.12-2.8.18 - Subscriber+ RCE / Stored XSS vulnerability

Subscriber+ RCE / Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Ad Inserter versions 2.8.12-2.8.18...

WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Vitepos versions = 3.5.0...

WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peter Tang in WordPress Plugin WPMobile.App versions = 11.83...

WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Minimum and Maximum Quantity for WooCommerce versions = 2.1.2...

WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Aydan Arabadzha in WordPress Plugin MakeCommerce for WooCommerce versions = 4.1.0...

WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Notification for Telegram versions = 3.5.2...

WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Booking Activities versions = 1.18.7.1...

WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Themify Builder versions = 7.8.1...

WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Seongwon LEE in WordPress Plugin YITH WooCommerce Tab Manager versions = 2.15.0...

WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP ERP versions = 1.17.9...

WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by c4st1e in WordPress Plugin WordPress Backup & Migration versions = 1.6.0...

WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin DesignSetGo versions = 2.8.0...

WordPress FluentBoards plugin <= 2.0.12 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Asim Alshaya in WordPress Plugin FluentBoards versions = 2.0.12...

WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Awesome Support versions = 6.3.9...

WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by bekitousei in WordPress Plugin Trusted Shops Easy Integration for WooCommerce versions = 2.0.6...

WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin eCommerce Product Catalog versions = 3.6.0...

WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Cost of Goods for WooCommerce versions = 3.5.2...

WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by manop55555 in WordPress Plugin Classified Listing versions = 6.1.3...

WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ashish Agarwal @Donrulezz in WordPress Plugin GravityExport Lite for Gravity Forms versions = 2.7.2...

WordPress Media Library Folders plugin <= 8.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Media Library Folders versions = 8.4.1...

WordPress Content Egg plugin <= 6.3.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Content Egg versions = 6.3.1...

WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by MYUNGYONG LEE in WordPress Plugin Paid Member Subscriptions versions = 3.0.9...

WordPress WP Verify API plugin <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients vulnerability

Unauthenticated Verification Code Email Sending to Arbitrary Recipients vulnerability discovered by RIA Labs in WordPress Plugin WP Verify API versions = 1.0.0...

WordPress PowerPress Podcasting plugin by Blubrry plugin < 11.17.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin PowerPress Podcasting versions 11.17.2...

WordPress NextScripts: Social Networks Auto-Poster plugin < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion vulnerability

Authenticated Social Account Credential Disclosure and Data Deletion vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin NextScripts versions 4.4.8...

WordPress Optima Express IDX plugin 8.6.0-8.7.5 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Usama Arshad in WordPress Plugin Optima Express + MarketBoost IDX Plugin versions 8.6.0-8.7.5...

WordPress WP YouTube Lyte plugin < 1.7.31 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin WP YouTube Lyte versions 1.7.31...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.27 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.27...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.27 - Contributor+ SSRF vulnerability

Contributor+ SSRF vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.27...

WordPress Mailchimp for WooCommerce plugin < 6.3 - Unauthenticated Customer Email and Cart Disclosure vulnerability

Unauthenticated Customer Email and Cart Disclosure vulnerability discovered by JunHee CHO in WordPress Plugin MailChimp For WooCommerce versions 6.3...

WordPress Online Scheduling and Appointment Booking System plugin 23.2-28.2 - Bookly Administrator+ PHP Object Injection vulnerability

Bookly Administrator+ PHP Object Injection vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Bookly versions 23.2-28.2...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.27 - Contributor+ SSRF vulnerability

Contributor+ SSRF vulnerability discovered by JunHee CHO in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.27...

WordPress Online Scheduling and Appointment Booking System plugin < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion vulnerability

Staff+ Appointment and Payment Disclosure, Modification and Deletion vulnerability discovered by Vũ Quang Huy in WordPress Plugin Bookly versions 28.3...

WordPress WebFacing Email Accounts for cPanel plugin 5.3-5.3.6 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by nobody in WordPress Plugin WebFacing Email Accounts for cPanel versions 5.3-5.3.6...

WordPress EmbedPress plugin < 4.6.7 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dthangws in WordPress Plugin EmbedPress versions 4.6.7...

WordPress UpdraftPlus: WP Backup & Migration Plugin plugin 1.23.8-1.26.7 - Subscriber+ Remote Storage Credential Disclosure vulnerability

Subscriber+ Remote Storage Credential Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin UpdraftPlus versions 1.23.8-1.26.7...

WordPress UpdraftPlus: WP Backup & Migration Plugin plugin 2.23.8-2.26.8.25 - Subscriber+ Remote Storage Credential Disclosure vulnerability

Subscriber+ Remote Storage Credential Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin UpdraftPlus versions 2.23.8-2.26.8.25...

WordPress Optimole plugin 4.0.0-4.2.12 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Optimole versions 4.0.0-4.2.12...

WordPress MCP Server for WordPress plugin < 1.8.2 - Contributor+ Workflow Modification and Deletion vulnerability

Contributor+ Workflow Modification and Deletion vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...

WordPress WP Delicious plugin < 1.10.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin WP Delicious versions 1.10.8...

WordPress MCP Server for WordPress plugin < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure vulnerability

Contributor+ Arbitrary Post Title Disclosure vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...

WordPress MCP Server for WordPress plugin < 1.8.2 - CSRF to Administrator Account Creation vulnerability

CSRF to Administrator Account Creation vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...