WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin GeoDirectory versions = 2.8.183...

WordPress WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings plugin <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin WP Maps versions = 4.9.8...

WordPress Fancy Product Designer plugin <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Fancy Product Designer versions = 6.5.2...

WordPress Restaurant Menu and Food Ordering plugin <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by 刀 妖 in WordPress Plugin Restaurant Menu by MotoPress versions = 2.4.14...

WordPress Fancy Product Designer plugin <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Fancy Product Designer versions = 6.5.2...

WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin AMP for WP versions = 1.1.16...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Coopernicus in WordPress Plugin WPDM – Premium Packages versions = 7.2.1...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin JetFormBuilder versions = 3.6.5.3...

WordPress BA Book Everything plugin <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin BA Book Everything versions = 1.8.27...

WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) vulnerability

Missing Authorization to Authenticated Author+ Arbitrary File Deletion Non-PHP vulnerability discovered by pbsec in WordPress Plugin Modula Image Gallery versions = 3.0.2...

WordPress wpForo Forum plugin <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin wpForo Forum versions = 3.1.6...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin GeoDirectory versions = 2.8.181...

WordPress MasterStudy LMS plugin < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass vulnerability

Subscriber+ Membership Plan Quota and Category Restriction Bypass vulnerability discovered by Arman Kumar in WordPress Plugin MasterStudy LMS versions 3.7.50...

WordPress Bookly plugin < 28.3 - Unauthenticated Customer PII Update vulnerability

Unauthenticated Customer PII Update vulnerability discovered by Artus KG in WordPress Plugin Bookly versions 28.3...

WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 2.0.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Contact Form by WPForms versions = 2.0.2...

WordPress Zero Spam for WordPress plugin <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Zero Spam versions = 5.7.10...

WordPress MasterStudy LMS WordPress Plugin plugin 2.3.0-3.7.49 - Unauthenticated Account Creation with Registration Disabled vulnerability

Unauthenticated Account Creation with Registration Disabled vulnerability discovered by vuxvinh in WordPress Plugin MasterStudy LMS versions 2.3.0-3.7.49...

WordPress 10Web Booster plugin < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion vulnerability

Unauthenticated Connection Secret Disclosure and Deletion vulnerability discovered by Shirshak Roy in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions 2.34.0...

WordPress WPForms plugin 1.8.8.2-2.0.1 - Unauthenticated Stripe Refund and Subscription Cancellation vulnerability

Unauthenticated Stripe Refund and Subscription Cancellation vulnerability discovered by Charles Vosburgh in WordPress Plugin Contact Form by WPForms versions 1.8.8.2-2.0.1...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 3.0.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Ivaylo in WordPress Plugin BP Better Messages versions = 3.0.4...

WordPress wpForo Forum plugin < 3.1.6 - Subscriber+ PHP Object Injection vulnerability

Subscriber+ PHP Object Injection vulnerability discovered by Sai Praneeth Koti in WordPress Plugin wpForo Forum versions 3.1.6...

WordPress CMB2 plugin < 2.13.0 - Subscriber+ Arbitrary Option Corruption vulnerability

Subscriber+ Arbitrary Option Corruption vulnerability discovered by Mutantgun in WordPress Plugin CMB2 versions 2.13.0...

WordPress WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings plugin <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion vulnerability

Authenticated Subscriber+ Local File Inclusion vulnerability discovered by lhking in WordPress Plugin WP Maps versions = 4.9.8...

WordPress Elementor Website Builder plugin 4.3.0-4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Sakri Koskimies in WordPress Plugin Elementor Website Builder versions 4.3.0-4.3.1...

WordPress Link Library plugin < 7.9.6 - Contributor+ Path Traversal vulnerability

Contributor+ Path Traversal vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Link Library versions 7.9.6...

WordPress Link Library plugin < 7.9.6 - Unauthenticated SSRF vulnerability

Unauthenticated SSRF vulnerability discovered by Charles Vosburgh in WordPress Plugin Link Library versions 7.9.6...

WordPress Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by moonge in WordPress Plugin Knit Pay versions = 9.6.1.0...

WordPress Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin <= 4.8.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Jiemook in WordPress Plugin Wawp versions = 4.8.6...

WordPress s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin <= 260814 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Supakiad S. m3ez in WordPress Plugin s2Member versions = 260814...

WordPress Optima Express IDX plugin <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment vulnerability

Unauthenticated Privilege Escalation to 'ihfclearcache' AJAX Action to Author Role Assignment vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Optima Express + MarketBoost IDX Plugin versions = 8.7.5...

NPM: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

NPM: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard /browser endpoint vulnerability discovered by ? in WordPress Npm cline versions 3.0.30...

NPM: xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

NPM: xhtml-purifier has HTML attribute-injection sanitizer bypass that leads to XSS vulnerability discovered by ? in WordPress Npm xhtml-purifier versions = 0.4.1...

NPM: CyberChef: Prototype pollution in Series Chart operation

NPM: CyberChef: Prototype pollution in Series Chart operation vulnerability discovered by ? in WordPress Npm cyberchef versions 11.2.0...

WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery vulnerability

Authenticated Administrator+ Server-Side Request Forgery vulnerability discovered by Pham Duc Anh in WordPress Plugin Asset CleanUp: Page Speed Booster versions = 1.4.0.5...

WordPress SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin SSL Zen versions = 4.7.42...

WordPress Modula Image Gallery – Photo Grid & Video Gallery plugin <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability

Missing Authorization to Unauthenticated Private Gallery Image Disclosure vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Modula Image Gallery versions = 3.0.1...

WordPress Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Gutenverse versions = 4.0.8...

WordPress OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin Desktop Mode versions = 1.1.7...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Modification vulnerability discovered by Averon Averenkov Averon Averenkov in WordPress Plugin Blog2Social versions = 9.1.0...

WordPress CSS & JavaScript Toolbox plugin <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin CSS & JavaScript Toolbox versions = 12.0.6...

NPM: SunEditor: Critical XSS vulnerability - sanitizer bypass

sanitizer bypass vulnerability discovered by ? in WordPress Npm suneditor versions = 2.47.10...

WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by daroo in WordPress Plugin Estatik versions = 4.3.5...

WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin WooCommerce Product Table Lite versions = 5.6.7...

WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dthangws in WordPress Plugin Happyforms versions = 1.26.15...

WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SEO Plugin by Squirrly SEO versions = 14.2.5...

WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Plugin LayerSlider versions = 8.4.0...

WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dthangws in WordPress Plugin YITH WooCommerce Ajax Search versions = 2.28.0...

WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tarcísio LuchesiPoystick in WordPress Plugin Profile Builder versions = 4.0.2...

WordPress TaxoPress plugin <= 3.53.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin TaxoPress versions = 3.53.0...

WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by satokan in WordPress Plugin WP Store Locator versions 3.0.0...