WordPress kittycatfish plugin <= 2.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by TAD Group in WordPress Plugin KittyCatfish versions = 2.2...

WordPress Car Park Booking System for WordPress plugin <= 1.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by 8bitsec in WordPress Plugin Car Park Booking System for WordPress versions = 1.0...

WordPress FleekDash V2 plugin <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover vulnerability

Missing Authorization to Authenticated Subscriber+ Administrator Account Takeover vulnerability discovered by maru in WordPress Plugin FleekDash V2 versions = 2.6.2.2...

WordPress Import and export users and customers plugin < 2.4.3 - Admin+ Arbitrary File Read vulnerability

Admin+ Arbitrary File Read vulnerability discovered by Centesiman in WordPress Plugin Import and export users and customers versions 2.4.3...

WordPress Charitable plugin < 1.8.5.3 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Charitable versions 1.8.5.3...

WordPress Event Booking Manager for WooCommerce plugin < 5.3.7 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WpEvently versions 5.3.7...

WordPress Product Attachment for WooCommerce plugin < 2.3.3 - Unauthenticated Arbitrary Media Download vulnerability

Unauthenticated Arbitrary Media Download vulnerability discovered by kevin@OPCIA in WordPress Plugin WooCommerce Product Attachment versions 2.3.3...

WordPress ProfileGrid plugin < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion vulnerability

Subscriber+ Arbitrary Notification Deletion vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin ProfileGrid versions 5.9.9.8...

WordPress Event Booking Manager for WooCommerce plugin < 5.3.7 - Contributor+ PHP Object Injection vulnerability

Contributor+ PHP Object Injection vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WpEvently versions 5.3.7...

WordPress Frontend File Manager Plugin plugin <= 23.6 - File Metadata Update vulnerability

File Metadata Update vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Frontend File Manager versions = 23.6...

WordPress Event Booking Manager for WooCommerce plugin < 5.3.7 - Contributor+ Arbitrary Post Modification vulnerability

Contributor+ Arbitrary Post Modification vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WpEvently versions 5.3.7...

WordPress Narrative Publisher plugin <= 1.0.7 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Narrative Publisher versions = 1.0.7...

WordPress LWS Optimize plugin < 3.4 - Subscriber+ Cache Deletion vulnerability

Subscriber+ Cache Deletion vulnerability discovered by Omar Elshopky in WordPress Plugin LWS Optimize versions 3.4...

WordPress Element Pack Addons for Elementor plugin < 8.7.13 - Contributor+ DOM-Based Stored XSS vulnerability

Contributor+ DOM-Based Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Element Pack Elementor Addons versions 8.7.13...

WordPress Clever Mega Menu for Visual Composer plugin <= 1.0.1 - Subscriber+ Menu Item Meta Update vulnerability

Subscriber+ Menu Item Meta Update vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin Clever Mega Menu for Visual Composer versions = 1.0.1...

WordPress Meta Box plugin < 5.13.1 - Contributor+ Arbitrary Attachment Deletion vulnerability

Contributor+ Arbitrary Attachment Deletion vulnerability discovered by Duy in WordPress Plugin Meta Box – WordPress Custom Fields Framework versions 5.13.1...

WordPress FluentBoards plugin < 1.95.3 - Subscriber+ Cross-Board Task Disclosure vulnerability

Subscriber+ Cross-Board Task Disclosure vulnerability discovered by Diogo Pinto in WordPress Plugin FluentBoards versions 1.95.3...

WordPress JetEngine plugin < 3.8.12 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by axbqd in WordPress Plugin JetEngine versions 3.8.12...

WordPress Five Star Restaurant Reservations plugin < 2.7.23 - Booking Manager+ Missing Authorization vulnerability

Booking Manager+ Missing Authorization vulnerability discovered by Minar in WordPress Plugin Five Star Restaurant Reservations versions 2.7.23...

WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ShopLentor Pro versions = 2.8.5...

WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ShopLentor Pro versions = 2.8.5...

WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetSearch versions = 3.6.1.2...

WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetBlocks For Elementor versions = 1.5.0...

WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetReviews versions = 3.0.1...

WordPress Mapster WP Maps plugin < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure vulnerability

Unauthenticated Private and Draft Post Content Disclosure vulnerability discovered by Alexander Jurkschat in WordPress Plugin Mapster WP Maps versions 1.24.0...

WordPress Pixel Tag Manager for WooCommerce plugin < 2.2.1 - Unauthenticated Forged Conversion Event Submission vulnerability

Unauthenticated Forged Conversion Event Submission vulnerability discovered by Pedro Pinho in WordPress Plugin Pixel Tag Manager for WooCommerce versions 2.2.1...

WordPress Event Tickets and Registration plugin < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation vulnerability

Unauthenticated PayPal Order Status Manipulation vulnerability discovered by Minar in WordPress Plugin Event Tickets versions 5.29.0.1...

WordPress Booking for Appointments and Events Calendar plugin < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification vulnerability

Amelia Manager+ Arbitrary User-Field Modification vulnerability discovered by Manuel Martínez Casasola in WordPress Plugin Amelia versions 2.4.4...

WordPress Event Tickets and Registration plugin < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification vulnerability

Contributor+ Seating Layout and Ticket Inventory Modification vulnerability discovered by Shivamani Vastrala in WordPress Plugin Event Tickets versions 5.29.0.1...

WordPress Podlove Podcast Publisher plugin < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion vulnerability

Podcast Contributor/Group/Role Creation and Deletion vulnerability discovered by Ryan Fabella in WordPress Plugin Podlove Podcast Publisher versions 4.5.3...

WordPress Pixelavo plugin < 1.5.4 - Unauthenticated Facebook CAPI Event Injection vulnerability

Unauthenticated Facebook CAPI Event Injection vulnerability discovered by Md Amin Ullah Sheikh in WordPress Plugin Pixelavo versions 1.5.4...

WordPress Brizy plugin < 2.8.18 - Contributor+ Sensitive Information Disclosure vulnerability

Contributor+ Sensitive Information Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Brizy versions 2.8.18...

WordPress Spectra Legacy plugin < 2.20.0 - Contributor+ Stored CSS Injection vulnerability

Contributor+ Stored CSS Injection vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Spectra versions 2.20.0...

WordPress Theme Demo Import plugin <= 1.1.3 - Admin+ Arbitrary File Upload vulnerability

Admin+ Arbitrary File Upload vulnerability discovered by Huynh Kien Minh in WordPress Plugin Theme Demo Import versions = 1.1.3...

WordPress Admin Columns for ACF Fields plugin <= 0.3.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Shivamani Vastrala in WordPress Plugin Admin Columns for ACF Fields versions = 0.3.2...

WordPress Everest Toolkit plugin <= 1.2.3 - Admin+ Arbitrary File Upload vulnerability

Admin+ Arbitrary File Upload vulnerability discovered by Huynh Kien Minh in WordPress Plugin Everest Toolkit versions = 1.2.3...

WordPress Codeless Page Builder plugin <= 1.1.4 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by testoun in WordPress Plugin Codeless Page Builder versions = 1.1.4...

WordPress Fluent Support plugin < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment vulnerability

Agent+ Arbitrary Ticket Customer Reassignment vulnerability discovered by Mustafa Ahmed in WordPress Plugin Fluent Support versions 2.3.1...

WordPress Bit Form plugin < 3.1.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Bit Form versions 3.1.4...

WordPress Exclusive Addons for Elementor plugin <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Exclusive Addons Elementor versions = 2.7.9.8...

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

NPM: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

NPM: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes vulnerability discovered by ? in WordPress Npm sanitize-html versions = 1.18.0, = 2.17.4...

WordPress WooCommerce PayPal Payments plugin <= 3.3.2 - Unauthenticated Sensitive Information Disclosure vulnerability

Unauthenticated Sensitive Information Disclosure vulnerability discovered by Drew Webber mcdruid in WordPress Plugin WooCommerce PayPal Payments versions = 3.3.2...

WordPress Powerkit – Supercharge your WordPress Site plugin <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Powerkit versions = 3.1.0...

WordPress WPvivid — Backup, Migration & Staging plugin <= 0.9.131 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WPvivid Backup and Migration versions = 0.9.131...

WordPress RealHomes Memberships plugin <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass vulnerability

Missing Authorization to Authenticated Subscriber+ Membership Payment Bypass vulnerability discovered by dyingman in WordPress Plugin RealHomes Memberships versions = 3.0.9...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) vulnerability

Authenticated Editor+ Path Traversal to Arbitrary File Write Zip Slip vulnerability discovered by cuokon, Wordfence PRISM in WordPress Plugin Kirki versions = 6.0.13...

WordPress Powerkit – Supercharge your WordPress Site plugin <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Powerkit versions = 3.1.0...

WordPress PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin <= 11.2.1 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Win3 in WordPress Plugin PixelYourSite – Your smart PIXEL TAG Manager versions = 11.2.1...