WordPress eesy_ID2WP – Publish InDesign HTML5 plugin <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read vulnerability

Unauthenticated Path Traversal to Arbitrary File Read vulnerability discovered by sermsak in WordPress Plugin eesyID2WP – Publish InDesign HTML5 versions = 1.0.3...

WordPress Visual Composer Website Builder plugin <= 45.16.0 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Tin Pham TF1T, Trong Pham dtro, Hao Ngo in WordPress Plugin Visual Composer Website Builder versions = 45.16.0...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 3.1.0-8.9.4 - Subscriber+ Arbitrary Listing Deletion vulnerability

Subscriber+ Arbitrary Listing Deletion vulnerability discovered by Artus KG in WordPress Plugin Directorist versions 3.1.0-8.9.4...

WordPress jet-form-builder-stripe-gateway plugin < 1.1.0 - Unauthenticated Blind SQLi vulnerability

Unauthenticated Blind SQLi vulnerability discovered by Jakub Herman in WordPress Plugin Jet Form Builder Stripe Gateway versions 1.1.0...

WordPress EthPress – Web3 Login plugin <= 2.3.5 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Thatchapol Booranatanit AliceZz in WordPress Plugin EthPress – Web3 Login versions = 2.3.5...

WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.4.0 - Subscriber+ Cross-User Account Takeover vulnerability

Subscriber+ Cross-User Account Takeover vulnerability discovered by vuxvinh in WordPress Plugin WP OAuth Server versions 6.4.0...

WordPress YAHMAN Add-ons plugin < 0.9.31 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Artus KG in WordPress Plugin YAHMAN Add-ons versions 0.9.31...

WordPress Events Manager plugin < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite vulnerability

Contributor+ Arbitrary Ticket Overwrite vulnerability discovered by Hasyros in WordPress Plugin Events Manager versions 7.4.5...

WordPress Events Manager plugin 7.4.1-7.4.4 - Subscriber+ Unpublished Event and Location Disclosure vulnerability

Subscriber+ Unpublished Event and Location Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Events Manager versions 7.4.1-7.4.4...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.26 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by achmad sonif in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.26...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure vulnerability

Contributor+ Campaign Configuration and Log Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.26...

WordPress MasterStudy LMS WordPress Plugin plugin 2.3.0-3.7.49 - Subscriber+ Course and Lesson Creation vulnerability

Subscriber+ Course and Lesson Creation vulnerability discovered by vuxvinh in WordPress Plugin MasterStudy LMS versions 2.3.0-3.7.49...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Subscriber+ Lesson Completion Record Creation vulnerability

Subscriber+ Lesson Completion Record Creation vulnerability discovered by Arman Kumar in WordPress Plugin MasterStudy LMS versions 3.7.50...

WordPress MasterStudy LMS WordPress Plugin plugin 3.5.29-3.7.49 - Contributor+ LFI vulnerability

Contributor+ LFI vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin MasterStudy LMS versions 3.5.29-3.7.49...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.26 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.26...

WordPress The Post Grid plugin < 7.9.5 - Contributor+ Stored HTML/iframe Injection vulnerability

Contributor+ Stored HTML/iframe Injection vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin The Post Grid versions 7.9.5...

WordPress Masteriyo LMS plugin < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure vulnerability

Subscriber+ Arbitrary User Course Progress Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Masteriyo - LMS versions 3.4.2...

WordPress Masteriyo LMS plugin < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure vulnerability

Subscriber+ Quiz Answer Key Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Masteriyo - LMS versions 3.4.2...

NPM: elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

NPM: elysia has Inefficient Algorithmic Complexity and Interpretation Conflict vulnerability discovered by ? in WordPress Npm elysia versions 1.4.29...

WordPress Spectra Legacy – Gutenberg Blocks plugin <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by se1en in WordPress Plugin Spectra versions = 2.20.0...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery vulnerability

Unauthenticated Blind Server-Side Request Forgery vulnerability discovered by Khoa Dang in WordPress Plugin Kirki versions = 6.2.0...

WordPress WP Multilang – Translation and Multilingual Plugin plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin WP Multilang versions = 2.4.31...

WordPress YOP Poll plugin <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability

Unauthenticated Origin Validation Error to Administrator Account Takeover vulnerability discovered by Supakiad S. m3ez in WordPress Plugin YOP Poll versions = 7.0.10...

WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Category Discount Woocommerce versions = 5.18...

WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Admin Notices Manager versions = 1.6.0...

WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin W4 Post List versions = 3.0.6...

NPM: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

NPM: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.2...

NPM: 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

NPM: 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.2...

NPM: 9router: Image prefetch DNS rebinding allows SSRF to internal services

NPM: 9router: Image prefetch DNS rebinding allows SSRF to internal services vulnerability discovered by ? in WordPress Npm 9router versions = 0.4.80...

NPM: 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

NPM: 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse vulnerability discovered by ? in WordPress Npm 9router versions = 0.4.80...

WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Safe SVG versions = 2.5.0...

WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP ERP versions = 1.17.9...

WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Estatik versions = 4.3.5...

WordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by spectreDeveloper in WordPress Plugin Safe SVG versions = 2.5.0...

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.11...

WordPress SiteSkite plugin <= 2.1.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nixxies in WordPress Plugin SiteSkite versions = 2.1.7...

WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by saddanr in WordPress Plugin Team versions = 6.0.0...

WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Ditty versions = 3.1.69...

WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetTricks versions = 2.0.1...

WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by foehn in WordPress Plugin AI Engine versions = 3.7.8...

WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Intrudify in WordPress Plugin PublishPress Capabilities versions = 2.50.1...

WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin The Post Grid versions = 7.9.5...

WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Premium Addons for Elementor versions = 4.11.105...

WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin ElementsKit Elementor addons Lite versions = 4.0.5...

WordPress Import and export users and customers plugin <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by khanhnv in WordPress Plugin Import and export users and customers versions = 2.4.17...

WordPress Paytium: Mollie payment forms & donations plugin <= 5.0.3 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Aydan Arabadzha in WordPress Plugin Paytium versions = 5.0.3...

WordPress Ocean Extra plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ocean Extra versions = 2.6.1...

WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Podcast Importer SecondLine versions = 1.5.6...

WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ultimate FAQ versions = 2.4.14...

WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Nhat Long in WordPress Plugin Core Web Vitals & PageSpeed Booster versions = 1.0.31...