WordPress WPC Smart Compare for WooCommerce plugin < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure vulnerability

Unauthenticated Password-Protected Product Description Disclosure vulnerability discovered by Artus KG in WordPress Plugin WPC Smart Compare for WooCommerce versions 6.6.1...

WordPress Product Badge, Label, Countdown Timer for WooCommerce plugin 7.0.0-7.5.1 - Unauthenticated Non-Public Product Disclosure vulnerability

Unauthenticated Non-Public Product Disclosure vulnerability discovered by Que Thanh Tuan in WordPress Plugin Product Badge, Label, Countdown Timer for WooCommerce versions 7.0.0-7.5.1...

WordPress Paymob for WooCommerce plugin < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification vulnerability

Contributor+ Payment Gateway Configuration Deletion and Modification vulnerability discovered by ryan fabella in WordPress Plugin Paymob for WooCommerce versions 4.1.14...

WordPress FluentBoards plugin 1.95-2.0.15 - Unauthenticated Board Member Email Address Disclosure vulnerability

Unauthenticated Board Member Email Address Disclosure vulnerability discovered by vuxvinh in WordPress Plugin FluentBoards versions 1.95-2.0.15...

WordPress JSM Show Post Metadata plugin < 4.9.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by pervinzahidli in WordPress Plugin JSM Show Post Metadata versions 4.9.1...

WordPress Paymob for WooCommerce plugin < 4.1.14 - Unauthenticated Saved Card Token Write to Any User vulnerability

Unauthenticated Saved Card Token Write to Any User vulnerability discovered by Salúa Es-sair in WordPress Plugin Paymob for WooCommerce versions 4.1.14...

WordPress Forminator Forms plugin 1.17.1-1.57.2.0 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link vulnerability

Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link vulnerability discovered by vuxvinh in WordPress Plugin Forminator versions 1.17.1-1.57.2.0...

WordPress Post Grid Gutenberg Blocks plugin < 5.0.41 - Unauthenticated Custom Field Key Disclosure vulnerability

Unauthenticated Custom Field Key Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin PostX versions 5.0.41...

WordPress WP Recipe Maker plugin 9.8.0-10.8.1 - Unauthenticated DoS vulnerability

Unauthenticated DoS vulnerability discovered by Isuka sanuj in WordPress Plugin WP Recipe Maker versions 9.8.0-10.8.1...

WordPress Forminator Forms plugin 1.38.1-1.57.2.0 - Subscriber+ Form Stripe Field Migration vulnerability

Subscriber+ Form Stripe Field Migration vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Forminator versions 1.38.1-1.57.2.0...

WordPress Real3D Flipbook plugin < 5.4 - Author+ Content Deletion and Stored XSS vulnerability

Author+ Content Deletion and Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Real 3D FlipBook versions 5.4...

WordPress WP Recipe Maker plugin < 10.8.2 - Subscriber+ Non-Public List Title Disclosure vulnerability

Subscriber+ Non-Public List Title Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin WP Recipe Maker versions 10.8.2...

WordPress HappyAddons for Elementor plugin < 3.50.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Happy Addons for Elementor versions 3.50.0...

WordPress WP Recipe Maker plugin 10.3.0-10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure vulnerability

Subscriber+ Draft and Private Recipe Content Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin WP Recipe Maker versions 10.3.0-10.8.1...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write vulnerability

Subscriber+ Cross-User Favorites Read and Write vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Directorist versions 8.9.5...

WordPress The Events Calendar plugin 6.15.16.1-6.17.4 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover vulnerability

Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.15.16.1-6.17.4...

WordPress The Events Calendar plugin 4.5-6.17.4 - Unauthenticated Non-Public Venue and Organizer Disclosure vulnerability

Unauthenticated Non-Public Venue and Organizer Disclosure vulnerability discovered by Kaveesha Nirmal in WordPress Plugin The Events Calendar versions 4.5-6.17.4...

WordPress The Events Calendar plugin 6.15.0-6.17.4 - Contributor+ Content Publication vulnerability

Contributor+ Content Publication vulnerability discovered by Jashid Sany in WordPress Plugin The Events Calendar versions 6.15.0-6.17.4...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 8.1-8.9.4 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Directorist versions 8.1-8.9.4...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 8.9.1-8.9.4 - Subscriber+ Paid Order and Payment Record Forgery vulnerability

Subscriber+ Paid Order and Payment Record Forgery vulnerability discovered by LevinityCyber in WordPress Plugin Directorist versions 8.9.1-8.9.4...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9.5 - Subscriber+ SSRF vulnerability

Subscriber+ SSRF vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin Directorist versions 8.9.5...

WordPress Email Subscribers & Newsletters plugin < 5.9.35 - Unauthenticated Subscription Status Change vulnerability

Unauthenticated Subscription Status Change vulnerability discovered by Usama Arshad in WordPress Plugin Email Subscribers & Newsletters versions 5.9.35...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure vulnerability

Subscriber+ Quiz Attempt Grade Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.50...

WordPress Better Payment plugin < 2.3.4 - Unauthenticated Payment Amount Manipulation vulnerability

Unauthenticated Payment Amount Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More versions 2.3.4...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Subscriber+ Stored HTML Injection vulnerability

Subscriber+ Stored HTML Injection vulnerability discovered by Jaime F. Murillo in WordPress Plugin MasterStudy LMS versions 3.7.50...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 8.5-8.9.4 - Subscriber+ Order and Financial Record Disclosure vulnerability

Subscriber+ Order and Financial Record Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Directorist versions 8.5-8.9.4...

WordPress zportals plugin < 6.4.2 - Subscriber+ User Email Disclosure vulnerability

Subscriber+ User Email Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Zportals versions 6.4.2...

WordPress zportals plugin < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update vulnerability

Subscriber+ Arbitrary Plugin Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Zportals versions 6.4.2...

WordPress divi-dash plugin < 1.0.7 - Unauthenticated Denial of Service vulnerability

Unauthenticated Denial of Service vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Divi Dash versions 1.0.7...

WordPress Real3D Flipbook plugin < 5.4 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Hanif Naufal Rahman in WordPress Plugin Real 3D FlipBook versions 5.4...

WordPress Social Commerce for WooCommerce plugin <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update vulnerability

Unauthenticated Plugin Option and Product Sync Status Update vulnerability discovered by Pablo González, Fran Ramirez and Iñigo Sánchez in WordPress Plugin Social Commerce for WooCommerce versions = 2.5.4...

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment cross-project integrity write, bypassing project RBAC and the audit log vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

NPM: Unleash: Clone-feature lets a user copy a feature from a project they cannot read

NPM: Unleash: Clone-feature lets a user copy a feature from a project they cannot read vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

NPM: Unleash: CR-approval email renders user-controlled raw HTML

NPM: Unleash: CR-approval email renders user-controlled raw HTML vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

NPM: mppx: Gas Draining with access list

NPM: mppx: Gas Draining with access list vulnerability discovered by ? in WordPress Npm mppx versions 0.8.2...

NPM: mppx: Gas Draining with padding

NPM: mppx: Gas Draining with padding vulnerability discovered by ? in WordPress Npm mppx versions 0.8.1...

NPM: request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

NPM: request-filtering-agent: Synchronous throw from createConnection for literal private-IP hosts bypasses req.on'error', crashing the Node.js process vulnerability discovered by ? in WordPress Npm request-filtering-agent versions 3.2.1...

WordPress Advanced Contact form 7 DB plugin <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure vulnerability

Missing Authorization to Authenticated Contributor+ Information Disclosure vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Advanced Contact form 7 DB versions = 2.1.1...

WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Manager versions = 2.9.19...

NPM: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

NPM: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...

NPM: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

NPM: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...

WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Oly Hossen in WordPress Plugin TrustedLogin Connector versions = 2.0.3...

WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion to Remote Code Execution vulnerability

Unauthenticated Local File Inclusion to Remote Code Execution vulnerability discovered by Robert Ressl in WordPress core versions = 7.1.1...

WordPress Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin <= 3.15.3 - Stored Cross-Site Scripting vulnerability

Stored Cross-Site Scripting vulnerability discovered by Hippolyte Quéré Hippie Hippie in WordPress Plugin Ninja Forms versions = 3.15.3...

WordPress WP Yelp Review Slider plugin <= 9.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin WP Yelp Review Slider versions = 9.2...

WordPress Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion vulnerability

Authenticated Shop Manager+ Path Traversal to File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin CTX Feed versions = 6.6.43...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Yu Liu in WordPress Plugin TranslatePress versions = 3.3.5...

WordPress Booking Calendar plugin <= 11.8.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Booking Calendar versions = 11.8.3...

WordPress GiveWP plugin < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin GiveWP versions 4.16.9...