WordPress Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification vulnerability

Missing Authorization to Authenticated Contributor+ Site-Wide Payment Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin WpEvently versions = 5.3.7...

WordPress Newsletters plugin <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Newsletters versions = 4.15...

WordPress Newsletters plugin <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Newsletters versions = 4.15...

WordPress WowStore – Store Builder & Product Blocks for WooCommerce plugin <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WowStore versions = 4.4.24...

WordPress WowStore – Store Builder & Product Blocks for WooCommerce plugin <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WowStore versions = 4.4.24...

WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export User Data versions = 2.2.6...

WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by lqc in WordPress Plugin Super Socializer versions = 7.14.5...

WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by 0xzenko in WordPress Plugin Vimeo versions = 1.2.2...

WordPress Super Socializer plugin <= 7.14.5 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by HaiND in WordPress Plugin Super Socializer versions = 7.14.5...

WordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Staff Training versions = 1.0.7...

WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Formidable Forms Signature Online Contract Automation versions = 2.0.1...

WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Luis Koleski in WordPress Plugin WP OAuth Server versions = 6.2.0...

WordPress Easy PayPal Buy Now Button plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy PayPal Buy Now Button versions = 2.0.4...

WordPress AffiliateWP plugin <= 2.35.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin AffiliateWP versions = 2.35.0...

WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by whitebyte in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.10...

WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by VanTastic in WordPress Plugin wpDataTables versions = 7.5.1...

WordPress Simply Schedule Appointments plugin <= 1.6.12.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.10...

WordPress AIWU plugin <= 1.5.6 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by qdtad in WordPress Plugin AIWU versions = 1.5.6...

WordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin BOX NOW Delivery Croatia versions = 3.3.0...

WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability

Captcha Bypass vulnerability discovered by johska in WordPress Plugin Element Pack Elementor Addons versions = 8.7.13...

WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 3.0.5...

WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mukhlis Amien in WordPress Plugin Business Directory versions = 6.4.24...

WordPress Breakdance plugin <= 2.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by johska in WordPress Plugin Breakdance versions = 2.6.1...

WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin AI Engine versions = 3.6.8...

WordPress Qode Tours plugin <= 3.1.3.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Bonds in WordPress Plugin Qode Tours versions = 3.1.3.1...

WordPress Creative Mail plugin <= 1.6.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Taichi Kashimura in WordPress Plugin Creative Mail versions = 1.6.9...

WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by daroo in WordPress Theme Betheme versions = 28.4.2...

WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Jeg Elementor Kit versions = 3.2.10...

WordPress FluentCart A New Era of eCommerce plugin < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering vulnerability

Subscriber+ Subscription Payment-Method Tampering vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin FluentCart versions 1.4.0...

WordPress Quiz and Survey Master (QSM) plugin < 11.1.5 - Contributor+ Arbitrary Template Deletion vulnerability

Contributor+ Arbitrary Template Deletion vulnerability discovered by md. minaruzzaman shovon in WordPress Plugin Quiz And Survey Master versions 11.1.5...

WordPress Event Tickets and Registration plugin < 5.28.4 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by FlashKiss in WordPress Plugin Event Tickets versions 5.28.4...

WordPress Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cozy Blocks versions = 2.2.11...

WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action vulnerability

Unauthenticated Sensitive Information Exposure in 'wpbotsendemailtranscript' AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin ChatBot versions = 8.5.9...

WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay vulnerability

Missing Authorization to Unauthenticated Email Relay vulnerability discovered by Wordfence PRISM in WordPress Plugin ChatBot versions = 8.5.9...

WordPress StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce plugin <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart versions = 2.1.0...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.1 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Tutor LMS versions = 4.0.1...

WordPress StoreGrowth plugin <= 2.1.0 - Missing Authorization to Unauthenticated Options Update vulnerability

Missing Authorization to Unauthenticated Options Update vulnerability discovered by Wordfence PRISM in WordPress Plugin StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart versions = 2.1.0...

WordPress Shortcodify plugin <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Shortcodify versions = 1.4.3...

WordPress SpeedyCache – Cache, Optimization, Performance plugin <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read vulnerability

Authenticated Administrator+ Arbitrary File Read vulnerability discovered by Chiao-Lin Yu Steven Meow in WordPress Plugin SpeedyCache versions = 1.3.8...

WordPress Media Cleaner: Clean your WordPress! plugin <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery vulnerability

Authenticated Administrator+ Server-Side Request Forgery vulnerability discovered by lucsob in WordPress Plugin Media Cleaner versions = 7.0.3...

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

WordPress GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin GamiPress versions = 7.9.9.1...

WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin ShopLentor versions = 3.4.5...

WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.4.5 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin ShopLentor versions = 3.4.5...

WordPress PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive PDF Disclosure vulnerability discovered by sl4x0 in WordPress Plugin PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer versions = 1.1.0...

WordPress Demi – One Click Demo Import, Backup & Site Migration plugin <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy vulnerability

Unauthenticated Information Exposure to Arbitrary Directory Copy vulnerability discovered by SAHRAOUI AYMEN in WordPress Plugin Demi One Click Demo Import, Backup & Site Migration versions = 0.0.8...

WordPress WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin <= 4.3.7 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.7...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion vulnerability

Authenticated Administrator+ Arbitrary File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin BP Better Messages versions = 2.15.19...

WordPress Advanced Form Integration plugin <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary MailUp OAuth Token Overwrite vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Form Integration versions = 2.6.0...