NPM: mppx: Gas Draining with access list

NPM: mppx: Gas Draining with access list vulnerability discovered by ? in WordPress Npm mppx versions 0.8.2...

NPM: mppx: Gas Draining with padding

NPM: mppx: Gas Draining with padding vulnerability discovered by ? in WordPress Npm mppx versions 0.8.1...

NPM: request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process

NPM: request-filtering-agent: Synchronous throw from createConnection for literal private-IP hosts bypasses req.on'error', crashing the Node.js process vulnerability discovered by ? in WordPress Npm request-filtering-agent versions 3.2.1...

WordPress Advanced Contact form 7 DB plugin <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure vulnerability

Missing Authorization to Authenticated Contributor+ Information Disclosure vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Advanced Contact form 7 DB versions = 2.1.1...

WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Manager versions = 2.9.19...

NPM: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header

NPM: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...

NPM: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header

NPM: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...

WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Oly Hossen in WordPress Plugin TrustedLogin Connector versions = 2.0.3...

WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion to Remote Code Execution vulnerability

Unauthenticated Local File Inclusion to Remote Code Execution vulnerability discovered by Robert Ressl in WordPress core versions = 7.1.1...

WordPress Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin <= 3.15.3 - Stored Cross-Site Scripting vulnerability

Stored Cross-Site Scripting vulnerability discovered by Hippolyte Quéré Hippie Hippie in WordPress Plugin Ninja Forms versions = 3.15.3...

WordPress WP Yelp Review Slider plugin <= 9.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin WP Yelp Review Slider versions = 9.2...

WordPress Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion vulnerability

Authenticated Shop Manager+ Path Traversal to File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin CTX Feed versions = 6.6.43...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Yu Liu in WordPress Plugin TranslatePress versions = 3.3.5...

WordPress Booking Calendar plugin <= 11.8.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Booking Calendar versions = 11.8.3...

WordPress GiveWP plugin < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin GiveWP versions 4.16.9...

WordPress Payment Gateway for PayPal on WooCommerce plugin < 9.2.1 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Charles Vosburgh in WordPress Plugin Payment Gateway for PayPal on WooCommerce versions 9.2.1...

WordPress Meow Gallery plugin < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by JunHee CHO in WordPress Plugin Meow Gallery versions 5.5.5...

WordPress Forminator Forms plugin < 1.57.2.1 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Forminator versions 1.57.2.1...

WordPress Forminator Forms plugin < 1.57.2.1 - Authenticated RCE vulnerability

Authenticated RCE vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Forminator versions 1.57.2.1...

WordPress Redux Framework plugin <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting vulnerability

Authenticated Subscriber+ Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Redux Framework versions = 4.5.13...

WordPress Photo Gallery, Sliders, Proofing and Themes plugin < 4.5.0 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Alihan Şahin in WordPress Plugin NextGEN Gallery versions 4.5.0...

WordPress MC4WP: Mailchimp for WordPress plugin <= 4.14.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by nism0 in WordPress Plugin MC4WP versions = 4.14.0...

WordPress LiteSpeed Cache plugin <= 7.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by mak3bread in WordPress Plugin LiteSpeed Cache versions = 7.9...

WordPress AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Mitchell in WordPress Plugin AppMySite versions = 3.15.3...

WordPress Redux Framework plugin <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Luc Huynh from Noventiq RedTeam in WordPress Plugin Redux Framework versions = 4.5.13...

WordPress WP Customer Reviews plugin <= 3.7.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Quang in WordPress Plugin WP Customer Reviews versions = 3.7.8...

WordPress WPGraphQL Smart Cache plugin < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting vulnerability

Unauthenticated Persisted Query Registration and Alias Squatting vulnerability discovered by msfire in WordPress Plugin WPGraphQL Smart Cache versions 2.3.2...

WordPress Master Blocks plugin 1.4.1-1.4.1.4 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Master Blocks versions 1.4.1-1.4.1.4...

WordPress Ultimate Member plugin < 2.13.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Ultimate Member versions 2.13.1...

WordPress WP Import Export Lite plugin < 3.9.35 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.35...

WordPress Give Tributes plugin <= 2.3.1 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Voyag3r-Security in WordPress Plugin Give Tributes versions = 2.3.1...

WordPress Import and export users and customers plugin < 2.5.2 - Custom Role Privilege Escalation to Administrator vulnerability

Custom Role Privilege Escalation to Administrator vulnerability discovered by BINESH MADHARAPU in WordPress Plugin Import and export users and customers versions 2.5.2...

WordPress Import and export users and customers plugin < 2.5.2 - Custom Role Privilege Escalation to Administrator vulnerability

Custom Role Privilege Escalation to Administrator vulnerability discovered by yzx001 in WordPress Plugin Import and export users and customers versions 2.5.2...

WordPress Unlimited Elements For Elementor plugin < 2.0.20 - Subscriber+ PHP Object Injection vulnerability

Subscriber+ PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 2.0.20...

WordPress MgoSync plugin 2.1.5-2.1.6 - Unauthenticated WooCommerce API Credential Disclosure vulnerability

Unauthenticated WooCommerce API Credential Disclosure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin MgoSync versions 2.1.5-2.1.6...

WordPress VikRentItems Flexible Rental Management System plugin < 1.2.4 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin VikRentItems Flexible Rental Management System versions 1.2.4...

WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Marc-André Beaulieu h3dg3h0g in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.50...

WordPress WP Ultimate Review plugin <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by jtb75 in WordPress Plugin Wp Ultimate Review versions = 2.4.2...

WordPress HUSKY – Products Filter for WooCommerce Professional plugin <= 1.4.4 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by crow in WordPress Plugin HUSKY versions = 1.4.4...

WordPress Web to Print Online Designer plugin < 2.15.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Web to Print Online Designer versions 2.15.0...

WordPress SAML Single Sign On plugin < 6.0.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin SAML SP Single Sign On versions 6.0.0...

WordPress Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin ProfilePress versions = 4.17.2...

WordPress The Welcomizer plugin <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution vulnerability

Missing Authorization to Authenticated Subscriber+ Remote Code Execution vulnerability discovered by Nabil Irawan in WordPress Plugin The Welcomizer versions = 2.8.1...

WordPress UsersWP plugin < 1.5.10 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin UsersWP Social Login versions 1.5.10...

WordPress Text Styler plugin <= 1.1.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Text Styler versions = 1.1.1...

WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by 0xQRx in WordPress Plugin WP Travel Engine versions = 6.8.0...

WordPress PixelPlay plugin <= 1.0.2 - Missing Authorization to Unauthenticated Arbitrary API Key Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary API Key Deletion vulnerability discovered by Phat RiO in WordPress Plugin PixelPlay versions = 1.0.2...

WordPress Image Buzz plugin <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary API Key Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary API Key Modification vulnerability discovered by Phat RiO in WordPress Plugin Image Buzz versions = 1.0.3...

WordPress Handily plugin <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification vulnerability discovered by Phat RiO in WordPress Plugin Handily versions = 1.0.3...

WordPress WP-CRM System – Manage Clients and Projects plugin <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information vulnerability

Authenticated Contributor+ Exposure of Sensitive Information vulnerability discovered by Teerachai Somprasong in WordPress Plugin WP-CRM System versions = 3.4.7...