49993 matches found
WordPress Easy Appointments plugin <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion vulnerability
Missing Authorization to Authenticated Contributor+ Arbitrary Connection Deletion vulnerability discovered by Vamshi Krishna Upadrasta in WordPress Plugin Easy Appointments versions = 3.12.27...
NPM: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
NPM: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.11...
NPM: Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
NPM: Auth.js: Configuration errors can cause existence-based auth checks to fail open auth object populated with an error vulnerability discovered by ? in WordPress Npm next-auth versions = 5.0.0-beta.0, = 5.0.0-beta.31...
NPM: Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
NPM: Auth.js: getToken throws an uncaught exception on malformed Bearer authorization headers vulnerability discovered by ? in WordPress Npm next-auth versions = 4.0.6, = 4.24.14...
NPM: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
NPM: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass vulnerability discovered by ? in WordPress Npm next-auth versions = 4.10.3, 4.24.15...
NPM: Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
NPM: Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them vulnerability discovered by ? in WordPress Npm next-auth versions = 4.24.14...
WordPress Post Grid Gutenberg Blocks – PostX plugin <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin PostX versions = 5.0.32...
WordPress Participants Database plugin <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure vulnerability
Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure vulnerability discovered by Robert Hartinger in WordPress Plugin Participants Database versions = 2.7.8.3...
WordPress MapSVG – Vector maps, Image maps, Google Maps plugin <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin MapSVG versions = 8.14.0...
WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability
Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Abu Hurayra HurayraIIT in WordPress Plugin Kirki versions = 6.0.14...
WordPress Firelight Lightbox plugin <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored DOM Cross-Site Scripting vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Firelight Lightbox versions = 2.3.20...
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.7.10...
WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Thaer Assfour in WordPress Plugin AWP Classifieds versions = 4.4.7...
WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin 3D Flipbook PDF Viewer & Embedder versions = 1.4.2...
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Zainul Anwar Adi Putra in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions = 4.7.10...
WordPress Byteflows Travel & Hotel Booking plugin <= 1.0.0 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Byteflows Travel & Hotel Booking versions = 1.0.0...
WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Paid Member Subscriptions versions = 3.0.7...
WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability
SQL Injection vulnerability discovered by qdtad in WordPress Plugin GamiPress versions = 7.9.7...
WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce versions = 2.10.22...
WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin CoCart – Headless ecommerce versions = 4.8.4...
WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Austin Ginder in WordPress Plugin Thrive Product Manager versions = 10.9.2...
WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mitchell in WordPress Plugin Post My CF7 Form versions = 6.2.0...
WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by ParkHyunWoo in WordPress Plugin Relevanssi Light versions = 1.2.2...
WordPress Booking and Rental Manager plugin <= 2.7.2 - Price Manipulation vulnerability
Price Manipulation vulnerability discovered by dodoh4t in WordPress Plugin Booking and Rental Manager versions = 2.7.2...
WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.10.0 - Unknown vulnerability
Unknown vulnerability discovered by dodoh4t in WordPress Plugin Falcon – WordPress Optimizations & Tweaks versions = 2.10.0...
WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by timomangcut in WordPress Plugin Stripe For WooCommerce versions = 4.0.7...
WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by hivesec in WordPress Plugin Ebook Store versions = 6.19...
WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by VuNBT in WordPress Plugin ShipTime: Discounted Shipping Rates versions = 1.1.1...
WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...
WordPress Hide My WP Ghost plugin <= 7.0.06 - 2FA Bypass vulnerability
2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Hide My WP Ghost versions = 7.0.06...
WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by testoun in WordPress Plugin Popup for CF7 with Sweet Alert versions = 1.6.5...
WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kwayy HTML Sitemap versions = 4.0...
WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Machete versions = 5.2...
WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Cyr to Lat reloaded – transliteration of links and file names versions = 1.3.3...
WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری versions = 4.4.5...
WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin TinyMCE Templates versions = 4.8.1...
WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Custom links in Elementor Image Carousel versions = 1.1.1...
WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Smart SEO Tool versions = 4.1.2...
WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Persian Woocommerce SMS versions = 7.2.2...
WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin TemplateSpare versions = 4.2.2...
WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Qubely versions = 1.8.14...
WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Graphina versions = 3.1.12...
WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin BSK PDF Manager versions = 3.8...
WordPress LIQUID SPEECH BALLOON plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LIQUID SPEECH BALLOON versions = 1.2.6...
WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Civi Framework versions = 2.2.0...
WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by ParkHyunWoo in WordPress Plugin Visualizer versions = 4.0.1...
WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Bonds in WordPress Plugin Avada Custom Branding versions = 1.2...
WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...
WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Social Ninja versions = 4.3.0...
WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Accept Donations with PayPal & Stripe versions = 1.5.5...