WordPress Bookit — Booking & Appointment Calendar plugin < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion vulnerability

Bookit Staff+ Arbitrary Appointment Deletion vulnerability discovered by hieus in WordPress Plugin BookIt versions 2.6.0.5...

NPM: Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text

NPM: Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text vulnerability discovered by ? in WordPress Npm paella-core versions 1.50.6...

WordPress All Bootstrap Blocks plugin 1.3.20-1.3.31 - Contributor+ LFI vulnerability

Contributor+ LFI vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin All Bootstrap Blocks versions 1.3.20-1.3.31...

WordPress Printcart Store – Web to Print Product Designer for WooCommerce plugin <= 2.8.5 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Spy0x7 in WordPress Plugin Printcart Web to Print Product Designer for WooCommerce versions = 2.8.5...

WordPress Mapster WP Maps plugin <= 1.23.0 - Authenticated (Subscriber+) Arbitrary User Meta Write vulnerability

Authenticated Subscriber+ Arbitrary User Meta Write vulnerability discovered by Wordfence PRISM in WordPress Plugin Mapster WP Maps versions = 1.23.0...

WordPress WP Multi Store Locator Pro plugin <= 4.5.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin WP Multi Store Locator Pro versions = 4.5.1...

WordPress Yo plugin 1.1-1.3.1 - Unauthenticated SQL Injection via username Parameter vulnerability

Unauthenticated SQL Injection via username Parameter vulnerability discovered by João Ramos Maciel in WordPress Plugin Yo versions 1.1-1.3.1...

WordPress Location Manager plugin <= 2.3.38 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Austin Ginder in WordPress Plugin GeoDirectory Location Manager versions = 2.3.38...

WordPress WP Shortcut Link plugin <= 1.2.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Theo Antônio Da Fonseca in WordPress Plugin WP Shortcut Link versions = 1.2.0...

WordPress WPComplete plugin <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin WPComplete versions = 2.9.9.0...

WordPress Product Question and Answer plugin <= 1.1.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Theo Antônio Da Fonseca in WordPress Plugin Product Question and Answer versions = 1.1.0...

WordPress Tz Weekly Radio Schedule plugin <= 1.8.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Theo Antônio Da Fonseca in WordPress Plugin Tz Weekly Radio Schedule versions = 1.8.1...

WordPress Tz Weekly Radio Schedule plugin <= 1.8.1 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Tz Weekly Radio Schedule versions = 1.8.1...

WordPress Paid Membership Subscriptions plugin < 3.0.9 - Unauthenticated Membership Payment Bypass vulnerability

Unauthenticated Membership Payment Bypass vulnerability discovered by Charles Vosburgh in WordPress Plugin Paid Member Subscriptions versions 3.0.9...

WordPress Autopay plugin < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion vulnerability

Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion vulnerability discovered by Artus KG in WordPress Plugin Autopay versions 5.0.1...

WordPress Robokassa payment gateway for Woocommerce plugin < 1.8.9 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Robokassa payment gateway for Woocommerce versions 1.8.9...

WordPress RestroPress plugin <= 3.4.7 - Unauthenticated Order Enumeration and Order Note Modification vulnerability

Unauthenticated Order Enumeration and Order Note Modification vulnerability discovered by Usama Arshad in WordPress Plugin RestroPress versions = 3.4.7...

WordPress Hide My WP Ghost plugin 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass vulnerability

Unauthenticated Firewall, Threat Detection and URL Hiding Bypass vulnerability discovered by Kenny in WordPress Plugin Hide My WP Ghost versions 7.0.10...

WordPress Hide My WP Ghost plugin < 7.0.11 - Unauthenticated URL Hiding Bypass vulnerability

Unauthenticated URL Hiding Bypass vulnerability discovered by Animesh Gaurav in WordPress Plugin Hide My WP Ghost versions 7.0.11...

WordPress Clean Login plugin < 1.19 - Unauthenticated CAPTCHA Bypass vulnerability

Unauthenticated CAPTCHA Bypass vulnerability discovered by Arthur Morgan in WordPress Plugin Clean Login versions 1.19...

WordPress Price Drop Alert for WooCommerce plugin <= 1.1 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Theo Antônio Da Fonseca in WordPress Plugin Price Drop Alert for WooCommerce versions = 1.1...

WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header vulnerability

Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header vulnerability discovered by Artus KG in WordPress Plugin Login/Signup Popup versions 4.0.2...

WordPress WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin <= 3.8.2 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin WCFM Marketplace versions = 3.8.2...

WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force vulnerability

Unauthenticated Account Takeover via Password Reset Code Brute Force vulnerability discovered by ryan fabella in WordPress Plugin Login/Signup Popup versions 4.0.2...

WordPress InfiniteWP Client plugin < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite vulnerability

Unauthenticated Administrator Account Takeover on Multisite vulnerability discovered by Jakub Herman in WordPress Plugin InfiniteWP Client versions 1.13.6...

WordPress SoftMarket plugin <= 1.0.0 - Unauthenticated Account Takeover via Email Verification Bypass vulnerability

Unauthenticated Account Takeover via Email Verification Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin SoftMarket — Digital Marketplace versions = 1.0.0...

WordPress To Do List Member plugin 1.4-1.6 - Unauthenticated Stored XSS, File Listing and Deletion vulnerability

Unauthenticated Stored XSS, File Listing and Deletion vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin To Do List Member versions 1.4-1.6...

WordPress PuppyFW plugin <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation vulnerability

Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin PuppyFW versions = 0.4.4...

WordPress WP Cloud Plugins - Dropbox (Out-of-the-Box) plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

WordPress WP Cloud Plugins - Dropbox Out-of-the-Box plugin 2.0-3.8.3 - Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Out-of-the-Box versions 2.0-3.8.3...

WordPress WP Cloud Plugins - Box (Lets-Box) plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

WordPress WP Cloud Plugins - Box Lets-Box plugin 2.0-3.8.3 - Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Lets-Box versions 2.0-3.8.3...

WordPress Share-one-Drive | OneDrive & SharePoint plugin for WordPress plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Share-one-Drive versions 2.0-3.8.3...

WordPress Use-your-Drive | Google Drive plugin for WordPress plugin 2.0-3.8.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by WP Cloud Plugins in WordPress Plugin Use-your-Drive versions 2.0-3.8.3...

WordPress wpShopGermany IT-RECHT KANZLEI plugin 1.6-2.3 - Unauthenticated RCE vulnerability

Unauthenticated RCE vulnerability discovered by Naoki Kawahigashi in WordPress Plugin wpShopGermany IT-RECHT KANZLEI versions 1.6-2.3...

WordPress Filter Gallery plugin <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Gallery Deletion vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Filter Gallery versions = 1.1.4...

WordPress Login with QR plugin <= 1.0.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Login with QR versions = 1.0.0...

WordPress The Pressengine plugin <= 1.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin The Pressengine versions = 1.0...

WordPress Private Feed Key plugin <= 0.1 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Private Feed Key versions = 0.1...

WordPress Clean Login plugin < 1.19 - Unauthenticated Account Creation with Registration Disabled vulnerability

Unauthenticated Account Creation with Registration Disabled vulnerability discovered by Artus KG in WordPress Plugin Clean Login versions 1.19...

WordPress All Bootstrap Blocks plugin <= 1.3.31 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin All Bootstrap Blocks versions = 1.3.31...

WordPress MasterStudy LMS WordPress Plugin plugin 3.6.2-3.7.49 - Instructor+ Student PII Disclosure vulnerability

Instructor+ Student PII Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin MasterStudy LMS versions 3.6.2-3.7.49...

WordPress Bookit — Booking & Appointment Calendar plugin < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure vulnerability

Bookit Staff+ Appointment PII Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin BookIt versions 2.6.0.5...

WordPress Easy Appointments plugin < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation vulnerability

Unauthenticated Appointment Cancellation/Confirmation vulnerability discovered by Morato Antoine in WordPress Plugin Easy Appointments versions 4.0.2.2...

WordPress Easy Appointments plugin 4.0-4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion vulnerability

Unauthenticated Arbitrary Appointment Modification and Deletion vulnerability discovered by blast in WordPress Plugin Easy Appointments versions 4.0-4.0.2.1...

WordPress King Addons for Elementor plugin < 51.1.81 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin King Addons for Elementor versions 51.1.81...

WordPress King Addons for Elementor plugin 51.1.56-51.1.80 - Author+ Missing Authorization vulnerability

Author+ Missing Authorization vulnerability discovered by Artus KG in WordPress Plugin King Addons for Elementor versions 51.1.56-51.1.80...

WordPress King Addons for Elementor plugin < 51.1.81 - Contributor+ Private Post Content Disclosure vulnerability

Contributor+ Private Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin King Addons for Elementor versions 51.1.81...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Instructor+ Order Status Manipulation vulnerability

Instructor+ Order Status Manipulation vulnerability discovered by Shivamani Vastrala in WordPress Plugin MasterStudy LMS versions 3.7.50...

WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress core versions = 7.1...

WordPress Core <= 7.1 - Author+ Private Parent Post Title Disclosure vulnerability

Author+ Private Parent Post Title Disclosure vulnerability discovered by HDWSec in WordPress core versions = 7.1...

WordPress Core <= 7.1 - Contributor+ Stored XSS via HTML API Comment Breakout vulnerability

Contributor+ Stored XSS via HTML API Comment Breakout vulnerability discovered by Jeremy Felt in WordPress core versions = 7.1...