WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Sakri Rafael Koskimies in WordPress Plugin King Addons for Elementor versions = 51.1.81...

WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetBlocks For Elementor versions = 1.5.2...

WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetSearch versions = 3.6.3...

WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin PropertyHive versions = 2.2.6...

WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.1...

WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by John Ryan Albon in WordPress Plugin Product Feed Manager versions = 7.12.0...

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ayukiab in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.19...

WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nixxies in WordPress Plugin PublishPress Series versions = 3.1.3...

WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Maps versions = 4.9.9...

WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Newsletters versions = 4.18...

WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPMasterToolKit versions = 2.22.0...

WordPress Brizy – Page Builder plugin <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Tharadol Suksamran d3kc4rt1 in WordPress Plugin Brizy versions = 2.8.14...

WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability

Email Verification Bypass vulnerability discovered by Ahmed Embaby in WordPress Plugin FluentAuth – The Ultimate Authorization & Security Plugin for WordPress versions = 2.1.2...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability

Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability discovered by Sorra in WordPress Plugin LatePoint versions = 5.6.9...

WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WC Vendors Marketplace versions = 2.7.2.1...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover vulnerability

Authenticated Custom+ Missing Authorization to Limited Account Takeover vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Amelia versions = 2.4.4...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass vulnerability

Missing Authorization to Unauthenticated Payment Bypass vulnerability discovered by ricky morty in WordPress Plugin Amelia versions = 2.4.5...

WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SKT Addons for Elementor versions = 4.0...

WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.11...

WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin PublishPress Series versions = 3.1.3...

WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MC Woocommerce Wishlist versions = 1.9.21...

WordPress ShareOpenly plugin < 1.2.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by blacksolo1 in WordPress Plugin ShareOpenly versions 1.2.1...

WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 3.16.1 - Unauthenticated Limited File Upload vulnerability

Unauthenticated Limited File Upload vulnerability discovered by Nir Yehoshua in WordPress Plugin Profile Builder versions = 3.16.1...

WordPress Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) plugin <= 9.8.1 - Missing Authorization to 2FA Bypass vulnerability

Missing Authorization to 2FA Bypass vulnerability discovered by Michael Holmquist in WordPress Plugin Really Simple SSL versions = 9.8.1...

WordPress OSM – OpenStreetMap plugin < 6.1.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin OSM versions 6.1.15...

WordPress Loops & Logic plugin <= 4.3.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Joshua Martinelle in WordPress Plugin Loops & Logic versions = 4.3.1...

WordPress JWT Authentication for WP REST APIs plugin <= 4.7.0 - Unauthenticated Authentication Method Downgrade vulnerability

Unauthenticated Authentication Method Downgrade vulnerability discovered by Choriyev Qahramon in WordPress Plugin WordPress REST API Authentication versions = 4.7.0...

WordPress Design Scuole Italia plugin 1.0-2.18.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by ? in WordPress Theme Design Scuole Italia versions 1.0-2.18.2...

WordPress Seraphinite Accelerator plugin < 2.29.24 - Subscriber+ DoS vulnerability

Subscriber+ DoS vulnerability discovered by Ángel PS drtz in WordPress Plugin Seraphinite Accelerator versions 2.29.24...

WordPress Design Scuole Italia plugin 2.6.0-2.18.1 - Unauthenticated Arbitrary File Donwload vulnerability

Unauthenticated Arbitrary File Donwload vulnerability discovered by ? in WordPress Theme Design Scuole Italia versions 2.6.0-2.18.1...

WordPress LearnPress plugin 4.2.6.4-4.4.6 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin LearnPress versions 4.2.6.4-4.4.6...

WordPress Optimole plugin 4.2.3-4.2.11 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Optimole versions 4.2.3-4.2.11...

WordPress MultiVendorX plugin 5.0.0-5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite vulnerability

Subscriber+ Arbitrary Store Data and Ownership Overwrite vulnerability discovered by Farid Narimanov in WordPress Plugin MultiVendorX versions 5.0.0-5.0.15...

WordPress Event Booking Manager for WooCommerce plugin < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure vulnerability

Contributor+ Payment Gateway Credential Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.6.0...

WordPress EWWW Image Optimizer plugin < 8.7.7 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin EWWW Image Optimizer versions 8.7.7...

WordPress Master Addons for Elementor plugin 3.0.0-3.1.8 - Unauthenticated Popup Deactivation vulnerability

Unauthenticated Popup Deactivation vulnerability discovered by JunHee CHO in WordPress Plugin Master Addons for Elementor versions 3.0.0-3.1.8...

WordPress Motors plugin < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure vulnerability

Unauthenticated Draft/Private Listing Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin Motors versions 1.4.121...

WordPress Active Woot Products Tables for WooCommerce. 100% FREE plugin 2.1.2 - Subscriber+ Arbitrary Post Title Modification vulnerability

Subscriber+ Arbitrary Post Title Modification vulnerability discovered by JunHee CHO in WordPress Plugin Active Products Tables for WooCommerce versions 2.1.2...

WordPress Event Booking Manager for WooCommerce plugin 5.3.6-5.3.7 - Unauthenticated Attendee PII Disclosure vulnerability

Unauthenticated Attendee PII Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WpEvently versions 5.3.6-5.3.7...

WordPress Comments Import & Export plugin 2.1.11-2.5.3 - Author+ Comment PII Disclosure vulnerability

Author+ Comment PII Disclosure vulnerability discovered by a0yark in WordPress Plugin Comments Import & Export versions 2.1.11-2.5.3...

WordPress Newsletter plugin < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification vulnerability

Unauthenticated Subscriber PII Disclosure and Modification vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Newsletter versions 9.3.8...

WordPress HT Mega Addons for Elementor plugin 3.2.0-3.2.5 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin HT Mega versions 3.2.0-3.2.5...

WordPress LearnPress plugin 4.4.3-4.4.6 - Unauthenticated Quiz Answer Disclosure vulnerability

Unauthenticated Quiz Answer Disclosure vulnerability discovered by Nicat Sultanov in WordPress Plugin LearnPress versions 4.4.3-4.4.6...

WordPress GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin <= 2.34.6 - Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script vulnerability

Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script vulnerability discovered by Supakiad S. m3ez in WordPress Plugin GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites versions = 2.34.6...

WordPress Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Custom Twitter Feeds Tweets Widget versions = 2.8.0...

WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rahul Yadav in WordPress Plugin Easy Invoice versions = 2.3.8...

WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nixxies in WordPress Plugin Cooked versions = 1.16.0...

WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Membership versions = 4.8.2...

WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Booking Calendar versions = 11.7...

WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by asdqgggg in WordPress Plugin User Registration versions = 5.2.7...