WordPress FluentBoards plugin < 2.0.15 - Board Member+ Comment Author Spoofing vulnerability

Board Member+ Comment Author Spoofing vulnerability discovered by vuxvinh in WordPress Plugin FluentBoards versions 2.0.15...

WordPress Rox Appointment Booking plugin < 1.2.8 - Unauthenticated Internal Notes Disclosure vulnerability

Unauthenticated Internal Notes Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.8...

WordPress kboard plugin < 6.7 - Unauthenticated Board Media Deletion vulnerability

Unauthenticated Board Media Deletion vulnerability discovered by SeongJun Joo in WordPress Plugin kboard versions 6.7...

WordPress Subscriptions for WooCommerce plugin < 2.0.3 - Unauthenticated Subscription Data Disclosure vulnerability

Unauthenticated Subscription Data Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Subscriptions for WooCommerce versions 2.0.3...

WordPress Visualizer plugin < 4.0.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Visualizer versions 4.0.8...

WordPress Newsletter plugin < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure vulnerability

Unauthenticated Open Redirect and Subscriber Token Disclosure vulnerability discovered by Artus KG in WordPress Plugin Newsletter versions 9.3.7...

WordPress Subscriptions for WooCommerce plugin < 2.0.3 - Subscription Cancellation vulnerability

Subscription Cancellation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Subscriptions for WooCommerce versions 2.0.3...

WordPress LearnPress plugin 4.3.2.8-4.4.6 - Unauthenticated Order Data Disclosure vulnerability

Unauthenticated Order Data Disclosure vulnerability discovered by Artus KG in WordPress Plugin LearnPress versions 4.3.2.8-4.4.6...

WordPress LearnPress plugin 4.2.7.1-4.4.6 - Unauthenticated Unpublished Course Disclosure vulnerability

Unauthenticated Unpublished Course Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin LearnPress versions 4.2.7.1-4.4.6...

WordPress LearnPress plugin 4.2.9-4.4.6 - Unauthenticated Question Bank Disclosure vulnerability

Unauthenticated Question Bank Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin LearnPress versions 4.2.9-4.4.6...

WordPress LearnPress plugin 4.4.6 - Unauthenticated Student Enrollment Disclosure vulnerability

Unauthenticated Student Enrollment Disclosure vulnerability discovered by vuxvinh in WordPress Plugin LearnPress versions 4.4.6...

WordPress Tutor LMS plugin 4.0.0-4.0.7 - Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability

Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability discovered by Shirshak in WordPress Plugin Tutor LMS versions 4.0.0-4.0.7...

WordPress FluentBoards plugin < 2.0.15 - Subscriber+ Private Board Membership Disclosure vulnerability

Subscriber+ Private Board Membership Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin FluentBoards versions 2.0.15...

WordPress Formidable Forms plugin 6.34 - Unauthenticated Stored Content Injection vulnerability

Unauthenticated Stored Content Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Formidable Forms versions 6.34...

WordPress Eventin plugin 4.1.5-4.1.23 - Unauthenticated Order and Attendee Status Reset vulnerability

Unauthenticated Order and Attendee Status Reset vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Event Solution versions 4.1.5-4.1.23...

WordPress WPLP Cookie Consent plugin < 4.4.4 - Arbitrary Post Deletion vulnerability

Arbitrary Post Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.4...

WordPress Xpro Addons — 140+ Widgets for Elementor plugin < 1.7.9 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Xpro Elementor Addons versions 1.7.9...

WordPress Schema & Structured Data for WP & AMP plugin 1.63-1.65 - Contributor+ Non-Public Post Content Disclosure vulnerability

Contributor+ Non-Public Post Content Disclosure vulnerability discovered by Shirshak in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.63-1.65...

WordPress Schema & Structured Data for WP & AMP plugin 1.46-1.65 - Unauthenticated Non-Public Comment Content Disclosure vulnerability

Unauthenticated Non-Public Comment Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.46-1.65...

WordPress Ni WooCommerce Sales Report plugin < 4.2.0 - Unauthenticated Order and Customer Data Disclosure vulnerability

Unauthenticated Order and Customer Data Disclosure vulnerability discovered by ryan fabella in WordPress Plugin Ni WooCommerce Sales Report versions 4.2.0...

WordPress Schema & Structured Data for WP & AMP plugin < 1.66 - Unauthenticated Password-Protected Post Content Disclosure vulnerability

Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.66...

WordPress WP Import Export Lite plugin < 3.9.33 - Contributor+ Stored DOM XSS vulnerability

Contributor+ Stored DOM XSS vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated SQLi vulnerability

Authenticated SQLi vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.33 - Admin+ SSRF vulnerability

Admin+ SSRF vulnerability discovered by Yassin Mohamed in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress Eventin plugin < 4.1.24 - Unauthenticated Ticket Price Rewrite vulnerability

Unauthenticated Ticket Price Rewrite vulnerability discovered by Nir Yehoshua in WordPress Plugin WP Event Solution versions 4.1.24...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated SQLi vulnerability

Authenticated SQLi vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Sensitive File Disclosure vulnerability

Authenticated Sensitive File Disclosure vulnerability discovered by Hasyros in WordPress Plugin WP Import Export Lite versions 3.9.33...

WordPress aVideo plugin <= 29.0 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by rajivraj in WordPress Plugin aVideo versions = 29.0...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Authenticated (Subscriber+) Username Enumeration vulnerability

Authenticated Subscriber+ Username Enumeration vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...

WordPress Admin Menu Editor Pro 2.35-2.36 - Backdoor vulnerability

Backdoor vulnerability discovered by Unknown in WordPress Plugin Admin Menu Editor Pro versions 2.35-2.36...

WordPress Online Scheduling and Appointment Booking System plugin <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversationid' Parameter vulnerability discovered by jtb75 - NG20 LLC in WordPress Plugin Bookly versions = 28.1...

WordPress Bold Page Builder plugin <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'shortcodecontent' Parameter vulnerability discovered by suyoung kimAhnLab - AhnLab in WordPress Plugin Bold Page Builder versions = 5.9.6...

WordPress WP-Lister Lite for eBay plugin <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request vulnerability

Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request vulnerability discovered by thevietronin - GalaxyOne in WordPress Plugin WP-Lister Lite for eBay versions = 3.8.9...

WordPress JetFormBuilder plugin <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

Unauthenticated Privilege Escalation via 'jetenginebookingformid' Parameter vulnerability discovered by daroo in WordPress Plugin JetFormBuilder versions = 3.6.2...

WordPress Advanced Popups plugin <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field vulnerability

Authenticated Author+ Stored Cross-Site Scripting via 'Notification Button Link' Field vulnerability discovered by Nguyen Cong Quang in WordPress Plugin Advanced Popups versions = 1.2.3...

WordPress Ad Inserter plugin <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter vulnerability

Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter vulnerability discovered by Evan - Independent Security Researcher in WordPress Plugin Ad Inserter versions = 2.8.16...

WordPress Contest Gallery plugin <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter vulnerability discovered by mad4cyber - nonprofit in WordPress Plugin Contest Gallery versions = 32.0.1...

WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Devlin Jenkins in WordPress Plugin TrueBooker versions = 1.2.3...

WordPress WP Directory Kit plugin <= 1.5.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by adhikara13 in WordPress Plugin WP Directory Kit versions = 1.5.4...

WordPress Getwid – Gutenberg Blocks plugin <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by AlexHenry in WordPress Plugin Getwid versions = 2.1.3...

WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Migratico Lite versions = 2.6.8...

WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Joost Grunwald in WordPress Plugin Headless Single Sign On versions = 1.7.0...

WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by henise in WordPress Plugin EduAdmin Booking versions = 5.4.2...

WordPress MotoPress Hotel Booking plugin <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Hotel Booking Lite versions = 6.2.4...

WordPress Consulting - Business, Finance WordPress Theme theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation vulnerability

WordPress Consulting - Business, Finance WordPress Theme theme = 6.7.16 - Authenticated Subscriber+ Privilege Escalation vulnerability discovered by lhking in WordPress Theme Consulting versions = 6.7.16...

WordPress Advanced Custom Fields: Extended PRO plugin <= 0.9.2.6 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Tin Pham TF1T, Trong Pham dtro, Hao Ngo in WordPress Plugin Advanced Custom Fields: Extended PRO versions = 0.9.2.6...

WordPress WP Directory Kit plugin <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure vulnerability

Contributor+ Non-Public Listing Field Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions = 1.5.7...

WordPress WP Directory Kit plugin <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure vulnerability

Unauthenticated Unpublished Listing Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions = 1.5.7...