WordPress WP Directory Kit plugin <= 1.5.7 - Editor+ SQL Injection vulnerability

Editor+ SQL Injection vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions = 1.5.7...

WordPress Design Scuole Italia plugin 1.0-2.17.3 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by ? in WordPress Theme Design Scuole Italia versions 1.0-2.17.3...

WordPress Design Scuole Italia plugin 1.0-2.17.3 - Open Redirect vulnerability

Open Redirect vulnerability discovered by ? in WordPress Theme Design Scuole Italia versions 1.0-2.17.3...

WordPress Job Postings plugin <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Jobs for WordPress versions = 2.8.1...

WordPress AI Engine plugin <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Sensitive Attachment Disclosure via 'mediaId' Parameter vulnerability discovered by Chi Trung Huynh - Duy Tan Universiy in WordPress Plugin AI Engine versions = 3.7.7...

WordPress Eventin - Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter vulnerability

WordPress Eventin - Event Calendar, Tickets, Registration, Booking & WooCommerce plugin = 4.1.23 - Authenticated Subscriber+ Privilege Escalation via mapmetacap Filter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Event Solution versions = 4.1.23...

WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Visitor Traffic Real Time Statistics Pro versions = 11.21...

WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sorawautsukushiii in WordPress Plugin WP Inventory Manager versions = 2.5.4...

WordPress Eventin plugin <= 4.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Event Solution versions = 4.1.23...

WordPress PublishPress Authors plugin <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin PublishPress Authors versions = 4.15.0...

WordPress ShopEngine Elementor WooCommerce Builder Addon plugin <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Romain Deperne ang3L in WordPress Plugin ShopEngine versions = 4.9.5...

WordPress Booking for Appointments and Events Calendar plugin < 2.4.10 - Amelia Manager+ WordPress Account Takeover vulnerability

Amelia Manager+ WordPress Account Takeover vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Amelia versions 2.4.10...

WordPress Export & Import WPBakery Page Builder plugin <= 1.0.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin Export & Import WPBakery Page Builder versions = 1.0.2...

WordPress Booking for Appointments and Events Calendar plugin 9.0-9.8.0 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Amelia versions 9.0-9.8.0...

WordPress Temporary Login Without Password plugin < 1.9.9 - Authenticated Temporary Access Revocation Bypass vulnerability

Authenticated Temporary Access Revocation Bypass vulnerability discovered by BaptouTatis in WordPress Plugin Temporary Login Without Password versions 1.9.9...

WordPress YayPricing plugin < 3.5.7 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin YayPricing versions 3.5.7...

WordPress User Registration & Membership plugin < 5.2.8 - Author+ Privilege Escalation to Administrator vulnerability

Author+ Privilege Escalation to Administrator vulnerability discovered by Baikuya in WordPress Plugin User Registration versions 5.2.8...

WordPress GenieWords plugin 1.5.27-1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite vulnerability

Unauthenticated Stored XSS and Configuration Overwrite vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, Iñigo Sánchez Enciso in WordPress Plugin GenieWords versions 1.5.27-1.5.34...

WordPress YouTube Embed plugin 10.0-10.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Adem0n in WordPress Plugin YouTube Embed - YouTube Gallery, Vimeo Gallery - Wordpress Plugin versions 10.0-10.3...

WordPress BE REST Endpoints plugin <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation vulnerability

Unauthenticated Stored XSS and Widget Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin BE REST Endpoints versions = 1.0.0...

WordPress Hoo Companion plugin 1.0.2 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Hoo Companion versions 1.0.2...

WordPress Rox Appointment Booking plugin < 1.2.0 - Unauthenticated Holiday Schedule Modification vulnerability

Unauthenticated Holiday Schedule Modification vulnerability discovered by Pedro Pinho in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.0...

WordPress Rox Appointment Booking plugin < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass vulnerability

Unauthenticated Price Manipulation and Payment Method Restriction Bypass vulnerability discovered by Morato Antoine in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.0...

WordPress Simple Membership plugin < 4.7.8 - Subscriber+ Membership Level Escalation vulnerability

Subscriber+ Membership Level Escalation vulnerability discovered by Charles Vosburgh in WordPress Plugin Simple Membership versions 4.7.8...

WordPress Mobile Events Manager plugin <= 1.4.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Mobile Events Manager versions = 1.4.8.3...

WordPress MDJM Event Management plugin < 1.7.8.5 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by Enrico Marcolini Dottor Marc, Claudio Marchesini Dottor Marc in WordPress Plugin Mobile DJ Manager versions 1.7.8.5...

WordPress Album Cover Finder plugin <= 0.7.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by João Ramos Maciel in WordPress Plugin Album Cover Finder versions = 0.7.0...

WordPress wpstorecart plugin <= 5.0.7 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by reconnaissance in WordPress Plugin WPStoreCart versions = 5.0.7...

WordPress SAMO Forms plugin <= 1.0.0 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by João Ramos Maciel in WordPress Plugin SAMO Forms versions = 1.0.0...

WordPress Frontegg SAML SSO plugin <= 1.0.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by moonge in WordPress Plugin Frontegg SAML SSO versions = 1.0.1...

WordPress Quads Ads Manager for Google AdSense plugin 3.0.4 - Subscriber+ Ad-Selling Payment Bypass vulnerability

Subscriber+ Ad-Selling Payment Bypass vulnerability discovered by JunHee CHO in WordPress Plugin Ads by WPQuads versions 3.0.4...

WordPress Zonify plugin < 1.0.5 - Unauthenticated Account Login Token Disclosure vulnerability

Unauthenticated Account Login Token Disclosure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Zonify Amazon Product Importer for WooCommerce versions 1.0.5...

WordPress CODE MONKEYS PROPOSALS plugin <= 1.0.1 - Subscriber+ Arbitrary File Deletion vulnerability

Subscriber+ Arbitrary File Deletion vulnerability discovered by João Ramos Maciel in WordPress Plugin Code Monkeys Proposals versions = 1.0.1...

WordPress Gpx2Graphics plugin <= 0.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Huynh Kien Minh in WordPress Plugin Gpx2Graphics versions = 0.3...

WordPress WebTotem Backups plugin <= 1.0.1 - Subscriber+ Arbitrary File Deletion vulnerability

Subscriber+ Arbitrary File Deletion vulnerability discovered by João Ramos Maciel in WordPress Plugin WebTotem Backups versions = 1.0.1...

WordPress DS Ad Rotator plugin <= 0.8 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Huynh Kien Minh in WordPress Plugin DS Ad Rotator versions = 0.8...

WordPress CryptoPayment Gateway plugin 1.2.1-1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update vulnerability

Unauthenticated Arbitrary File Deletion and Settings Update vulnerability discovered by Pedro Pinho in WordPress Plugin CryptoPayment Gateway versions 1.2.1-1.2.2...

WordPress Yogeta WP Cloud plugin <= 1.0 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by Huynh Kien Minh in WordPress Plugin Yogeta WP Cloud versions = 1.0...

WordPress User Registration & Membership plugin 4.4.6-5.2.7 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin User Registration versions 4.4.6-5.2.7...

WordPress WP images upload on piclect plugin <= 1.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by João Ramos Maciel in WordPress Plugin WP images upload on piclect versions = 1.0...

WordPress WP Component plugin <= 2.2.4 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin WP Component versions = 2.2.4...

WordPress Add User Autocomplete plugin < 1.2 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Nguyen Huu Do in WordPress Plugin Add User Autocomplete versions 1.2...

WordPress MemberPress Corporate Accounts plugin <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by andrea bocchetti in WordPress Plugin MemberPress Corporate Accounts versions = 1.5.39...

WordPress Bridge - Creative Multipurpose WordPress Theme theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

WordPress Bridge - Creative Multipurpose WordPress Theme theme = 30.8.9.1 - Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by João Pedro Soares de Alcântara in WordPress Theme Bridge Theme versions = 30.8.9.1...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification vulnerability

Subscriber+ Arbitrary Activity Privacy Modification vulnerability discovered by JunHee CHO in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions 4.7.12...

WordPress Bookit — Booking & Appointment Calendar plugin < 2.6.0.1 - Unauthenticated Appointment PII Disclosure vulnerability

Unauthenticated Appointment PII Disclosure vulnerability discovered by Philipp Doblhofer in WordPress Plugin BookIt versions 2.6.0.1...

WordPress User Registration & Membership plugin 5.0-5.2.7 - Unauthenticated User Data Disclosure vulnerability

Unauthenticated User Data Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin User Registration versions 5.0-5.2.7...

WordPress User Registration & Membership plugin < 5.2.8 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by Sai Praneeth Koti in WordPress Plugin User Registration versions 5.2.8...

WordPress Domain For Sale – Landing Page Per Domain, Domain Mapping, Offers & Listings plugin <= 3.5.1 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Labda in WordPress Plugin Domain For Sale versions = 3.5.1...

WordPress Product XML Feed Manager for WooCommerce plugin < 3.1.1 - Contributor+ Arbitrary Product Deletion vulnerability

Contributor+ Arbitrary Product Deletion vulnerability discovered by Abdullah Kareem cyberkareem in WordPress Plugin Product XML Feed Manager for WooCommerce versions 3.1.1...