WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Sprout Clients versions = 3.2.3...

WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Averon Averenkov in WordPress Plugin Autopay dla WooCommerce versions = 2.2.27...

WordPress Download Monitor - WPForms Lock plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

WordPress Download Monitor - WPForms Lock plugin = 1.0.4 - Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Download Monitor - WPForms Lock versions = 1.0.4...

WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by HaiND in WordPress Plugin TrueBooker versions = 1.2.3...

WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dodoh4t in WordPress Plugin Bookly versions = 27.7...

WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by HieuPenguinnn in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...

WordPress Form Vibes – Database Manager for Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Form Vibes – Database Manager for Forms versions = 1.5.2...

WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Daniel Wade in WordPress Plugin Easy Appointments versions = 3.12.27...

WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Jakub Herman in WordPress Plugin WooCommerce Product Stock Alert versions = 3.0.6...

WordPress Bookly plugin <= 27.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ickogz in WordPress Plugin Bookly versions = 27.7...

WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...

WordPress Planyo online reservation system plugin <= 3.0 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by chaeyp, Ronnachai Sretawat Na Ayutaya Simonhaskelly, Ronnachai Chaipha rxnr in WordPress Plugin Planyo online reservation system versions = 3.0...

WordPress Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database plugin <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Chawabhon Netisingha JNX03 in WordPress Plugin Form Vibes – Database Manager for Forms versions = 1.5.2...

WordPress WP Hotel Booking plugin <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass vulnerability

Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass vulnerability discovered by valent1 in WordPress Plugin WP Hotel Booking versions = 2.3.1...

WordPress Code Engine – PHP Snippets, AI Functions & Automation for WordPress plugin <= 0.3.5 - Authenticated (Contributor+) Remote Code Execution vulnerability

Authenticated Contributor+ Remote Code Execution vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Code Engine versions = 0.3.5...

WordPress Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin <= 6.6.10 - Authenticated (Contributor+) Account Takeover vulnerability

Authenticated Contributor+ Account Takeover vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Essential Addons for Elementor versions = 6.6.10...

WordPress GEO Plugin by Squirrly SEO plugin <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting vulnerability

Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin SEO Plugin by Squirrly SEO versions = 14.0.0...

WordPress wpForo Forum plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by valent1 in WordPress Plugin wpForo Forum versions = 3.1.1...

WordPress Motors – Car Dealership & Classified Listings plugin plugin <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Motors versions = 1.4.112...

WordPress Majestic Support plugin <= 1.1.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin Majestic Support versions = 1.1.9...

WordPress Simple JWT Login – Allows you to use JWT on REST endpoints. plugin <= 3.6.6 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation vulnerability

Authenticated Subscriber+ Authentication Bypass to Privilege Escalation vulnerability discovered by Navapon Premkasem 71C4 71C4 in WordPress Plugin Simple JWT Login versions = 3.6.6...

WordPress SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover vulnerability

Unauthenticated Linked WordPress Account Takeover vulnerability discovered by Supakiad S. m3ez in WordPress Plugin SureCart versions = 4.2.3...

WordPress Instant Appointment plugin <= 1.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Random Robbie in WordPress Plugin Instant Appointment versions = 1.2...

WordPress WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution vulnerability

Missing Authorization to Authenticated Subscriber+ Remote Code Execution vulnerability discovered by daroo in WordPress Plugin WP Ultimate CSV Importer versions = 8.0.1...

NPM: systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

NPM: systeminformation: OS command injection in networkInterfaces via interfaces5 source-directive path on Linux vulnerability discovered by ? in WordPress Npm systeminformation versions = 5.31.6...

NPM: dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

NPM: dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS vulnerability discovered by ? in WordPress Npm dd-trace versions 5.100.0...

NPM: websocket-driver: Resource limit bypass via message compression

NPM: websocket-driver: Resource limit bypass via message compression vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...

NPM: websocket-driver: Message corruption via abuse of protocol length headers

NPM: websocket-driver: Message corruption via abuse of protocol length headers vulnerability discovered by ? in WordPress Npm websocket-driver versions 0.7.5...

NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

NPM: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/path — arbitrary host file read/write/delete vulnerability discovered by ? in WordPress Npm obsidian-local-rest-api versions 4.1.3...

WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by K. Sorrachat in WordPress Plugin WP ERP versions = 1.17.5...

NPM: n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode

NPM: n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode vulnerability discovered by ? in WordPress Npm n8n-mcp versions = 2.57.3...

NPM: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution

NPM: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution vulnerability discovered by ? in WordPress Npm tidgi versions = 0.13.0...

NPM: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

NPM: n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments vulnerability discovered by ? in WordPress Npm n8n-mcp versions = 2.56.0...

WordPress Genolve – Genolve AI Business Graphics, AI Images plugin <= 5.0.5 - Authenticated (Contributor+) Incorrect Authorization to Privilege Escalation vulnerability

Authenticated Contributor+ Incorrect Authorization to Privilege Escalation vulnerability discovered by Kazuma Matsumoto in WordPress Plugin Genolve versions = 5.0.5...

WordPress bbp style pack plugin <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Catalin Oancea 0x4D5A in WordPress Plugin bbp style pack versions = 6.4.5...

WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Valatty in WordPress Plugin CorvusPay WooCommerce Payment Gateway versions = 2.7.4...

WordPress W3 Total Cache plugin <= 2.9.4 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by snr in WordPress Plugin W3 Total Cache versions = 2.9.4...

WordPress WP CTA – Call Now Button, Sticky Button & Call to Action Builder plugin <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection vulnerability

Unauthenticated Time-Based Blind SQL Injection vulnerability discovered by daroo in WordPress Plugin WordPress CTA versions = 2.2.2...

WordPress Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin <= 2.8.4 - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation vulnerability

WordPress Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin = 2.8.4 - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit = 2.8.4 - Unauthenticated Privilege Escalation vulnerability discovered by lb in WordPress Plugin Aimogen Pro versions =...

WordPress Ultimate WooCommerce Auction Pro plugin <= 2.4.5 - Reflected XSS via uwa_manage_auctions vulnerability

Reflected XSS via uwamanageauctions vulnerability discovered by Kacper Rybczyński in WordPress Plugin Ultimate Auction Pro versions = 2.4.5...

WordPress Ultimate WooCommerce Auction Pro plugin <= 2.4.5 - Reflected XSS via uwa_auctions_bids_list vulnerability

Reflected XSS via uwaauctionsbidslist vulnerability discovered by Kacper Rybczyński in WordPress Plugin Ultimate Auction Pro versions = 2.4.5...

WordPress ICS Calendar plugin <= 12.0.9 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Khanh Nguyen - BlueRock in WordPress Plugin ICS Calendar versions = 12.0.9...

WordPress Booking Package plugin <= 1.7.20 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by PRISM in WordPress Plugin Booking Package versions = 1.7.20...

WordPress WP Customer Area plugin <= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin WP Customer Area versions = 8.3.5...

WordPress FoodBook Lite – Online Food Ordering System plugin <= 1.5.6 - Missing Authorization to Unauthenticated User Registration vulnerability

Missing Authorization to Unauthenticated User Registration vulnerability discovered by Eason in WordPress Plugin FoodBook Lite – Online Food Ordering System versions = 1.5.6...

WordPress News Kit Addons For Elementor plugin <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Romain Deperne ang3L in WordPress Plugin News Kit Elementor Addons versions = 1.4.6...

WordPress Avada (Fusion) Builder plugin <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Zbigniew Piotrak in WordPress Plugin Fusion Builder versions = 3.15.5...

WordPress Smart Slider 3 plugin <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Yuvraj Tomar in WordPress Plugin Smart Slider 3 versions = 3.5.1.37...

WordPress Academy LMS plugin <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference vulnerability discovered by sorawautsukushiii in WordPress Plugin Academy LMS versions = 3.8.0...

WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ووسلام همگام سازی ووکامرس و باسلام versions = 1.9.1...