WordPress Debloat – Remove Unused CSS, Optimize JS plugin <= 1.3.0 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Kuba in WordPress Plugin Debloat – Remove Unused CSS, Optimize JS versions = 1.3.0...

WordPress FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin FluentCart versions = 1.7.0...

WordPress Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin <= 1.19 - Sensitive Information Exposure vulnerability

Sensitive Information Exposure vulnerability discovered by wesley wcraft in WordPress Plugin Lightweight Cookie Notice Cookie Banner for Cookie Consent versions = 1.19...

WordPress MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter vulnerability

Unauthenticated Privilege Escalation to 'formcustomfieldmappings' Parameter vulnerability discovered by Kuba in WordPress Plugin MailOptin versions = 1.2.78.6...

WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin PAYCOMET for WooCommerce versions = 5.45...

WordPress Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin 6.4.1-6.4.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by YCInfosec in WordPress Plugin Popup box versions 6.4.1-6.4.2...

WordPress Complianz GDPR/CCPA Cookie Consent Banner plugin <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Complianz versions = 7.5.5...

WordPress Mang Board plugin <= 2.4.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin Mang Board WP versions = 2.4.4...

WordPress Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Santh in WordPress Plugin Flying Scripts: Delay JavaScript to Improve Site Speed & Performance versions = 1.2.4...

WordPress NotificationX plugin <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route vulnerability

Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route vulnerability discovered by jiahao in WordPress Plugin NotificationX versions = 3.3.3...

WordPress Opti-Behavior plugin <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting via 'countryname' Location Parameter vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights versions = 1.9.2.1...

WordPress Quick PayPal Payments: Payment Button & Form plugin <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Quick Paypal Payments versions = 6.0.4...

WordPress NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability

Missing Authorization to Unauthenticated Arbitrary Content Injection vulnerability discovered by Eunho Kim in WordPress Plugin NotificationX versions = 3.3.3...

WordPress Bulk Page Generator – LPagery plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Page Creation/Modification/Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Bulk Landing Page Creator for WordPress LPagery versions = 3.1.0...

WordPress Mail Mint – Email Marketing, Automation & WooCommerce Emails with AI Assistance plugin <= 1.31.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.4...

WordPress Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML vulnerability

Authenticated Subscriber+ Sensitive Information Exposure in Admin Page HTML vulnerability discovered by crow in WordPress Plugin Image Hub Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy versions = 1.2.0...

WordPress FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin <= 1.7.0 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin FluentCart versions = 1.7.0...

WordPress Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover vulnerability

Insecure Direct Object Reference to Authenticated Custom+ Limited Account Takeover vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Dokan versions = 5.2.1...

WordPress Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Suphakit Phrmduang TORTY in WordPress Plugin WP Dark Mode versions = 5.3.17...

WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by neurotx in WordPress Plugin Gantry 5 Framework versions = 5.6.4...

WordPress Tutor LMS plugin < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite vulnerability

Unauthenticated Tutor Page Force-Publish and Content Overwrite vulnerability discovered by Kevin Chen in WordPress Plugin Tutor LMS versions 4.1.1...

WordPress Cardinity Payment Gateway for WooCommerce plugin 3.2.6-3.4.1 - Unauthenticated Arbitrary Order Payment Forgery vulnerability

Unauthenticated Arbitrary Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Cardinity Payment Gateway for WooCommerce versions 3.2.6-3.4.1...

WordPress User Rights Access Manager plugin <= 1.1.3 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin User Rights Access Manager versions = 1.1.3...

WordPress Rede Itaú for WooCommerce plugin 3.7.1-5.5.2 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Rede Itaú for WooCommerce versions 3.7.1-5.5.2...

WordPress Rede Itaú for WooCommerce plugin < 5.5.3 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by JunHee CHO in WordPress Plugin Rede Itaú for WooCommerce versions 5.5.3...

WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pablo González Pérez in WordPress Plugin Fancy Comments WordPress versions = 1.2.21...

WordPress WholesaleX – All-in-One B2B Solution with Wholesale Pricing plugin <= 3.0.8 - Unauthenticated Limited Privilege Escalation vulnerability

Unauthenticated Limited Privilege Escalation vulnerability discovered by Ronnachai Chaipha rxnr in WordPress Plugin WholesaleX versions = 3.0.8...

WordPress Easy HTTPS Redirection (SSL) plugin < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite vulnerability

Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Easy HTTPS Redirection SSL versions 2.0.2...

WordPress eaSYNC Booking plugin < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update vulnerability

Unauthenticated Cancellation Request Creation and Email Template Update vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin eaSYNC versions 1.3.31...

WordPress Spin Wheel plugin < 2.2.1 - Unauthenticated Coupon Code Disclosure vulnerability

Unauthenticated Coupon Code Disclosure vulnerability discovered by Aditya Gurav in WordPress Plugin Spin Wheel versions 2.2.1...

WordPress Cooked – Recipe Management plugin <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cooked versions = 1.16.1...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure vulnerability

Authenticated Contributor+ Insecure Direct Object Reference to Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin Blog2Social versions = 9.1.4...

WordPress Elementor Website Builder – more than just a page builder plugin <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Or Benit in WordPress Plugin Elementor Website Builder versions = 4.2.3...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.34.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions = 2.34.10...

WordPress Tracking Code Manager plugin <= 2.6.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Suredsi Ulpada cyberdesu in WordPress Plugin Tracking Code Manager versions = 2.6.0...

WordPress Ocean Extra plugin <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by hashiramasenju333 in WordPress Plugin Ocean Extra versions = 2.6.0...

WordPress Mang Board plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by John Ryan Albon in WordPress Plugin Mang Board WP versions = 2.4.0...

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by thevietronin in WordPress Plugin Groundhogg versions = 4.5.14...

WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin <= 1.8.42 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Photo Gallery by 10Web versions = 1.8.42...

WordPress VK Blocks plugin <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin VK Blocks versions = 1.126.1...

WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Post and Page Builder by BoldGrid versions = 1.27.13...

WordPress Import and export users and customers plugin <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Luca Laytynher LyT in WordPress Plugin Import and export users and customers versions = 2.4.5...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin Kirki versions = 6.2.0...

WordPress PhastPress plugin <= 3.10 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Itthidej Aramsri Boeing777 in WordPress Plugin PhastPress versions = 3.10...

WordPress Asaas Gateway for WooCommerce plugin < 2.7.8 - Unauthenticated Order Payment Bypass vulnerability

Unauthenticated Order Payment Bypass vulnerability discovered by Guillermo Álvarez Fernández in WordPress Plugin Asaas Gateway for WooCommerce versions 2.7.8...

WordPress Trust Payments Gateway for WooCommerce plugin < 3.1.0 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by ryan fabella in WordPress Plugin Trust Payments Gateway for WooCommerce versions 3.1.0...

WordPress Forms plugin < 3.0.2 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Forms versions 3.0.2...

WordPress affiliate-toolkit plugin < 3.9.1 - Contributor+ RCE vulnerability

Contributor+ RCE vulnerability discovered by Artus KG in WordPress Plugin affiliate-toolkit versions 3.9.1...

WordPress WP Encryption plugin < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement vulnerability

Unauthenticated Certificate Private Key and ACME Order Replacement vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content versions 7.8.8.2...

WordPress WP Booking System plugin < 2.1.0.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Eric Buntain in WordPress Plugin WP Booking System versions 2.1.0.1...