NPM: LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

NPM: LiquidJS: Uncontrolled Resource Consumption in join filter allows template authors to bypass memoryLimit and crash the process vulnerability discovered by ? in WordPress Npm liquidjs versions = 10.27.1...

NPM: node-csv: Prototype replacement still reachable via columns path

NPM: node-csv: Prototype replacement still reachable via columns path vulnerability discovered by ? in WordPress Npm csv-parse versions 7.0.2...

WordPress ilGhera Reviso Exporter for WooCommerce plugin <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function vulnerability

Missing Authorization to Authenticated Subscriber+ Agreement Grant Token Deletion via disconnectcallback Function vulnerability discovered by Legion Hunter in WordPress Plugin ilGhera Reviso Exporter for WooCommerce versions = 1.2.3...

WordPress WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation vulnerability

Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WPFunnels versions = 3.12.13...

WordPress Awesome Support – WordPress HelpDesk & Support Plugin plugin <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary User Denial vulnerability discovered by Wordfence PRISM in WordPress Plugin Awesome Support versions = 6.3.9...

WordPress WP Recipe Maker plugin <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Recipe Ownership Takeover and Unpublishing vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Recipe Maker versions = 10.8.0...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management vulnerability

Missing Authorization to Authenticated Subscriber+ Notification Flow Management vulnerability discovered by Sushi Com Abacate in WordPress Plugin WP Event SOlution versions = 4.1.17...

WordPress WP Crowdfunding plugin <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Crowdfunding versions = 2.2.1...

WordPress Podlove Podcast Publisher plugin <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Podlove Podcast Publisher versions = 4.5.5...

WordPress Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin <= 1.31.0 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Mail Mint versions = 1.31.0...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress My Calendar – Accessible Event Manager plugin <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin My Calendar versions = 3.8.3...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion vulnerability

Authenticated Custom+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event SOlution versions = 4.1.22...

WordPress Salon booking system plugin <= 10.31.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tiago Ventura @perses in WordPress Plugin Salon booking system versions = 10.31.5...

WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability

Content Injection vulnerability discovered by kta1kri in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...

WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Captcha Bypass vulnerability

Captcha Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple Cloudflare Turnstile versions = 1.42.1...

WordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability

Settings Change vulnerability discovered by Johan Buenavida in WordPress Plugin WP-Stateless versions = 4.4.1...

WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin WPAdverts versions = 2.3.3...

WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tony Harris in WordPress Plugin Thank You Page Customizer for WooCommerce versions = 1.2.2...

WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by CidKagenouSama in WordPress Plugin WP Travel versions = 12.0.3...

WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Page Visits Counter Lite versions = 1.2.3...

WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by babyhack@OPCIA in WordPress Plugin Return Refund and Exchange For WooCommerce versions = 4.6.4...

WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by dodoh4t in WordPress Plugin Youzify versions = 1.3.7...

WordPress MailMunch – Grow your Email List plugin <= 3.2.5 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin MailMunch – Grow your Email List versions = 3.2.5...

WordPress Wise Chat plugin <= 3.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peng Zhou in WordPress Plugin Wise Chat versions = 3.4...

WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by HaiND in WordPress Plugin IMPress for IDX Broker versions = 3.3.0...

WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HaiND in WordPress Plugin IMPress for IDX Broker versions = 3.3.0...

WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin EventON versions = 2.5.7...

WordPress EDD Product Catalog Feed by PixelYourSite plugin <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion vulnerability

Authenticated Subscriber+ Arbitrary Options Deletion vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin EDD Product Catalog Feed by PixelYourSite versions = 1.0.2...

WordPress JetFormBuilder plugin < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin JetFormBuilder versions 3.6.5.2...

WordPress B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More plugin < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass vulnerability

Unauthenticated B2B Group Assignment and Approval Bypass vulnerability discovered by Farid Narimanov in WordPress Plugin B2BKing versions 5.2.40...

WordPress Kirki plugin 6.2.1-6.2.5 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Kirki versions 6.2.1-6.2.5...

WordPress SureCart plugin < 4.7.0 - Unauthenticated Account Creation with Automatic Login vulnerability

Unauthenticated Account Creation with Automatic Login vulnerability discovered by Jakub Herman in WordPress Plugin SureCart versions 4.7.0...

WordPress Email Subscribers & Newsletters plugin <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field vulnerability

Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field vulnerability discovered by Sander Horsman - Conda Security in WordPress Plugin Email Subscribers & Newsletters versions = 5.9.27...

WordPress User Profile Builder plugin <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field vulnerability

Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field vulnerability discovered by daroo in WordPress Plugin Profile Builder versions = 3.15.7...

WordPress Jetpack plugin 14.5-16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters

Reflected to Stored Cross-Site Scripting via Reader Repost Parameters vulnerability discovered by Jetpack in WordPress Plugin Jetpack versions 16.1-16.1.2...

WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kishan Vyas in WordPress Plugin Beaver Builder versions = 2.10.3.1...

WordPress WPML Multilingual CMS plugin <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection vulnerability

Incorrect Authorization to Authenticated Subscriber+ SQL Injection vulnerability discovered by h0xilo in WordPress Plugin Multilingual CMS versions = 4.9.5...

WordPress Event Tickets and Registration plugin <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update vulnerability

Missing Authorization to Unauthenticated Stripe Credentials Update vulnerability discovered by h0xilo in WordPress Plugin Event Tickets versions = 5.27.4...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability

Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event SOlution versions = 4.1.22...

WordPress Graphina – Charts and Graphs For Elementor plugin <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin Graphina versions = 3.1.11...

WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin <= 6.1.4 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Peng Zhou in WordPress Plugin Product Catalog Enquiry for WooCommerce by MultiVendorX versions = 6.1.4...

WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by benzdeus in WordPress Plugin WpEvently versions = 5.6.0...

WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peng Zhou in WordPress Plugin Csomagpontok és szállítási címkék WooCommerce-hez versions 4.2.8...

WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by care in WordPress Plugin Open User Map versions = 1.4.50...

WordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HieuPenguinnn in WordPress Plugin Unbounce Landing Pages versions = 1.1.4...

WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Anthony Green of Greenhat Security in WordPress Plugin JetFormBuilder versions = 3.6.5.1...

WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0xzenko in WordPress Plugin Easy Appointments versions = 4.0.2.1...

WordPress Folders plugin <= 3.1.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin Folders versions = 3.1.9...