WordPress GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin GamiPress versions = 7.9.9.1...

WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin ShopLentor versions = 3.4.5...

WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.4.5 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin ShopLentor versions = 3.4.5...

WordPress PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive PDF Disclosure vulnerability discovered by sl4x0 in WordPress Plugin PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer versions = 1.1.0...

WordPress Demi – One Click Demo Import, Backup & Site Migration plugin <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy vulnerability

Unauthenticated Information Exposure to Arbitrary Directory Copy vulnerability discovered by SAHRAOUI AYMEN in WordPress Plugin Demi One Click Demo Import, Backup & Site Migration versions = 0.0.8...

WordPress WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin <= 4.3.7 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.7...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion vulnerability

Authenticated Administrator+ Arbitrary File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin BP Better Messages versions = 2.15.19...

WordPress Advanced Form Integration plugin <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary MailUp OAuth Token Overwrite vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Form Integration versions = 2.6.0...

WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by luc in WordPress Plugin Simple Link Directory Pro versions = 15.0.6...

WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tarcísio LuchesiPoystick in WordPress Plugin miniorange otp verification versions = 5.5.1...

WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Anti Spam and list cleaner AcyChecker versions = 1.8.1...

WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jayant Kamble in WordPress Plugin Contest Gallery versions = 30.0.6...

WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kali Forms versions = 2.4.18...

WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ad Invalid Click Protector AICP versions = 1.3.0...

WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin BackWPup versions = 5.7.4...

WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by luc in WordPress Plugin FormCraft versions = 3.9.15...

WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin GiveWP versions = 4.16.3...

WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin GetGenie versions = 4.4.3...

WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Addons for Contact Form 7 versions =3.5.45...

WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Message Filter for Contact Form 7 versions = 1.6.3.9...

WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mitchell in WordPress Plugin Xendit Payment versions = 7.1.0...

WordPress Blogfolio theme <= 3.0.5 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Blogfolio versions = 3.0.5...

WordPress Exclusive Addons Elementor plugin <= 2.8.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Exclusive Addons Elementor versions = 2.8.0...

WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk versions = 6.82...

WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO in WordPress Theme Gillion versions = 4.13...

WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy Digital Downloads versions = 3.6.9...

WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Insert Headers and Footers Code – HT Script versions = 1.1.8...

WordPress Checkout Field Editor for WooCommerce &#8211; Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Checkout Field Editor for WooCommerce Checkout Manager versions = 3.0.5...

WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Sharief in WordPress Plugin Gallery PhotoBlocks versions = 1.3.3...

WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by K. Sorrachat in WordPress Plugin YayPricing versions = 3.5.6...

WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by TurboNexic in WordPress Plugin Open User Map versions = 1.4.46...

WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Feedzy versions = 5.2.4...

WordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Location Weather versions = 3.0.6...

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions = 3.33...

WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Google Review Slider versions = 18.4...

WordPress WP Google Review Slider plugin <= 18.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Google Review Slider versions = 18.4...

WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kirki versions = 6.0.13...

WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Thrive Leads Version versions = 10.9.2...

WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin ЮKassa для WooCommerce versions = 2.16.1...

WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by luc in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions = 1.5.1...

WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Septio Noerdiansyah in WordPress Plugin FundEngine versions = 1.7.8...

WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Booking Calendar versions = 11.4.2...

WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by anhcd05 in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions = 1.5.1...

WordPress Calendar plugin < 1.3.18 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Marcus Cornes in WordPress Plugin Calendar versions 1.3.18...

WordPress Contact Form 7 plugin < 2.5 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Pedro Antunes in WordPress Plugin Contact Form 7 – PayPal & Stripe Add-on versions 2.5...

WordPress Smart Manager plugin < 8.92.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by TruongLV1 From FPT Nightwolf in WordPress Plugin Smart Manager versions 8.92.0...

WordPress Download Manager plugin < 3.3.62 - Unauthorized Protected File Download vulnerability

Unauthorized Protected File Download vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin Download Manager versions 3.3.62...

WordPress WPBot plugin < 8.5.2 - Admin+ Second-Order SQL Injection vulnerability

Admin+ Second-Order SQL Injection vulnerability discovered by Mustafa Ahmed in WordPress Plugin ChatBot versions 8.5.2...

WordPress The Events Calendar plugin < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation vulnerability

Unauthenticated Event Aggregator Import Status Manipulation vulnerability discovered by Haitam Lazaar in WordPress Plugin The Events Calendar versions 6.16.5.1...

WordPress Advanced Ads plugin < 2.0.23 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pablo González and Francisco José Ramírez in WordPress Plugin Advanced Ads versions 2.0.23...