49988 matches found
WordPress Invoice123 plugin <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Setting Modification vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Invoice123 versions = 1.7.0...
WordPress Import and export users and customers plugin <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability
Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Tiago Ventura perses in WordPress Plugin Import and export users and customers versions = 2.4.0...
WordPress Hostel plugin <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Hostel versions = 1.1.7...
WordPress Highlighting Code Block plugin <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability
Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Chinnapak Charoensiri in WordPress Plugin Highlighting Code Block versions = 2.2.0...
WordPress Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin <= 1.26.12 - Authenticated (Admin+) Local File Inclusion vulnerability
Authenticated Admin+ Local File Inclusion vulnerability discovered by Rahul Sreenivasan Tr0j4n in WordPress Plugin Happyforms versions = 1.26.12...
WordPress GW AI Website Builder plugin <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Settings Deletion vulnerability discovered by Legion Hunter in WordPress Plugin GW AI Website Builder versions = 1.0.1...
WordPress GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset vulnerability
Cross-Site Request Forgery to Google Meet Credential Reset vulnerability discovered by Legion Hunter in WordPress Plugin GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference versions = 1.1.8...
WordPress Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by PRISM in WordPress Plugin WP Event SOlution versions = 4.1.15...
WordPress FlowForms – Conversational Form Builder plugin <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification vulnerability
Authenticated Contributor+ Insecure Direct Object Reference to Arbitrary Form Modification vulnerability discovered by Aliyan Khan in WordPress Plugin FlowForms – Conversational Form Builder versions = 1.1.1...
WordPress Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin 4.0.25-4.1.15 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass vulnerability
Event Calendar, Event Registration, Tickets & Booking AI Powered plugin 4.0.25-4.1.15 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass vulnerability discovered by Niv Kochan in WordPress Plugin WP Event SOlution versions 4.0.25-4.1.15...
WordPress Easy Upload Files During Checkout plugin <= 3.0.1 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability
Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin Easy Upload Files During Checkout versions = 3.0.1...
WordPress Easy Appointments plugin <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation vulnerability
Missing Authorization to Authenticated Author+ Bulk Appointment Manipulation vulnerability discovered by armx64 in WordPress Plugin Easy Appointments versions = 3.12.27...
WordPress Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin <= 4.3.6 - Authenticated (Administrator+) SQL Injection vulnerability
Authenticated Administrator+ SQL Injection vulnerability discovered by PRISM in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.6...
WordPress Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin <= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Scan Schedule Modification vulnerability discovered by PRISM in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.6...
WordPress BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin <= 4.6.0 - Authenticated (Custom+) SQL Injection vulnerability
Authenticated Custom+ SQL Injection vulnerability discovered by PRISM in WordPress Plugin BetterDocs versions = 4.6.0...
WordPress Salon Booking System – Free Version plugin <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution vulnerability
Cross-Site Request Forgery to Remote Code Execution vulnerability discovered by Afifudin Maarif in WordPress Plugin Salon booking system versions = 10.30.32...
WordPress Post Export Import with Media plugin <= 1.13.1 - Authenticated (Administrator+) Arbitrary File Upload vulnerability
Authenticated Administrator+ Arbitrary File Upload vulnerability discovered by ? in WordPress Plugin Post Export Import with Media versions = 1.13.1...
WordPress Simply Schedule Appointments plugin <= 1.6.12.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hio in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.4...
WordPress WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Modification vulnerability discovered by Sushi Com Abacate in WordPress Plugin WPCafe versions = 3.0.14...
WordPress 777 theme <= 1.13.0 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Bonds in WordPress Theme 777 versions = 1.13.0...
WordPress WoowBot Pro Max plugin <= 14.1.7 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Plugin WoowBot Pro Max versions = 14.1.7...
WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerability
WordPress OAuth Single Sign On - SSO OAuth Client plugin = 38.5.8 - Broken Authentication vulnerability discovered by Kim Dvash in WordPress Plugin OAuth Single Sign On - SSO OAuth Client versions = 38.5.8...
WordPress Membership For WooCommerce plugin <= 3.1.0 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by sebbealb in WordPress Plugin Membership For WooCommerce versions = 3.1.0...
WordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Averon Averenkov in WordPress Plugin APIExperts Square for WooCommerce versions = 4.7.4...
WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability
SQL Injection vulnerability discovered by VanTastic in WordPress Plugin AIWU versions = 1.5.4...
WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation vulnerability
Incorrect Authorization to Authenticated Subscriber+ Arbitrary Subscription Cancellation vulnerability discovered by Fernando Mecozzi in WordPress Plugin FluentForm versions = 6.2.1...
WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by ParkHyunWoo in WordPress Plugin Realtyna Organic IDX plugin versions = 5.2.0...
WordPress Aimogen Pro plugin <= 2.8.3 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Aimogen Pro versions = 2.8.3...
WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Grand Photography versions = 5.7.8...
WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability
SQL Injection vulnerability discovered by VDsec in WordPress Plugin Buddyboss Platform versions = 3.0.5...
WordPress MailOptin plugin <= 1.2.77.3 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by qdtad in WordPress Plugin MailOptin versions = 1.2.77.3...
WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by dutafi in WordPress Plugin Directorist versions = 8.8.2...
WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by anhcd05 in WordPress Plugin Simply Schedule Appointments versions = 1.6.11.11...
WordPress Fluent CRM plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Fluent CRM versions = 3.1.7...
WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Anti-Malware Security and Brute-Force Firewall versions = 4.23.89...
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.12 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Taylsec in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.12...
WordPress Eventer plugin <= 4.4.2 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Eventer versions = 4.4.2...
WordPress Eventer plugin <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation vulnerability
Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Eventer versions = 4.4.2...
WordPress Simple Coherent Form plugin <= 2.4.13 - Unauthenticated Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin Simple Coherent Form versions = 2.4.13...
WordPress Jssor Slider by jssor.com plugin <= 3.1.24 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Jssor Slider by jssor.com versions = 3.1.24...
WordPress Backstage – Customizer Demo Access plugin <= 1.4.2 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Backstage versions = 1.4.2...
WordPress 多说社会化评论框 plugin <= 1.2 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Spy0x7 in WordPress Plugin 多说社会化评论框 versions = 1.2...
WordPress Widget Logic Visual plugin <= 1.52 - Authenticated (Subscriber+) Remote Code Execution vulnerability
Authenticated Subscriber+ Remote Code Execution vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin Widget Logic Visual versions = 1.52...
NPM: Waku has an Open Redirect via `unstable_redirect` Helper
NPM: Waku has an Open Redirect via unstableredirect Helper vulnerability discovered by ? in WordPress Npm waku versions = 1.0.0-beta.0...
NPM: Waku: Cross-Origin CSRF on RSC Server Action Dispatch
NPM: Waku: Cross-Origin CSRF on RSC Server Action Dispatch vulnerability discovered by ? in WordPress Npm waku versions = 1.0.0-beta.0...
WordPress Ad Inserter plugin <= 2.8.11 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Ad Inserter versions = 2.8.11...
WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.55.0.1...
WordPress Event Tickets plugin <= 5.28.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by dunvu0 in WordPress Plugin Event Tickets versions = 5.28.5...
WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Houzez Login Register versions = 3.3.3...