WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.55.0.2...

WordPress Events Manager plugin <= 7.3.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by dutafi in WordPress Plugin Events Manager versions = 7.3.6...

WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jamaal ahmed in WordPress Plugin Simple Business Directory Pro versions = 15.9.4...

WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin Amelia versions = 2.4.2...

WordPress Abandoned Cart Recovery for WooCommerce plugin <= 1.1.12 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by she11f in WordPress Plugin Abandoned Cart Recovery for WooCommerce versions = 1.1.12...

WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin ProfileGrid versions = 5.9.9.6...

WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dunvu0 in WordPress Plugin Razorpay Payment Links for WooCommerce versions = 2.1.4...

WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Message Filter for Contact Form 7 versions = 1.6.3.8...

WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Bopo – WooCommerce Product Bundle Builder versions = 1.2.0...

WordPress CRM Perks Forms plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Baikuya in WordPress Plugin CRM Perks Forms versions = 1.1.7...

WordPress Author Box WP Lens plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin Author Box WP Lens versions = 2.1.5...

WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mitchell in WordPress Plugin Stock Locations for WooCommerce versions = 3.1.8...

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by she11f in WordPress Plugin Client Invoicing by Sprout Invoices versions = 20.8.13...

WordPress Cart Lift plugin <= 3.1.57 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin Cart Lift versions = 3.1.57...

WordPress SiteGround Email Marketing plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by xwii in WordPress Plugin SiteGround Email Marketing versions = 1.7.5...

WordPress Gift Vouchers plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by xwii in WordPress Plugin Gift Vouchers versions = 4.7.0...

WordPress ChatBot for eCommerce – WoowBot plugin <= 4.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin ChatBot for eCommerce WoowBot versions = 4.6.1...

WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by ParkHyunWoo in WordPress Plugin Instant Image Generator versions = 2.1.4...

WordPress Gift Vouchers plugin <= 4.6.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dodoh4t in WordPress Plugin Gift Vouchers versions = 4.6.9...

WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin CF7 Views Complete Entry Management for Contact Form 7 versions = 3.2.2...

WordPress MailerPress plugin <= 2.0.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by anhcd05 in WordPress Plugin MailerPress versions = 2.0.2...

WordPress Active Products Tables for WooCommerce plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Active Products Tables for WooCommerce versions = 1.1.0...

WordPress Peach Payments Gateway plugin <= 4.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HieuPenguinnn in WordPress Plugin Peach Payments Gateway versions = 4.0.2...

WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by dodoh4t in WordPress Plugin PDF Generator for WordPress versions = 1.6.2...

WordPress FundEngine plugin <= 1.7.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peng Zhou in WordPress Plugin FundEngine versions = 1.7.6...

WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HaiND in WordPress Theme Open Shop versions = 1.7.1...

WordPress Booking and Rental Manager plugin <= 2.6.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by hhhai in WordPress Plugin Booking and Rental Manager versions = 2.6.9...

WordPress GD Security Headers plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin GD Security Headers versions = 1.8...

WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.51 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Flexible Refund and Return Order for WooCommerce versions = 1.0.51...

WordPress SureDash plugin <= 1.8.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by hhhai in WordPress Plugin SureDash versions = 1.8.0...

WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by okndjo in WordPress Plugin Event Tickets Manager for WooCommerce versions = 1.5.5...

WordPress Proxy & VPN Blocker plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peng Zhou in WordPress Plugin Proxy & VPN Blocker versions = 3.5.8...

WordPress Real Estate Manager Pro plugin <= 12.8.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Real Estate Manager Pro versions = 12.8.3...

WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Theme Coaching versions = 3.9.2...

WordPress Free Gifts for WooCommerce plugin <= 13.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Free Gifts for WooCommerce versions = 13.1.0...

WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Sandesh Gawai in WordPress Plugin Tourfic versions = 2.22.5...

WordPress Newsletters plugin <= 4.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Newsletters versions = 4.14...

WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WooCommerce PDF Invoice Builder versions = 2.0.8...

WordPress Loops & Logic plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin Loops & Logic versions = 4.2.3...

WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ramshath in WordPress Plugin Tourfic versions = 2.22.5...

WordPress Extra Product Options Builder for WooCommerce plugin <= 1.2.167 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by VanTastic in WordPress Plugin Extra Product Options Builder for WooCommerce versions = 1.2.167...

WordPress Groundhogg plugin <= 4.4.1 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by she11f in WordPress Plugin Groundhogg versions = 4.4.1...

WordPress Hydra Booking plugin <= 1.1.44 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin Hydra Booking versions = 1.1.44...

WordPress picu plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by xwii in WordPress Plugin picu versions = 3.5.1...

WordPress WishList Member X plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Austin Ginder in WordPress Plugin WishList Member X versions = 3.32.0...

WordPress Recurio – Ultimate Subscription for WooCommerce plugin <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection vulnerability

Authenticated Shop Manager+ SQL Injection vulnerability discovered by PRISM in WordPress Plugin Recurio – Ultimate Subscription for WooCommerce versions = 1.1.3...

NPM: Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

NPM: Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows vulnerability discovered by ? in WordPress Npm better-auth versions = 0.3.4, 1.6.11...

NPM: @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive

NPM: @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.11...

NPM: Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

NPM: Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption vulnerability discovered by ? in WordPress Npm better-auth versions = 1.4.8-beta.7, 1.6.0...

NPM: Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default

NPM: Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default vulnerability discovered by ? in WordPress Npm better-auth versions 1.6.11...