WordPress Flamingo plugin <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search vulnerability

Authenticated Contributor+ Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search vulnerability discovered by jopet in WordPress Plugin Flamingo versions = 2.6.2...

WordPress SEO Flow by LupsOnline plugin 3.0.0-3.0.2 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin SEO Flow by LupsOnline versions 3.0.0-3.0.2...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825, Revanth Matte in WordPress Plugin LearnPress versions = 4.3.9.1...

WordPress Live Composer – Free WordPress Website Builder plugin <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Page Builder: Live Composer versions = 2.1.18...

WordPress Zephyr Project Manager plugin <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Zephyr Project Manager versions = 3.3.205...

WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Plugin Update vulnerability discovered by KoreaInfoSec in WordPress Plugin Bookly versions = 27.2...

WordPress Ninja Forms plugin 3.14.10-3.15.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Ninja Forms versions 3.14.10-3.15.1...

WordPress Redirection for Contact Form 7 plugin 2.2.7-3.2.10 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Redirection for Contact Form 7 versions 2.2.7-3.2.10...

WordPress JetFormBuilder plugin < 3.6.5.2 - Unauthenticated Email Header Injection vulnerability

Unauthenticated Email Header Injection vulnerability discovered by Emirhan Kurt in WordPress Plugin JetFormBuilder versions 3.6.5.2...

WordPress Bold Page Builder plugin < 5.9.9 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Luka Zimonjic in WordPress Plugin Bold Page Builder versions 5.9.9...

WordPress Real Estate Papi theme <= 1.0.5 - Subscriber+ Plugin Installation vulnerability

Subscriber+ Plugin Installation vulnerability discovered by Huynh Kien Minh in WordPress Theme Real Estate Papi versions = 1.0.5...

WordPress Jetpack plugin 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent vulnerability

WordPress Jetpack plugin 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent vulnerability discovered by Jetpack in WordPress Plugin Jetpack versions 16.1-16.1.2...

WordPress Jetpack plugin 12.0-16.1.2 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Jetpack in WordPress Plugin Jetpack versions 16.1-16.1.2...

WordPress Ninja Forms - Save Progress plugin <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook vulnerability

WordPress Ninja Forms - Save Progress plugin = 3.0.30 - Missing Authorization to Authenticated Subscriber+ Arbitrary Data Deletion via admin-ajax.php with admininit Hook vulnerability discovered by Hermione in WordPress Plugin Ninja Forms - Save Progress versions = 3.0.30...

WordPress LearnDash LMS plugin 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint vulnerability

WordPress LearnDash LMS plugin 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint vulnerability discovered by Applied Cybernetics in WordPress Plugin LearnDash LMS versions 4.25.0-5.1.6...

WordPress Gallery : FooGallery plugin <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute vulnerability discovered by UKO - Korea univ. in WordPress Plugin FooGallery versions = 3.3.2...

WordPress Pods plugin <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'notfound' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Pods versions = 3.3.9.1...

WordPress Custom Contact Forms plugin <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Deletion and Post Meta Modification via Nested 'fields.ID' / 'choices.ID' Parameters vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Custom Contact Forms versions = 7.16...

WordPress Video Player for YouTube plugin < 2.1.0 - Contributor+ SQLi vulnerability

Contributor+ SQLi vulnerability discovered by Artus KG in WordPress Plugin YT Player versions 2.1.0...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability

Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability discovered by RIA Labs in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

WordPress Joli Table Of Contents plugin < 3.0.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Joli Table Of Contents versions 3.0.3...

WordPress CatFolders Document Gallery & PDF Library plugin < 2.0.7 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin CatFolders Document Gallery & PDF Library versions 2.0.7...

WordPress VikWidgetsLoader plugin < 1.12.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin VikWidgetsLoader versions 1.12.0...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Administrator Email Disclosure vulnerability

Contributor+ Administrator Email Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

WordPress Eventin plugin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability

Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.22...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Google Reviews Modification vulnerability

Contributor+ Google Reviews Modification vulnerability discovered by Artus KG in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

WordPress Kirki plugin 6.0.0-6.2.5 - Authenticated Collaboration Comment Status Modification vulnerability

Authenticated Collaboration Comment Status Modification vulnerability discovered by Revanth Meesala in WordPress Plugin Kirki versions 6.0.0-6.2.5...

WordPress Eventin plugin < 4.1.21 - Contributor+ LFI vulnerability

Contributor+ LFI vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.21...

WordPress Kirki plugin 6.0.0-6.2.5 - Editor+ SQLi vulnerability

Editor+ SQLi vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Kirki versions 6.0.0-6.2.5...

WordPress The Events Calendar plugin < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability

Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.17.3.1...

WordPress King Addons for Elementor plugin < 51.1.77 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin King Addons for Elementor versions 51.1.77...

WordPress Bold Page Builder plugin < 5.9.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Md. Minaruzzaman Shovon in WordPress Plugin Bold Page Builder versions 5.9.8...

WordPress Greenshift plugin < 13.2.0 - Contributor+ SSRF vulnerability

Contributor+ SSRF vulnerability discovered by Alireza Kalhor in WordPress Plugin Greenshift versions 13.2.0...

WordPress Bold Page Builder plugin < 5.9.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Bold Page Builder versions 5.9.8...

WordPress Greenshift plugin < 13.2.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Greenshift versions 13.2.0...

WordPress My Private Site plugin < 4.2.3 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Shivamani Vastrala in WordPress Plugin My Private Site versions 4.2.3...

WordPress Accept Stripe Payments plugin < 2.1.4 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Usama Arshad in WordPress Plugin Stripe Payments versions 2.1.4...

WordPress Masteriyo LMS plugin 1.18.0-2.3.3 - Instructor+ Stored XSS vulnerability

Instructor+ Stored XSS vulnerability discovered by Mutantgun in WordPress Plugin Masteriyo - LMS versions 1.18.0-2.3.3...

WordPress Accept Stripe Payments plugin < 2.1.4 - Unauthenticated Product Substitution vulnerability

Unauthenticated Product Substitution vulnerability discovered by Nguyen Huu Do in WordPress Plugin Stripe Payments versions 2.1.4...

WordPress Smart Post plugin 4.0.0-4.0.7 - Unauthenticated Password-Protected Post Content and post_password Disclosure vulnerability

Unauthenticated Password-Protected Post Content and postpassword Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 4.0.0-4.0.7...

WordPress Smart Post plugin 4.0.0-4.0.7 - Contributor+ Private and Protected Post Content Disclosure vulnerability

Contributor+ Private and Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 4.0.0-4.0.7...

WordPress Search Atlas SEO plugin < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion vulnerability

Subscriber+ Google Service Account Credential Overwrite/Deletion vulnerability discovered by Shivamani Vastrala in WordPress Plugin Search Atlas SEO versions 2.6.24...

WordPress Joli Table Of Contents plugin 2.0.0-2.8.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Joli Table Of Contents versions 2.0.0-2.8.0...

WordPress JCH Optimize plugin 4.2.1-5.0.0 - Admin+ Path Traversal vulnerability

Admin+ Path Traversal vulnerability discovered by Krugov Artyom in WordPress Plugin JCH Optimize versions 4.2.1-5.0.0...

WordPress WP File Download plugin <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Read via Path Traversal in 'remoteurl' Parameter vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin WP File Download versions = 6.3.8...

WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation vulnerability

Missing Authorization to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by d.v4ns3c in WordPress Plugin Abandoned Cart Pro for WooCommerce versions = 10.7.1...

WordPress Gravity Forms plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability

Unauthenticated Stored Cross-Site Scripting via Post Body Field Value vulnerability discovered by daroo in WordPress Plugin Gravity Forms versions = 2.10.5...

WordPress W3 Total Cache plugin <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator vulnerability

Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator vulnerability discovered by theviper17y in WordPress Plugin W3 Total Cache versions = 2.10.5...

WordPress Ninja Forms plugin <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key vulnerability

Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Ninja Forms versions = 3.15.1...

WordPress Spam protection, Honeypot, Anti-Spam by CleanTalk plugin <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder vulnerability discovered by theviper17y in WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk versions = 6.86...