WordPress WPForms Lite plugin 1.10.0.1-2.0.2.1 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Abdulrhman Mari d7mr4ny in WordPress Plugin Contact Form by WPForms versions 1.10.0.1-2.0.2.1...

WordPress Classified Listing plugin < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification vulnerability

Subscriber+ Unattached Media Deletion and Modification vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Classified Listing versions 6.1.1...

WordPress Rank Math SEO plugin < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion vulnerability

Unauthenticated SEO Analyzer Results Deletion vulnerability discovered by Duy Tran in WordPress Plugin Rank Math SEO versions 1.0.280...

WordPress WPCode plugin < 2.4.0 - Unauthenticated Snippet Suppression vulnerability

Unauthenticated Snippet Suppression vulnerability discovered by Kenny of Greenhat Security in WordPress Plugin WPCode versions 2.4.0...

WordPress Fast Courier plugin 5.0.0-5.2.3 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Fast Courier versions 5.0.0-5.2.3...

WordPress Ultimate Multisite plugin < 2.17.2 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by hanzzly Farhan Auliya Abrar in WordPress Plugin Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform versions 2.17.2...

WordPress CamPay Shortcode Payment Gateway plugin < 1.7 - Unauthenticated Payment Status Forgery vulnerability

Unauthenticated Payment Status Forgery vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin CamPay Shortcode Payment Gateway versions 1.7...

WordPress Walletdoc Payment Gateway for WooCommerce plugin < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery vulnerability

Unauthenticated SQLi and Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Walletdoc Payment Gateway for WooCommerce versions 1.8.5...

WordPress Visma Pay for WooCommerce plugin < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure vulnerability

Unauthenticated Payment Bypass and Order Data Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Visma Pay for WooCommerce versions 1.2.2...

WordPress Meow Lightbox plugin <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Meow Lightbox versions = 5.6.2...

WordPress Responsive Blocks plugin < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email vulnerability

Unauthenticated HTML Injection in Form Notification Email vulnerability discovered by Amin Guliyev in WordPress Plugin Responsive Blocks versions 2.3.0...

WordPress Tickera plugin < 3.6.0.4 - Unauthenticated Order Payment Bypass vulnerability

Unauthenticated Order Payment Bypass vulnerability discovered by ryan fabella in WordPress Plugin Tickera versions 3.6.0.4...

WordPress LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by Adrien Brunner in WordPress Plugin LifterLMS versions = 10.3.1...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sawyer in WordPress Plugin GeoDirectory versions = 2.8.190...

WordPress Record of Consent Extension for Complianz plugin <= 2.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by OKISO in WordPress Plugin Record of Consent Extension for Complianz versions = 2.5...

WordPress Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Kuba in WordPress Plugin Jeg Kit for Elementor versions = 3.2.19...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin GeoDirectory versions = 2.8.190...

WordPress Mang Board plugin <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by leon figueira in WordPress Plugin Mang Board WP versions = 2.4.3...

WordPress NewStatPress plugin <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin NewStatPress versions = 1.4.5...

WordPress Contact Form DB for Enfold plugin <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by andrea bocchetti in WordPress Plugin Contact Form DB for Enfold versions = 2.0.2...

WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin Verified Reviews Avis Vérifiés versions = 2.4.6...

WordPress FV Player 8 plugin <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin FV Player 8 versions = 8.1.7...

WordPress NewStatPress plugin <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by zickzick2 in WordPress Plugin NewStatPress versions = 1.4.5...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability discovered by churchill11 in WordPress Plugin LatePoint versions = 5.7.3...

WordPress Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.48 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Form Maker by 10Web versions = 1.15.48...

WordPress JTL-Connector for WooCommerce plugin <= 2.4.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin JTL-Connector for WooCommerce versions = 2.4.3...

WordPress Mang Board plugin <= 2.4.3 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin Mang Board WP versions = 2.4.3...

WordPress SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment vulnerability

Unauthenticated Privilege Escalation to wpcapabilities Mass Assignment vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin FormFlow versions = 3.10.0...

WordPress ShopMagic – email automation for WordPress plugin <= 4.9.0 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by crow in WordPress Plugin ShopMagic versions = 4.9.0...

WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin FV Flowplayer Video Player versions = 7.5.54.7212...

WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peter Tang in WordPress Plugin CP Multi View Event Calendar versions = 1.4.41...

WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin Restricted Site Access versions = 7.6.2...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover vulnerability

Unauthenticated Authentication Bypass to Customer Account Takeover vulnerability discovered by OKISO in WordPress Plugin LatePoint versions = 5.7.2...

WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Rafie Muhammad in WordPress Plugin The Grid versions = 2.8.1...

WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin Green Popups versions 7.6.3...

WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Gravity Forms versions 3.1.1...

WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Theme Houzez versions = 4.4.0...

WordPress AWP Classifieds plugin < 4.4.9 - Unauthenticated Listing Contact Email Disclosure vulnerability

Unauthenticated Listing Contact Email Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin AWP Classifieds versions 4.4.9...

WordPress Cart Abandonment Recovery for WooCommerce plugin < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification vulnerability

Unauthenticated Abandoned Cart Record Deletion and Modification vulnerability discovered by JunHee CHO in WordPress Plugin WooCommerce Cart Abandonment Recovery versions 2.1.4...

WordPress Paymentfor Gateway for WooCommerce plugin < 1.0.6 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc, Naoki Kawahigashi in WordPress Plugin Paymentfor Gateway for WooCommerce versions 1.0.6...

WordPress Robokassa payment gateway for Woocommerce plugin < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed vulnerability

Unauthenticated Arbitrary Order Status Change to Failed vulnerability discovered by JunHee CHO in WordPress Plugin Robokassa payment gateway for Woocommerce versions 1.9.0...

WordPress Donation Thermometer plugin < 2.3.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Donation Thermometer versions 2.3.0...

WordPress YITH WooCommerce Popup plugin < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion vulnerability

Contributor+ Arbitrary Post Meta Deletion vulnerability discovered by JunHee CHO in WordPress Plugin YITH WooCommerce Popup versions 1.60.0...

WordPress Sifalo Pay plugin 2.0-2.5.2 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Ryan Fabella in WordPress Plugin Sifalo Pay versions 2.0-2.5.2...

WordPress SellKit plugin < 2.8.0 - Unauthenticated Arbitrary Price Manipulation vulnerability

Unauthenticated Arbitrary Price Manipulation vulnerability discovered by Lê Gia Khôi in WordPress Plugin SellKit versions 2.8.0...

WordPress Sifalo Pay plugin 2.0-2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure vulnerability

Unauthenticated Order Payment Metadata Modification and Forced Order Failure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Sifalo Pay versions 2.0-2.5.2...

WordPress Tainacan plugin < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure vulnerability

Subscriber+ Repository Staff Email Address Disclosure vulnerability discovered by Artus KG in WordPress Plugin Tainacan versions 1.4.0...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin < 4.7.14 - Subscriber+ Arbitrary Album Media Injection vulnerability

Subscriber+ Arbitrary Album Media Injection vulnerability discovered by Lawal Qasim in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions 4.7.14...

WordPress Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant plugin < 5.3.2 - Unauthenticated Forced Store Registration vulnerability

Unauthenticated Forced Store Registration vulnerability discovered by JunHee CHO in WordPress Plugin Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant versions 5.3.2...

WordPress FV Flowplayer Video Player plugin 7.5.44.7212-7.5.55.7211 - Contributor+ SSRF vulnerability

Contributor+ SSRF vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin FV Flowplayer Video Player versions 7.5.44.7212-7.5.55.7211...