WordPress Persistent Login plugin <= 3.1.0 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin WordPress Persistent Login versions = 3.1.0...

WordPress WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin <= 4.4.1 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Supakiad S. m3ez in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.4.1...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.133 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by cyberkareem in WordPress Plugin WPvivid Backup and Migration versions 0.9.133...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering vulnerability

Instructor+ Cross-Course Curriculum Deletion and Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

WordPress WC Vendors plugin < 2.7.2.1 - Order Shipment Status Change vulnerability

Order Shipment Status Change vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...

WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability

Vendor+ Cross-Vendor Product and Arbitrary Post Modification vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...

WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change vulnerability

Vendor+ Cross-Vendor Order Shipment Status Change vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Unauthenticated Student Statistics Disclosure vulnerability

Unauthenticated Student Statistics Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

WordPress JetStyleManager for Gutenberg plugin < 1.3.9 - Skin Deletion and Modification vulnerability

Skin Deletion and Modification vulnerability discovered by Huynh Kien Minh in WordPress Plugin JetStyleManager for Gutenberg versions 1.3.9...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Unauthenticated Student Enrollment Disclosure vulnerability

Unauthenticated Student Enrollment Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.46...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure vulnerability

Subscriber+ Cross-Instructor Order Data Disclosure vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.46...

WordPress CatalogX plugin < 6.1.3 - Unauthenticated Email Content Injection vulnerability

Unauthenticated Email Content Injection vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Product Catalog Enquiry for WooCommerce by MultiVendorX versions 6.1.3...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Instructor+ Quiz Answer Disclosure vulnerability

Instructor+ Quiz Answer Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure vulnerability

Unauthenticated Unpublished Course Title Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...

WordPress FormLayer plugin < 1.0.9 - Unauthenticated Form Configuration Disclosure vulnerability

Unauthenticated Form Configuration Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin FormLayer versions 1.0.9...

WordPress Rank Math SEO plugin < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure vulnerability

Unauthenticated Non-Public Post Schema and Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Non-Public Post Content Disclosure vulnerability

Author+ Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite vulnerability

Author+ Arbitrary Post and User Metadata Overwrite vulnerability discovered by Usama Arshad in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Rank Math SEO plugin < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability

Author+ Term Metadata Update and Cross-Object Post Title Overwrite vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress Social Media Share Buttons & Social Sharing Icons plugin < 3.0.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Social Media & Share Icons versions 3.0.1...

WordPress Rank Math SEO plugin < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure vulnerability

Unauthenticated Password-Protected Post Content Disclosure vulnerability discovered by Project Black in WordPress Plugin Rank Math SEO versions 1.0.277.1...

WordPress MultiVendorX plugin 5.0.13-5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure vulnerability

Unauthenticated Vendor PII and Payout Data Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin MultiVendorX versions 5.0.13-5.0.14...

WordPress Comments plugin < 7.6.66 - Unauthenticated Comment Disclosure vulnerability

Unauthenticated Comment Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin wpDiscuz versions 7.6.66...

WordPress Gutentor plugin < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure vulnerability

Subscriber+ Password Protected Post Password Disclosure vulnerability discovered by Ezekiel Victor in WordPress Plugin Gutentor versions 4.0.6...

WordPress Ultimate Member plugin < 2.13.0 - Unauthenticated Unapproved Comment Disclosure vulnerability

Unauthenticated Unapproved Comment Disclosure vulnerability discovered by Alessandro Greco aka Aleff, Giovambattista Ianni University of Calabria - UNICAL in WordPress Plugin Ultimate Member versions 2.13.0...

WordPress MotoPress Appointment Booking plugin < 2.4.8 - Unauthenticated Arbitrary Reservation Deletion vulnerability

Unauthenticated Arbitrary Reservation Deletion vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin MotoPress Appointment Booking versions 2.4.8...

WordPress Ultimate Before After Image Slider & Gallery plugin < 4.7.19 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin BEAF versions 4.7.19...

WordPress Solace Extra plugin < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability

Unauthenticated Draft/Private Site Builder Content Disclosure vulnerability discovered by JunHee CHO in WordPress Plugin Solace Extra versions 1.7.0...

WordPress Booking for Appointments and Events Calendar plugin < 2.4.9 - Unauthenticated Post-Booking Action Trigger vulnerability

Unauthenticated Post-Booking Action Trigger vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 2.4.9...

WordPress Ultimate Before After Image Slider & Gallery plugin < 4.7.19 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin BEAF versions 4.7.19...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.3.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Yuto Hyakumoto in WordPress Plugin TranslatePress versions = 3.3.1...

WordPress Formidable Charts plugin <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter vulnerability

Unauthenticated Arbitrary File Read via 'frmgraph' Parameter vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Formidable Charts versions = 2.0.1...

NPM: ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

NPM: ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass vulnerability discovered by ? in WordPress Npm sanitize-html versions = 1.9.0, = 2.17.6...

NPM: nanoid: Integer Overflow or Wraparound

NPM: nanoid: Integer Overflow or Wraparound vulnerability discovered by ? in WordPress Npm nanoid versions 3.3.12...

NPM: pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

NPM: pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml vulnerability discovered by ? in WordPress Npm pnpm versions = 10.7.0, 10.34.5...

WordPress Easy Waveform Player plugin <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Easy Waveform Player versions = 1.2.2...

NPM: pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

NPM: pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project vulnerability discovered by ? in WordPress Npm pnpm versions = 12.0.0-alpha.0, 12.0.0-alpha.5...

WordPress Divi plugin <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Contact Form 'redirecturl' Shortcode Parameter vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Divi versions = 4.27.5...

WordPress SigmaForms Pro plugin <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability

Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability discovered by Doan Dinh Van in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.11...

WordPress DevKit Pro plugin <= 2.3.0 - Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter vulnerability

Authenticated Subscriber+ Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter vulnerability discovered by Bao Le in WordPress Plugin DevKit Pro versions = 2.3.0...

NPM: Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

NPM: Browserslist: Unbounded memory growth no cache eviction via distinct query results, leading to eventual OOM vulnerability discovered by ? in WordPress Npm browserslist versions = 4.28.6...

NPM: Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

NPM: Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats normalizeStats vulnerability discovered by ? in WordPress Npm browserslist versions = 4.28.6...

NPM: MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

NPM: MySQL2: Auth Plugin Downgrade to mysqlclearpassword Leaks Plaintext Credentials vulnerability discovered by ? in WordPress Npm mysql2 versions 3.22.0...

WordPress Booking for Appointments and Events Calendar - Amelia (Premium) plugin 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' vulnerability

WordPress Booking for Appointments and Events Calendar - Amelia Premium plugin 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' vulnerability discovered by d.v4ns3c in WordPress Plugin Amelia versions 8.0-9.6.2...

WordPress Divi plugin <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Dynamic Content Legacy JSON Format Shortcode vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Divi versions = 4.27.6...

WordPress WP File Download plugin <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via 'remoteurl' Parameter vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin WP File Download versions = 6.3.4...

WordPress WooCommerce Product Attachment plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Jakub Herman in WordPress Plugin WooCommerce Product Attachment versions = 2.3.3...

WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Denver Jackson in WordPress Plugin Booking Hub versions = 1.3.1...

WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by 20kilograma in WordPress Plugin WP Event SOlution versions = 4.1.22...

WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability

WordPress Ninja Forms - Layout & Styles plugin = 3.0.31 - PHP Object Injection vulnerability discovered by Marc-André Beaulieu h3dg3h0g in WordPress Plugin Ninja Forms - Layout & Styles versions = 3.0.31...