52842 matches found
WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Interactive Geo Maps versions = 1.6.30...
WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by Steve in WordPress Plugin Authorizer versions = 3.15.1...
WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar versions = 5.13.1...
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Upsell Order Bump Offer for WooCommerce versions = 3.1.5...
WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin Login With Ajax versions = 4.5.1...
WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ivaylo Atanassov in WordPress Plugin WCFM Marketplace versions = 3.8.1...
WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin WP User Frontend versions = 4.3.10...
WordPress KiviCare plugin < 4.5.5 - Unauthenticated Patient Data Disclosure vulnerability
Unauthenticated Patient Data Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.5...
WordPress MW WP Form plugin < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin MW WP Form versions 5.1.5...
WordPress WP Fastest Cache plugin 0.8.7.7-1.5.0 - Unauthenticated Cache Poisoning vulnerability
Unauthenticated Cache Poisoning vulnerability discovered by Amity Gilmour in WordPress Plugin WP Fastest Cache versions 0.8.7.7-1.5.0...
WordPress Gravity Forms plugin <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion vulnerability
Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion vulnerability discovered by WordFence in WordPress Plugin Gravity Forms versions = 3.0.2...
WordPress WPBakery Page Builder plugin <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via 'data' Parameter vulnerability discovered by d.v4ns3c in WordPress Plugin WPBakery Page Builder versions = 8.7.4...
WordPress Welcart e-Commerce plugin <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'customorder' Parameter vulnerability discovered by Afifudin Maarif in WordPress Plugin Welcart e-Commerce versions = 2.12.1...
WordPress Nokri - Job Board WordPress Theme plugin <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter vulnerability
WordPress Nokri - Job Board WordPress Theme plugin = 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter vulnerability discovered by d.v4ns3c in WordPress Theme Nokri versions = 1.6.6...
WordPress Simple Membership plugin <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding vulnerability
Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding vulnerability discovered by Kittipat Jitphonchana in WordPress Plugin Simple Membership versions = 4.8.1...
WordPress FS Poster plugin <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting vulnerability
Authenticated Subscriber+ Remote Code Execution via FFmpeg Path Setting vulnerability discovered by Sullo - Hack LLC in WordPress Plugin FS Poster versions = 8.0.1...
WordPress WP Recipe Maker Premium plugin <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode vulnerability discovered by theviper17y in WordPress Plugin WP Recipe Maker Premium versions = 10.5.0...
WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...
WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...
NPM: MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
NPM: MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS vulnerability discovered by ? in WordPress Npm mysql2 versions = 3.23.0...
NPM: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
NPM: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input vulnerability discovered by ? in WordPress Npm decode-uri-component versions = 0.4.2...
NPM: Socket.IO: Engine.IO WebTransport SID DoS
NPM: Socket.IO: Engine.IO WebTransport SID DoS vulnerability discovered by ? in WordPress Npm engine.io versions = 6.5.0, 6.6.7...
WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WCFM Marketplace versions = 3.8.2...
WordPress Pods plugin 3.3-3.3.9.1 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Unknown in WordPress Plugin Pods versions 3.3-3.3.9.1...
WordPress Breakdance plugin <= 2.8.1 - Unauthenticated Broken Access Control in Design Library Import vulnerability
Unauthenticated Broken Access Control in Design Library Import vulnerability discovered by Soflyy in WordPress Plugin Breakdance versions = 2.8.1...
WordPress User Profile Builder plugin <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'email' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Profile Builder versions = 4.0.0...
WordPress Charitable plugin <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute vulnerability
Authenticated Contributor+ SQL Injection via 'order' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Charitable versions = 1.8.12.1...
WordPress Blocksy Companion plugin <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) vulnerability
Authenticated Author+ Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data vulnerability discovered by haofanjiukunle in WordPress Plugin Blocksy Companion versions = 2.1.51...
WordPress BetterDocs plugin <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin BetterDocs versions = 4.8.1...
WordPress Frontend Admin by DynamiApps plugin <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag vulnerability
Unauthenticated Arbitrary File Deletion via Path Traversal via customdirectoryname Merge Tag vulnerability discovered by nudien in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.12...
WordPress Support Genix plugin <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability
Authenticated Subscriber+ Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Support Genix versions = 1.4.52...
WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'lsddisplstyle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Listdom versions = 5.8.1...
WordPress Affiliate Super Assistent plugin <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function vulnerability
Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function vulnerability discovered by theviper17y in WordPress Plugin Affiliate Super Assistent versions = 1.10.2...
WordPress Oxygen plugin 6.0-6.1.1 - Unauthenticated Broken Access Control in Design Library Import vulnerability
Unauthenticated Broken Access Control in Design Library Import vulnerability discovered by Soflyy in WordPress Plugin Oxygen Builder versions 6.0-6.1.1...
WordPress User Profile Builder plugin <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'date' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Profile Builder versions = 4.0.0...
WordPress Shopping Cart & eCommerce Store plugin <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter vulnerability
Authenticated Administrator+ SQL Injection via 'productorder' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP EasyCart versions = 5.9.2...
WordPress Photo Gallery by Ays plugin <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter vulnerability
Authenticated Administrator+ SQL Injection via 's' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Photo Gallery by Ays versions = 6.8.2...
WordPress Cozy Blocks plugin <= 2.2.17 - Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter vulnerability
Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Cozy Blocks versions = 2.2.17...
WordPress Master Addons for Elementor plugin <= 3.1.9 - Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction vulnerability
Authenticated Editor+ Arbitrary File Upload via uploadtemplatekit AJAX ZIP Extraction vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Master Addons for Elementor versions = 3.1.9...
WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'customid' Shortcode Attribute vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...
WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'dslccustomfield' Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...
WordPress LearnPress plugin <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability
Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin LearnPress versions = 4.4.4...
WordPress Frontend Admin by DynamiApps plugin <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'tag' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.11...
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Jiemook in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.4.1...
WordPress User Profile Builder plugin < 4.0.1 - Unauthenticated Unpublished Content and Media Modification vulnerability
Unauthenticated Unpublished Content and Media Modification vulnerability discovered by Erwan LR WPScan in WordPress Plugin Profile Builder versions 4.0.1...
WordPress Total processing card payments for WooCommerce plugin <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure vulnerability
Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Nomupay Payment Processing Gateway versions = 7.3...
WordPress Geotargeting WP plugin < 3.5.6.2 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by andrew gomez in WordPress Plugin Geotargeting WP versions 3.5.6.2...
WordPress Frontend Admin by DynamiApps plugin < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion vulnerability
Subscriber+ Arbitrary Membership Plan Deletion vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Frontend Admin by DynamiApps versions 3.29.11...
WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin < 4.5.13 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Groundhogg versions 4.5.13...
WordPress Rest Routes plugin <= 5.5.5 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Rest Routes – Custom Endpoints for WP REST API versions = 5.5.5...