WordPress 爱采集数据采集和发布插件 plugin <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write vulnerability

Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin 爱采集数据采集和发布插件 versions = 1.0.0...

WordPress Uix UserCenter plugin <= 1.0.3 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by moonge in WordPress Plugin Uix UserCenter versions = 1.0.3...

WordPress MemberHero plugin <= 6.9 - Unauthenticated Privilege Escalation to Administrator vulnerability

Unauthenticated Privilege Escalation to Administrator vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Simple User Registration versions = 6.9...

WordPress MyHome Core plugin <= 4.4.5 - Authentication Bypass to Account Takeover vulnerability

Authentication Bypass to Account Takeover vulnerability discovered by Rafie Muhammad in WordPress Plugin MyHome Core versions = 4.4.5...

WordPress Custom User Registration Fields for WooCommerce plugin <= 2.2.3 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Custom User Registration Fields for WooCommerce versions = 2.2.3...

WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin bbPress versions = 2.6.14...

WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability

Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution vulnerability discovered by d.v4ns3c in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.5...

WordPress Customer Reviews for WooCommerce plugin < 5.118.0 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by rasul in WordPress Plugin Customer Reviews for WooCommerce versions 5.118.0...

WordPress SAML Single Sign On – SSO Login plugin <= 5.4.6 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Tanishq Shah, Thatchapol Booranatanit AliceZz in WordPress Plugin SAML SP Single Sign On versions = 5.4.6...

WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Noman Riffat in WordPress Plugin Charitable versions = 1.8.12.1...

WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gabriel Tanaka in WordPress Plugin RegistrationMagic versions = 6.0.9.8...

WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by she11f in WordPress Plugin Print Barcode Labels for your WooCommerce products/orders versions = 4.0.0...

WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Kalles Addons versions = 1.0.6...

WordPress Really Simple Security plugin < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability

Multisite Subsite Admin+ Arbitrary Plugin Installation vulnerability discovered by Charles Vosburgh in WordPress Plugin Really Simple SSL versions 9.8.0...

WordPress HEL Online Classroom: AI-powered Online Classrooms plugin <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass vulnerability

Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass vulnerability discovered by kimsunghoon in WordPress Plugin HEL Online Classroom: AI-powered Online Classrooms versions = 1.0.3...

WordPress MStore API plugin < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass vulnerability

Subscriber+ Arbitrary Order Payment Bypass vulnerability discovered by Erwan LR WPScan in WordPress Plugin MStore API versions 4.21.1...

WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Adam Kahlon Adkali in WordPress Plugin MapSVG versions = 8.15.0...

WordPress 爱采集数据采集和发布插件 plugin <= 1.0.0 - Unauthenticated User and Term Creation vulnerability

Unauthenticated User and Term Creation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin 爱采集数据采集和发布插件 versions = 1.0.0...

WordPress MW WP Form plugin < 5.1.6 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin MW WP Form versions 5.1.6...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.133 - Admin+ Arbitrary File Write vulnerability

Admin+ Arbitrary File Write vulnerability discovered by Nir Yehoshua in WordPress Plugin WPvivid Backup and Migration versions 0.9.133...

WordPress SOGO Add Script to Individual Pages Header Footer plugin <= 3.9 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin SOGO Add Script to Individual Pages Header Footer versions = 3.9...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability

Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.42...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.40 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Abdullah Kareem in WordPress Plugin MasterStudy LMS versions 3.7.40...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.43 - Unauthenticated Open Redirect vulnerability

Unauthenticated Open Redirect vulnerability discovered by Abiodun Victor in WordPress Plugin MasterStudy LMS versions 3.7.43...

WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.5 - Cross-Customer Subscription Cancellation vulnerability

Cross-Customer Subscription Cancellation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Full Stripe Free versions 8.5.5...

WordPress WP Ultimate CSV Importer plugin < 9.0 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Jaan Buerms in WordPress Plugin WP Ultimate CSV Importer versions 9.0...

WordPress Rank Math SEO plugin < 1.0.277 - Editor+ Core Settings Modification vulnerability

Editor+ Core Settings Modification vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Rank Math SEO versions 1.0.277...

WordPress HEL Online Classroom: AI-powered Online Classrooms plugin <= 1.0.3 - Unauthenticated Plugin Settings Update vulnerability

Unauthenticated Plugin Settings Update vulnerability discovered by kimsunghoon in WordPress Plugin HEL Online Classroom: AI-powered Online Classrooms versions = 1.0.3...

WordPress Booking for Appointments and Events Calendar plugin 1.2.32-2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval vulnerability

Amelia Customer+ Appointment Status Update and Self-Approval vulnerability discovered by Louise in WordPress Plugin Amelia versions 1.2.32-2.4.8...

WordPress Appointment Booking Calendar Plugin and Scheduling Plugin plugin 1.5.6-1.6.2 - Unauthenticated Booking Price Manipulation vulnerability

Unauthenticated Booking Price Manipulation vulnerability discovered by Nguyen Phuoc Thinh - HPT Vietnam Corporation in WordPress Plugin BookingPress versions 1.5.6-1.6.2...

WordPress HEL Online Classroom: AI-powered Online Classrooms plugin <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure vulnerability

Unauthenticated BigBlueButton API Secret Disclosure vulnerability discovered by kimsunghoon in WordPress Plugin HEL Online Classroom: AI-powered Online Classrooms versions = 1.0.3...

WordPress User Profile Builder plugin < 4.0.1 - Admin+ PHP Object Injection vulnerability

Admin+ PHP Object Injection vulnerability discovered by Vivien LEBAS in WordPress Plugin Profile Builder versions 4.0.1...

WordPress Catfolders Document Gallery Pro plugin < 2.0.7 - Unauthenticated Missing Authorization vulnerability

Unauthenticated Missing Authorization vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Catfolders Document Gallery Pro versions 2.0.7...

WordPress User Profile Builder plugin < 4.0.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Profile Builder versions 4.0.1...

WordPress Newsletters plugin < 4.17 - Unauthenticated API Access vulnerability

Unauthenticated API Access vulnerability discovered by Erwan LR WPScan in WordPress Plugin Newsletters versions 4.17...

WordPress SmartAIPress plugin <= 1.2.0 - Subscriber+ Server-Side Request Forgery vulnerability

Subscriber+ Server-Side Request Forgery vulnerability discovered by Benjamin Aguayo in WordPress Plugin SmartAIPress versions = 1.2.0...

WordPress MStore API plugin < 4.21.1 - Subscriber+ Arbitrary Order Completion vulnerability

Subscriber+ Arbitrary Order Completion vulnerability discovered by Erwan LR WPScan in WordPress Plugin MStore API versions 4.21.1...

WordPress Newsletters plugin < 4.17 - Arbitrary Plugin Option Update vulnerability

Arbitrary Plugin Option Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Newsletters versions 4.17...

NPM: MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

NPM: MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.4...

NPM: MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

NPM: MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.4...

NPM: MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

NPM: MariaDB's connector leaks the cleartext password to an MitM despite ssl: true vulnerability discovered by ? in WordPress Npm mariadb versions 3.2.4...

NPM: 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

NPM: 9router: Unauthenticated /v1 proxy access via Host-header spoofing → open AI relay + SSRF vulnerability discovered by ? in WordPress Npm 9router versions 0.5.2...

NPM: 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

NPM: 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass vulnerability discovered by ? in WordPress Npm 9router versions 0.5.2...

WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability

SQL Injection vulnerability discovered by sequenceX0 in WordPress Plugin WP Data Access versions = 5.5.81...

WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Forms Pro Add On Pack versions = 6.2.12...

WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Forms Pro Add On Pack versions = 6.2.12...

WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin LeadConnector versions = 4.0.5...

WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin SliceWP versions = 1.2.10...

WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Emiliano Carrizo in WordPress Plugin RegistrationMagic versions = 6.0.9.8...

WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Smart Marketing SMS and Newsletters Forms versions = 5.1.24...