WordPress WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read vulnerability

Authenticated Subscriber+ Arbitrary File Read vulnerability discovered by daroo in WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels versions = 4.9.8...

WordPress Forminator Forms plugin <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) vulnerability

Unauthenticated Stored Cross-Site Scripting via Radio Field Save and Continue Draft vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.57.0.2...

WordPress Forminator Forms plugin <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter vulnerability

Unauthenticated DOM-Based Cross-Site Scripting via 'errordescription' Parameter vulnerability discovered by Adrien Brunner in WordPress Plugin Forminator versions = 1.57.0...

WordPress Ultimate Member plugin <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by tiborisaak in WordPress Plugin Ultimate Member versions = 2.12.1...

WordPress WooCommerce Lottery plugin <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters vulnerability

Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters vulnerability discovered by h0xilo in WordPress Plugin WooCommerce Lottery versions = 2.2.9...

WordPress Classified Listing - Mobile Number Verification plugin <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login vulnerability

WordPress Classified Listing - Mobile Number Verification plugin = 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Classified Listing - Mobile Number Verification versions = 1.6.0...

WordPress ERP plugin <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment vulnerability

Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment vulnerability discovered by Talal Nasraddeen in WordPress Plugin WP ERP versions = 1.17.8...

WordPress Security Hardener plugin <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by zickzick2 in WordPress Plugin Security Hardener versions = 2.4.4...

WordPress InfusedWoo Pro plugin <= 5.1.17 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin InfusedWoo Pro versions = 5.1.17...

WordPress SmilePass Selfie Login plugin <= 1.0.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin SmilePass Selfie Login versions = 1.0.2...

WordPress Social Login & Sharing buttons with Analytics By SoClever plugin <= 1.2.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Social Login & Sharing buttons with Analytics By SoClever versions = 1.2.0...

WordPress WP Social Media Login plugin <= 1.0.6 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin WP Social Media Login versions = 1.0.6...

WordPress MalCare WordPress Security plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin MalCare Security versions 5.16-6.62...

WordPress BlogVault Backup & Staging plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin BlogVault versions 5.16-6.62...

WordPress The WP Remote WordPress plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin The WP Remote WordPress Plugin versions 5.16-6.62...

WordPress CM Map Locations plugin <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action vulnerability

Authenticated Subscriber+ Arbitrary File Upload via cmlocrouteimageupload AJAX Action vulnerability discovered by Spy0x7 in WordPress Plugin CM Map Locations versions = 2.1.8...

WordPress Mang Board WP plugin <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie vulnerability

Authenticated Subscriber+ Privilege Escalation to Forged Authentication Cookie vulnerability discovered by daroo in WordPress Plugin Mang Board WP versions = 2.3.7...

WordPress Simple Newsletter Plugin plugin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure vulnerability

Unauthenticated Subscriber PII and confirmkey Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Noptin versions 4.3.3...

WordPress Tutor LMS plugin 4.0.0-4.0.6 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Jakub Herman in WordPress Plugin Tutor LMS versions 4.0.6...

WordPress Avada Theme <= 7.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability

Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Theme Avada versions = 7.16...

WordPress Fusion Builder plugin <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability

Unauthenticated Remote Code Execution via Arbitrary File Write vulnerability discovered by WordFence in WordPress Plugin Fusion Builder versions = 3.16...

WordPress WP Data Access plugin <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access vulnerability

Unauthenticated Insecure Direct Object Reference to Data Access vulnerability discovered by type5afe in WordPress Plugin WP Data Access versions = 5.5.68...

WordPress Greenshift plugin <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Data URI vulnerability discovered by WordFence in WordPress Plugin Greenshift versions = 12.8.9...

WordPress Reviews and Rating - Google Reviews plugin <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes vulnerability

WordPress Reviews and Rating - Google Reviews plugin = 5.10 - Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Shortcodes vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Reviews and Rating – Google My Business versions = 5.10...

WordPress Project Manager plugin 2.1.0-4.0.6 - Unauthenticated Subscriber Account Creation vulnerability

Unauthenticated Subscriber Account Creation vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.1.0-4.0.6...

WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.1 - Cross-Customer Subscription Modification vulnerability

Cross-Customer Subscription Modification vulnerability discovered by Charles Vosburgh in WordPress Plugin WP Full Stripe Free versions 8.5.1...

WordPress RegistrationMagic plugin < 6.0.9.4 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin RegistrationMagic versions 6.0.9.4...

WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure vulnerability

Unauthenticated Customer Portal Subscription and Billing Data Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin WP Full Stripe Free versions 8.5.1...

WordPress Eventin plugin < 4.1.19 - Unauthenticated Order Completion Without Payment vulnerability

Unauthenticated Order Completion Without Payment vulnerability discovered by Nir Yehoshua in WordPress Plugin WP Event SOlution versions 4.1.19...

WordPress Kirki plugin < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure vulnerability

Unauthenticated User and Comment Author Email Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Kirki versions 6.0.14...

WordPress Project Manager plugin < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification vulnerability

Subscriber+ Cross-Project Task Disclosure and Task Board Modification vulnerability discovered by Pedro Pinho in WordPress Plugin WP Project Manager versions 4.0.7...

WordPress Project Manager plugin 2.2.0-4.0.7 - 4.0.6 - Subscriber+ User Activity Feed Disclosure vulnerability

WordPress Project Manager plugin 2.2.0-4.0.7 - 4.0.6 - Subscriber+ User Activity Feed Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin WP Project Manager versions 2.2.0-4.0.6...

WordPress Royal Addons for Elementor plugin < 1.7.1066 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Royal Elementor Addons versions 1.7.1066...

WordPress Booking Package plugin < 1.7.25 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Booking Package versions 1.7.25...

WordPress Royal Addons for Elementor plugin < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure vulnerability

Unauthenticated Taxonomy Term Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Royal Elementor Addons versions 1.7.1066...

WordPress WPCafe plugin < 3.0.18 - Unauthenticated Reservation Approval Bypass vulnerability

Unauthenticated Reservation Approval Bypass vulnerability discovered by ABIODUN VICTOR TAIWO in WordPress Plugin WPCafe versions 3.0.18...

WordPress Royal Addons for Elementor plugin < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification vulnerability

Unauthenticated Like Count and IP Meta Modification vulnerability discovered by Shivamani Vastrala in WordPress Plugin Royal Elementor Addons versions 1.7.1066...

WordPress Booking for Appointments and Events Calendar plugin < 2.4.7 - Unauthenticated Notification Queue Dispatch vulnerability

Unauthenticated Notification Queue Dispatch vulnerability discovered by Manuel Martínez Casasola in WordPress Plugin Amelia versions 2.4.7...

WordPress Eventin plugin < 4.1.22 - Unauthenticated Unpublished Content Disclosure vulnerability

Unauthenticated Unpublished Content Disclosure vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.22...

WordPress Betheme plugin <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'iconbox2' Shortcode vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Theme Betheme versions = 28.4...

WordPress Gutenverse plugin <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Blocks vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Gutenverse versions = 4.0.2...

WordPress Mailgun for WordPress plugin <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) vulnerability

Unauthenticated Server-Side Request Forgery SSRF vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin Mailgun for WordPress versions = 2.2.0...

WordPress kk Star Ratings – Rate Post & Collect User Feedbacks plugin <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Ronnachai Sretawat Na Ayutaya Simonhaskelly in WordPress Plugin kk Star Ratings versions = 5.4.10.3...

NPM: consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

NPM: consciousness-explorer / sublinear-time-solver MCP exportstate has an arbitrary file write vulnerability discovered by ? in WordPress Npm sublinear-time-solver versions 1.6.0...

NPM: consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

NPM: consciousness-explorer / sublinear-time-solver MCP exportstate has an arbitrary file write vulnerability discovered by ? in WordPress Npm consciousness-explorer versions 1.1.2...

NPM: Whistle vulnerable to path traversal

NPM: Whistle vulnerable to path traversal vulnerability discovered by ? in WordPress Npm whistle versions 2.10.3...

NPM: mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

NPM: mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment RFC 9260 violation vulnerability discovered by ? in WordPress Npm mediasoup versions = 3.20.0, = 3.20.5...

WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...

WordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass vulnerability

Unauthenticated Improper Input Validation to Price Bypass vulnerability discovered by Andrés Cruciani in WordPress Plugin Advanced Product Fields Product Addons for WooCommerce versions = 1.6.21...

WordPress WS Form LITE – Drag & Drop Contact Form Builder plugin <= 1.10.80 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin WS Form LITE versions = 1.10.80...