WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin WP Project Manager versions = 4.0.6...

WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Toolset Blocks versions = 1.6.26...

WordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ugur Ozer in WordPress Plugin AutomatorWP versions = 5.8.3...

WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by 20kilograma in WordPress Plugin MasterStudy LMS versions = 3.7.42...

WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by LevinityCyber in WordPress Plugin Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads versions = 1.2.0...

WordPress WPLegalPages plugin <= 3.7.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by HieuPenguinnn in WordPress Plugin WPLegalPages versions = 3.7.0...

WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Que Thanh Tuan in WordPress Plugin Style Kits versions = 2.6.5...

WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Stripe Payments versions = 2.1.2...

WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by ChuongVN in WordPress Plugin TranslatePress versions = 3.3.2...

WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Udin Chan in WordPress Plugin Event Tickets versions = 5.29.2.1...

WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Udin Chan in WordPress Plugin The Events Calendar versions = 6.17.2...

WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability

WordPress ACPT Pro - Custom Post Types Plugin for WordPress plugin = 2.0.63 - PHP Object Injection vulnerability discovered by VDsec in WordPress Plugin ACPT Pro - Custom Post Types Plugin for WordPress versions = 2.0.63...

WordPress AllCoach plugin < 1.0.2 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin AllCoach versions 1.0.2...

WordPress YMC Smart Filter plugin < 3.11.3 - Unauthenticated Private/Draft Post Disclosure vulnerability

Unauthenticated Private/Draft Post Disclosure vulnerability discovered by Ahmed Hashim Ismael in WordPress Plugin Filter & Grids versions 3.11.3...

WordPress BookingPress plugin < 1.5.6 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Sanjar Tulkinov in WordPress Plugin BookingPress versions 1.5.6...

WordPress ProfilePress plugin < 4.16.17 - Subscriber+ Subscription Cancellation via IDOR vulnerability

Subscriber+ Subscription Cancellation via IDOR vulnerability discovered by Haitam Lazaar in WordPress Plugin ProfilePress versions 4.16.17...

WordPress WP Support Plus Responsive Ticket System plugin <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array Keys vulnerability

Unauthenticated SQL Injection via filterelements Array Keys vulnerability discovered by Ayush Srivastava in WordPress Plugin WP Support Plus Responsive Ticket System versions = 9.1.2...

WordPress Everest Forms plugin < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST Endpoints vulnerability

Unauthenticated Missing Authorization via Site Assistant REST Endpoints vulnerability discovered by Pedro Pinho in WordPress Plugin Everest Forms versions 3.5.0...

WordPress SALESmanago & Leadoo plugin < 3.11.3 - Subscriber+ SQL Injection vulnerability

Subscriber+ SQL Injection vulnerability discovered by Alberto Ucendo Martínez in WordPress Plugin SALESmanago & Leadoo versions 3.11.3...

WordPress Royal MCP plugin < 1.4.26 - Subscriber+ Insufficient Authorization in MCP Tools vulnerability

Subscriber+ Insufficient Authorization in MCP Tools vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin Royal MCP versions 1.4.26...

WordPress WANotifier plugin < 2.6 - Subscriber+ LFI vulnerability

Subscriber+ LFI vulnerability discovered by Project Black in WordPress Plugin Notifier versions 2.6...

WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.5.1 - Path Traversal vulnerability

Path Traversal vulnerability discovered by D01EXPLOIT OFFICIAL in WordPress Plugin Printcart Web to Print Product Designer for WooCommerce versions = 2.5.1...

WordPress Booking Hub plugin <= 1.3.0 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Booking Hub versions = 1.3.0...

WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Plugin UltimateAI versions = 3.1.0...

WordPress Content Protector (Passster) plugin < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass vulnerability

Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass vulnerability discovered by Erwan LR WPScan in WordPress Plugin Passster versions 4.3.9...

WordPress Charitable plugin < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability

Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Charitable versions 1.8.12...

WordPress LitExtension: Store to WooCommerce Migration plugin <= 1.2.5 - Connector Token Takeover via CSRF vulnerability

Connector Token Takeover via CSRF vulnerability discovered by marim00 in WordPress Plugin LitExtension: WooCommerce Migration Plugin versions = 1.2.6...

WordPress myCred plugin < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED vulnerability

Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin myCred versions 3.2.5...

WordPress Eventin plugin < 4.1.21 - Contributor+ Server-Side Request Forgery vulnerability

Contributor+ Server-Side Request Forgery vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Event SOlution versions 4.1.21...

WordPress AI Engine plugin 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools vulnerability

WordPress AI Engine plugin 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools vulnerability discovered by Charles Vosburgh in WordPress Plugin AI Engine versions = 3.6.0...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass vulnerability

Unauthenticated RCE via Control Character Filename Bypass vulnerability discovered by Jakub Herman in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...

WordPress Copy & Delete Posts plugin < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure vulnerability

Authenticated Arbitrary Post Content and Password Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

WordPress Copy & Delete Posts plugin < 1.5.6 - Author+ Password-Protected Post Content Disclosure vulnerability

Author+ Password-Protected Post Content Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin Duplicate Post versions 1.5.6...

WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability

WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin = 1.4 - Local File Inclusion vulnerability discovered by Jamaal ahmed in WordPress Plugin MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator versions = 1.4...

WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Boost versions = 2.0.4...

WordPress Media Library Assistant plugin < 3.40 - Author+ SQL Injection via mla_search_connector vulnerability

Author+ SQL Injection via mlasearchconnector vulnerability discovered by João Ramos Maciel in WordPress Plugin Media LIbrary Assistant versions 3.40...

WordPress Tamara Checkout plugin <= 1.9.9.20 - Unauthenticated Order Status Manipulation vulnerability

Unauthenticated Order Status Manipulation vulnerability discovered by Ezekiel Victor in WordPress Plugin Tamara Checkout versions = 1.9.9.20...

WordPress Dokan plugin < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount vulnerability

Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin Dokan versions 5.0.14...

WordPress Dokan plugin < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint vulnerability

Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint vulnerability discovered by Usama Arshad in WordPress Plugin Dokan versions 5.0.14...

WordPress Link Whisper plugin < 0.9.7 - Editor+ SQL Injection via domain Parameter vulnerability

Editor+ SQL Injection via domain Parameter vulnerability discovered by huytqtq in WordPress Plugin Link Whisper Free versions 0.9.7...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting vulnerability

Admin+ Stored XSS via dragndropheadingtag Setting vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...

WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by luc in WordPress Plugin Boost versions = 2.0.4...

WordPress NewPath WildApricotPress Add-on - Member Directory plugin <= 1.0.0 - Unauthenticated Member PII Disclosure via REST API vulnerability

WordPress NewPath WildApricotPress Add-on - Member Directory plugin = 1.0.0 - Unauthenticated Member PII Disclosure via REST API vulnerability discovered by Huynh Kien Minh in WordPress Plugin NewPath WildApricotPress Add-on for Member Directory versions = 1.0.0...

WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Luis Koleski in WordPress Plugin WooBeWoo Product Filter Pro versions = 3.1.8...

WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sungbyeongchan in WordPress Plugin Magazine Blocks versions = 1.8.6...

WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin RepairBuddy versions = 4.1223...

WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by sanghyeok Kim in WordPress Plugin Hash Form versions = 1.4.0...

WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...