WordPress SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment vulnerability

Unauthenticated Privilege Escalation to wpcapabilities Mass Assignment vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin FormFlow versions = 3.10.0...

WordPress ShopMagic – email automation for WordPress plugin <= 4.9.0 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by crow in WordPress Plugin ShopMagic versions = 4.9.0...

WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin FV Flowplayer Video Player versions = 7.5.54.7212...

WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin Restricted Site Access versions = 7.6.2...

WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peter Tang in WordPress Plugin CP Multi View Event Calendar versions = 1.4.41...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover vulnerability

Unauthenticated Authentication Bypass to Customer Account Takeover vulnerability discovered by OKISO in WordPress Plugin LatePoint versions = 5.7.2...

WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Rafie Muhammad in WordPress Plugin The Grid versions = 2.8.1...

WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin Green Popups versions 7.6.3...

WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Gravity Forms versions 3.1.1...

WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Theme Houzez versions = 4.4.0...

WordPress Paymentfor Gateway for WooCommerce plugin < 1.0.6 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc, Naoki Kawahigashi in WordPress Plugin Paymentfor Gateway for WooCommerce versions 1.0.6...

WordPress Cart Abandonment Recovery for WooCommerce plugin < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification vulnerability

Unauthenticated Abandoned Cart Record Deletion and Modification vulnerability discovered by JunHee CHO in WordPress Plugin WooCommerce Cart Abandonment Recovery versions 2.1.4...

WordPress AWP Classifieds plugin < 4.4.9 - Unauthenticated Listing Contact Email Disclosure vulnerability

Unauthenticated Listing Contact Email Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin AWP Classifieds versions 4.4.9...

WordPress Robokassa payment gateway for Woocommerce plugin < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed vulnerability

Unauthenticated Arbitrary Order Status Change to Failed vulnerability discovered by JunHee CHO in WordPress Plugin Robokassa payment gateway for Woocommerce versions 1.9.0...

WordPress Donation Thermometer plugin < 2.3.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Donation Thermometer versions 2.3.0...

WordPress Sifalo Pay plugin 2.0-2.5.2 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Ryan Fabella in WordPress Plugin Sifalo Pay versions 2.0-2.5.2...

WordPress Sifalo Pay plugin 2.0-2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure vulnerability

Unauthenticated Order Payment Metadata Modification and Forced Order Failure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Sifalo Pay versions 2.0-2.5.2...

WordPress SellKit plugin < 2.8.0 - Unauthenticated Arbitrary Price Manipulation vulnerability

Unauthenticated Arbitrary Price Manipulation vulnerability discovered by Lê Gia Khôi in WordPress Plugin SellKit versions 2.8.0...

WordPress YITH WooCommerce Popup plugin < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion vulnerability

Contributor+ Arbitrary Post Meta Deletion vulnerability discovered by JunHee CHO in WordPress Plugin YITH WooCommerce Popup versions 1.60.0...

WordPress Tainacan plugin < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure vulnerability

Subscriber+ Repository Staff Email Address Disclosure vulnerability discovered by Artus KG in WordPress Plugin Tainacan versions 1.4.0...

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin < 4.7.14 - Subscriber+ Arbitrary Album Media Injection vulnerability

Subscriber+ Arbitrary Album Media Injection vulnerability discovered by Lawal Qasim in WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress versions 4.7.14...

WordPress Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant plugin < 5.3.2 - Unauthenticated Forced Store Registration vulnerability

Unauthenticated Forced Store Registration vulnerability discovered by JunHee CHO in WordPress Plugin Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant versions 5.3.2...

WordPress Pricing Table plugin 1.0.7-2.1.4 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Pricing Table block – Display product prices as a table. versions 1.0.7-2.1.4...

WordPress FV Flowplayer Video Player plugin 7.5.44.7212-7.5.55.7211 - Contributor+ SSRF vulnerability

Contributor+ SSRF vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin FV Flowplayer Video Player versions 7.5.44.7212-7.5.55.7211...

WordPress Sunshine Photo Cart plugin < 3.7.4 - Unauthenticated Content Injection vulnerability

Unauthenticated Content Injection vulnerability discovered by Raphael P. Cigana in WordPress Plugin Sunshine Photo Cart versions 3.7.4...

WordPress WP 2FA plugin < 4.2.0 - Admin+ Arbitrary User 2FA Removal vulnerability

Admin+ Arbitrary User 2FA Removal vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP 2FA versions 4.2.0...

WordPress EmbedPress plugin < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating vulnerability

Unauthenticated YouTube API Quota Consumption and Database Bloating vulnerability discovered by Alberto Ucendo Martínez in WordPress Plugin EmbedPress versions 4.6.8...

WordPress GamiPress plugin < 8.0.6 - Subscriber+ Activity Log Disclosure vulnerability

Subscriber+ Activity Log Disclosure vulnerability discovered by Shirshak in WordPress Plugin GamiPress versions 8.0.6...

WordPress GamiPress plugin 7.9.5-8.0.5 - Unauthenticated Private Activity Log Disclosure vulnerability

Unauthenticated Private Activity Log Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin GamiPress versions 7.9.5-8.0.5...

WordPress Image Photo Gallery Final Tiles Grid plugin < 3.6.16 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Ala Bouali in WordPress Plugin Image Photo Gallery Final Tiles Grid versions 3.6.16...

WordPress LTL Freight Quotes plugin < 4.2.19 - Unauthenticated Stored HTML Injection vulnerability

Unauthenticated Stored HTML Injection vulnerability discovered by Ryan Fabella in WordPress Plugin LTL Freight Quotes – Old Dominion Edition versions 4.2.19...

WordPress Gutenverse Form plugin < 3.0.11 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by John Ryan Albon in WordPress Plugin Gutenverse Form versions 3.0.11...

WordPress NEX-Forms plugin 9.2.1-9.3.0 - Unauthenticated Arbitrary Form Entry Modification vulnerability

Unauthenticated Arbitrary Form Entry Modification vulnerability discovered by Farid Narimanov in WordPress Plugin NEX-Forms versions 9.2.1-9.3.0...

WordPress LTL Freight Quotes plugin < 4.2.19 - Unauthenticated FreightDesk Integration Option Update vulnerability

Unauthenticated FreightDesk Integration Option Update vulnerability discovered by achmad sonif in WordPress Plugin LTL Freight Quotes – Old Dominion Edition versions 4.2.19...

WordPress WP Data Access plugin < 5.5.84 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Raphael P. Cigana in WordPress Plugin WP Data Access versions 5.5.84...

WordPress Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin 4.10.1-4.10.5 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Civitasmass in WordPress Plugin Post Expirator versions 4.10.1-4.10.5...

WordPress CodeAtoZ B2B Suite for WooCommerce plugin < 1.6.1 - Unauthenticated Guest Quote Disclosure vulnerability

Unauthenticated Guest Quote Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin CodeAtoZ B2B Suite for WooCommerce versions 1.6.1...

WordPress WP Data Access plugin < 5.5.77 - Unauthenticated Incorrect Authorization vulnerability

Unauthenticated Incorrect Authorization vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Data Access versions 5.5.77...

WordPress Image Photo Gallery Final Tiles Grid plugin < 3.6.15 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Abdullah Kareem in WordPress Plugin Image Photo Gallery Final Tiles Grid versions 3.6.15...

WordPress PeproDev Branches Map (Mapify) plugin <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin PeproDev Branches Map versions = 3.0.1...

WordPress Post Export Import with Media plugin <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Post Export Import with Media versions = 1.17.1...

WordPress Mang Board plugin <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Mang Board WP versions = 2.4.3...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion vulnerability

Authenticated Subscriber+ Sensitive Information Exposure in 'firstname' Parameter Template Re-expansion vulnerability discovered by walid213 in WordPress Plugin LatePoint versions = 5.7.3...

WordPress Gallery Custom Links plugin <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Gallery Custom Links versions = 2.3.3...

WordPress JTL-Connector for WooCommerce plugin <= 2.4.3 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Supakiad S. m3ez in WordPress Plugin JTL-Connector for WooCommerce versions = 2.4.3...

WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin FV Flowplayer Video Player versions = 7.5.54.7212...

WordPress Hyyan WooCommerce Polylang Integration plugin <= 1.5.0 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by HYEBIN NOH sh in WordPress Plugin Hyyan WooCommerce Polylang Integration versions = 1.5.0...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sorra in WordPress Plugin Directorist versions = 8.10.2.1...

WordPress PO/MO Editor plugin <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by sermsak in WordPress Plugin PO/MO Editor versions = 1.4.2...

WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Spy0x7 in WordPress Plugin Cryptocurrency Donation Box – Bitcoin & Crypto Donations versions = 2.2.13...