WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...

WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Cem Bas in WordPress Plugin Shared Files versions = 1.7.69...

WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by qdtad in WordPress Plugin Woo Essential versions = 4.3.0...

WordPress ShopBuilder Pro – Elementor WooCommerce Builder Addons plugin <= 2.2.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Jamaal ahmed in WordPress Plugin ShopBuilder Pro – Elementor WooCommerce Builder Addons versions = 2.2.0...

WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Brave Conversion Engine PRO versions = 0.8.6...

WordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jamaal ahmed in WordPress Plugin ProLancer Element versions = 1.4.8...

WordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jamaal ahmed in WordPress Plugin ProLancer Element versions = 1.4.8...

WordPress WooCommerce File Approval plugin <= 10.7 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Jamaal ahmed in WordPress Plugin WooCommerce File Approval versions = 10.7...

WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by VanTastic in WordPress Plugin Super Forms versions = 6.3.315...

WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability

WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin = 8.9.1 - Privilege Escalation vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Affiliate Pro - Affiliate Program for WooCommerce & WordPress versions = 8.9.1...

WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin TourMaster Plugin versions = 5.4.9...

WordPress Templately plugin < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite vulnerability

Unauthenticated Administrator Templately Cloud Connection Overwrite vulnerability discovered by Shivamani Vastrala in WordPress Plugin Templately versions 3.7.1...

WordPress Kirki plugin < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions vulnerability

Unauthenticated Arbitrary Shortcode Execution via Form Email Actions vulnerability discovered by Jakub Herman in WordPress Plugin Kirki versions 6.2.1...

WordPress TeraWallet - Wallet for WooCommerce plugin < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up vulnerability

WordPress TeraWallet - Wallet for WooCommerce plugin 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up vulnerability discovered by Guillermo Álvarez Fernández in WordPress Plugin TeraWallet – For WooCommerce versions 1.6.10...

WordPress EONSR AEO Agent plugin <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation vulnerability

Unauthenticated Stored XSS via Scheduled Post Creation vulnerability discovered by Pedro Pinho in WordPress Plugin EONSR AEO Agent versions = 3.7.9...

WordPress Infility Global plugin <= 2.15.34 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Denny Abraham Sinaga dennyabrahamsinaga in WordPress Plugin Infility Global versions = 2.15.34...

WordPress Chat On Desk Order Notifications plugin < 1.0.9 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by moonge in WordPress Plugin Chat On Desk Order Notifications versions 1.0.9...

WordPress SMS Alert plugin < 3.9.8 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Sai Praneeth Koti in WordPress Plugin SMS Alert Order Notifications versions 3.9.8...

WordPress Brave plugin < 0.8.6 - Subscriber+ Unpublished Popup Disclosure vulnerability

Subscriber+ Unpublished Popup Disclosure vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Brave versions 0.8.6...

WordPress WooCommerce Bookings plugin < 3.9.0 - Subscriber+ Draft Bookable Product Creation vulnerability

Subscriber+ Draft Bookable Product Creation vulnerability discovered by Mike Gozdiskowski in WordPress Plugin WooCommerce Bookings versions 3.9.0...

WordPress PPWP – Password Protect Pages plugin <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin PPWP versions = 1.9.18...

WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin Image Photo Gallery Final Tiles Grid versions = 3.6.12...

WordPress Greenshift – animation and page builder blocks plugin <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification vulnerability

Authenticated Contributor+ Theme Settings Modification vulnerability discovered by Raihan Adi Arba in WordPress Plugin Greenshift versions = 12.8.9...

WordPress Post Duplicator plugin <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication vulnerability

Authorization Bypass to Authenticated Contributor+ Post Duplication vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Post Duplicator versions = 3.0.11...

WordPress Conekta Payment Gateway plugin < 6.2.2 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by Pedro Pinho in WordPress Plugin Conekta Payment Gateway versions 6.2.2...

WordPress Tutor LMS plugin < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure vulnerability

Instructor+ Cross-Instructor Private Course Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Tutor LMS versions 4.0.6...

WordPress Post Grid, Slider & Carousel Ultimate plugin < 1.8.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Post Grid, Slider & Carousel Ultimate versions 1.8.1...

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions 1.8.8...

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions 1.8.8...

NPM: JSONata: Arbitrary Code Execution via crafted JSONata expressions

NPM: JSONata: Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions = 1.8.7...

NPM: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors

NPM: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors vulnerability discovered by ? in WordPress Npm defuddle versions = 0.19.0...

NPM: Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

NPM: Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

NPM: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

NPM: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers vulnerability discovered by ? in WordPress Npm unleash-server versions 7.5.2...

NPM: Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

NPM: Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter vulnerability discovered by ? in WordPress Npm unleash-server versions 7.5.2...

WordPress Automation Web Platform plugin <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure vulnerability

Unauthenticated Authentication Bypass via 'otptransient' Token Disclosure vulnerability discovered by RIA Labs - RIA Labs in WordPress Plugin Wawp versions = 4.8.6...

WordPress WPForms Pro plugin <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values vulnerability

Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values vulnerability discovered by daroo in WordPress Plugin WPForms Pro versions = 2.0.0.2...

WordPress JSON Options plugin <= 0.0.4 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin JSON Options versions = 0.0.4...

WordPress Depicter plugin < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import vulnerability

Editor+ Arbitrary File Upload via ZIP Import vulnerability discovered by md. minaruzzaman shovon in WordPress Plugin Depicter Slider versions 4.8.0...

WordPress Kirki plugin < 6.2.3 - Editor+ Stored XSS via Font Zip Upload vulnerability

Editor+ Stored XSS via Font Zip Upload vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.2.3...

WordPress GutenKit plugin <= 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure vulnerability

Contributor+ Mailchimp Audience Data Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin GutenKit versions = 2.4.15...

WordPress Admin and Site Enhancements plugin < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC vulnerability

Author+ Stored XSS via SVG Upload over XML-RPC vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Admin and Site Enhancements ASE versions 9.0.1...

WordPress GutenKit plugin < 2.5.0 - Author+ Stored XSS via SVG Upload vulnerability

Author+ Stored XSS via SVG Upload vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin GutenKit versions 2.5.0...

WordPress Royal Elementor Addons plugin < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder vulnerability

Admin+ Remote Code Execution via Widget Builder vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Royal Elementor Addons versions 1.7.1066...

WordPress AI Agent by SiteGround plugin <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Media Upload via /generate-content REST Endpoint vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SG AI Studio versions = 1.2.7...

WordPress Events Made Easy plugin <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property vulnerability

Authenticated Contributor+ Local File Inclusion via 'wppagetemplate' Event Property vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Events Made Easy versions = 3.2.5...

WordPress WPS Bidouille plugin < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users vulnerability

Subscriber+ User Email Disclosure via wpsgetusers vulnerability discovered by Shikhali Jamalzade in WordPress Plugin WPS Bidouille versions 1.33.5...

WordPress Membership For WooCommerce plugin < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass vulnerability

Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Membership For WooCommerce versions 3.1.2...

WordPress KiviCare plugin < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR vulnerability

Patient+ Arbitrary Media Attachment Read via IDOR vulnerability discovered by Erwan LR WPScan in WordPress Plugin KiviCare versions 4.5.4...