52802 matches found
WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ SSRF via proSol_url_validate vulnerability
Subscriber+ SSRF via proSolurlvalidate vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...
WordPress WPC Admin Columns plugin < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability
Subscriber+ Arbitrary User/Post/Term Meta Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WPC Admin Columns versions 2.3.4...
WordPress WP Photo Album Plus plugin < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability
Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...
WordPress WP Photo Album Plus plugin < 9.2.07.002 - Reflected XSS via lbstart vulnerability
Reflected XSS via lbstart vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...
WordPress WP Travel Engine plugin < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart vulnerability
Unauthenticated Booking Details Disclosure and Modification via wteaddtriptocart vulnerability discovered by Usama Arshad in WordPress Plugin WP Travel Engine versions 6.8.5...
WordPress KiviCare plugin < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability
Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability discovered by Mokksh Parekh in WordPress Plugin KiviCare versions 4.5.2...
WordPress RT Mega Menu plugin < 1.5.2 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Shivamani Vastrala in WordPress Plugin RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions 1.5.2...
WordPress wpForo Forum plugin < 3.1.2 - Subscriber+ Stored XSS vulnerability
Subscriber+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin wpForo Forum versions 3.1.2...
WordPress Gallery for Google Photos plugin < 1.2.1 - Unauthenticated Google OAuth Token Disclosure vulnerability
Unauthenticated Google OAuth Token Disclosure vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin Gallery For Google Photos versions 1.2.1...
WordPress WP Directory Kit plugin < 1.5.6 - Subscriber+ SQL Injection via section Parameter vulnerability
Subscriber+ SQL Injection via section Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions 1.5.6...
WordPress WP Directory Kit plugin < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category vulnerability
Unauthenticated SQL Injection via searchlocation and searchcategory vulnerability discovered by Pedro Pinho in WordPress Plugin WP Directory Kit versions 1.5.6...
WordPress Ezoic plugin < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes vulnerability
Unauthenticated Database Export via Content Export REST Routes vulnerability discovered by Usama Arshad in WordPress Plugin Ezoic versions 2.23.1...
WordPress The School Management plugin <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter vulnerability
Authenticated Custom+ SQL Injection via 'order0dir' Parameter vulnerability discovered by j4ck13ch4n in WordPress Plugin The School Management – Education & Learning Management versions = 5.4...
WordPress WPAdverts – Classifieds Plugin plugin <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability
Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Deva Parekh in WordPress Plugin WPAdverts versions = 2.3.2...
WordPress ShopMonitor.io plugin < 1.2.0 - Unauthenticated Administrator Account Takeover vulnerability
Unauthenticated Administrator Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin ShopMonitor.io versions 1.2.0...
WordPress DynamicKit for Elementor plugin < 1.0.3 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin DynamicKit for Elementor versions 1.0.3...
WordPress User Profile Builder plugin < 3.16.4 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Jakub Herman in WordPress Plugin Profile Builder versions 3.16.4...
WordPress Essential Addons for Elementor plugin < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment vulnerability
Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment vulnerability discovered by Jakub Herman in WordPress Plugin Essential Addons for Elementor versions 6.7.2...
WordPress ProSolution WP Client plugin <= 2.0.8 - Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters vulnerability
Unauthenticated Arbitrary File Deletion via 'newfilename' and 'filename' Parameters vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin ProSolution WP Client versions = 2.0.8...
WordPress ProSolution WP Client plugin <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability
Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability discovered by Nir Yehoshua - cipher security labs in WordPress Plugin ProSolution WP Client versions = 2.0.10...
WordPress SVG Support plugin < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass vulnerability
Author+ Stored XSS via .svgz Sanitization Bypass vulnerability discovered by Shivamani Vastrala in WordPress Plugin SVG Support versions 2.5.17...
WordPress Eventin plugin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting vulnerability
Editor+ Local File Inclusion via speakertemplate Setting vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...
WordPress Nexter Blocks plugin < 5.0.2 - Author+ Stored XSS via SVG Upload vulnerability
Author+ Stored XSS via SVG Upload vulnerability discovered by Bob Matyas in WordPress Plugin Nexter Blocks versions 5.0.2...
WordPress GeoDirectory plugin < 2.8.110 - Editor+ Stored XSS via Place Categories vulnerability
Editor+ Stored XSS via Place Categories vulnerability discovered by Krugov Artyom in WordPress Plugin GeoDirectory versions 2.8.110...
WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by dutafi in WordPress Plugin YITH WooCommerce Membership Premium versions = 2.33.0...
WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Templatiq versions = 0.2.5...
WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin PDF Smart Viewer for Elementor versions = 1.0.4...
WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Online Contact Widget versions = 1.3.0...
WordPress Duitku Payment Gateway plugin <= 2.11.14 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by daroo in WordPress Plugin Duitku Payment Gateway versions = 2.11.14...
WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Jakub Herman in WordPress Plugin Restaurant Menu by MotoPress versions = 2.4.11...
WordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin Autopay versions = 5.0.0...
WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Evan NR in WordPress Plugin WPDM – Premium Packages versions = 7.0.5...
WordPress MultiVendorX plugin <= 5.0.14 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Jakub Herman in WordPress Plugin MultiVendorX versions = 5.0.14...
WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Flutterwave WooCommerce versions = 3.3.0...
WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication vulnerability
Broken Authentication vulnerability discovered by Jakub Herman in WordPress Plugin Piraeus Bank WooCommerce Payment Gateway versions 3.2.0...
WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by dutafi in WordPress Plugin JetAppointment versions = 2.5.2...
WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability
SQL Injection vulnerability discovered by dutafi in WordPress Plugin Readabler versions 2.0.18...
WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Jakub Herman in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...
WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability
WordPress Masteriyo - LMS plugin = 2.3.2 - Arbitrary File Upload vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 2.3.2...
WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability
Bypass Vulnerability vulnerability discovered by Asim Alshaya in WordPress Plugin Contact Form by Supsystic versions 1.10.0...
WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Contact Form by Supsystic versions 1.10.0...
WordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability
SQL Injection vulnerability discovered by rootdirective.sec in WordPress Plugin License Manager for WooCommerce versions = 3.0.18...
WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability
Deserialization of untrusted data vulnerability discovered by Peter Thaleikis in WordPress Plugin Youzify versions = 1.3.7...
WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Fluent Forms Pro Add On Pack versions 6.2.12...
WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin <= 1.8.5 - Unauthenticated PHP Object Injection vulnerability
WordPress Contact Form, Survey, Quiz & Popup Form Builder - ARForms plugin = 1.8.5 - Unauthenticated PHP Object Injection vulnerability discovered by Krzysztof Zając - CERT PL in WordPress Plugin ARForms Form Builder versions = 1.8.5...
WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin OptionTree versions = 2.7.3...
WordPress Kirki plugin <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter vulnerability
Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure via 'context' Parameter vulnerability discovered by Datist Pham - NAB Innovation Centre Vietnam in WordPress Plugin Kirki versions = 6.1.1...
WordPress Ultimate Dashboard plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Ultimate Dashboard versions = 3.11.2...
WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Ultimate Dashboard Pro versions = 3.11.2...