NPM: Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

NPM: Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling vulnerability discovered by ? in WordPress Npm epetherpad-lite versions = 1.8.14...

NPM: vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

NPM: vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

NPM: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

NPM: vm2: NodeVM builtin: '' exposes os and dns — process-wide observability reads AND writes that hijack the host sibling class of GHSA-9g8x-92q2-p28f vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

NPM: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

NPM: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

NPM: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

NPM: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

NPM: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

NPM: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin RomethemeForm For Elementor versions = 1.2.6...

WordPress Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms plugin <= 6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Gravity Booster Styles & Layouts for Gravity Forms versions = 6.1...

WordPress WP Table Builder plugin <= 2.2.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Table Builder versions = 2.2.1...

WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery versions = 1.16.20...

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Shortcodes and extra features for Phlox theme versions = 2.17.22...

WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Razorpay for WooCommerce versions = 4.8.7...

NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs

NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs vulnerability discovered by ? in WordPress Npm deepmerge-ts versions 8.0.0...

WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability

Remote File Inclusion vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions 1.14.2...

WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Easy Google Maps versions = 1.13.0...

WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Chaty Pro versions = 3.5.8...

WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Subscribe2 versions = 10.46...

WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by 20kilograma in WordPress Plugin ThumbPress versions 6.5...

WordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by VanTastic in WordPress Plugin Modern Events Calendar versions 7.35.0...

WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin Aotuman Grab WeChat Articles versions = 2.0.1...

WordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by 0xVenus in WordPress Plugin Gravity Forms Bookings premium versions = 2.1...

WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Nabil Irawan in WordPress Plugin Sync Post With Other Site versions = 1.9.3...

WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by johska in WordPress Plugin Cwicly versions = 1.4.4...

WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Mayosis Core versions = 5.4.7...

WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Doan Dinh Van in WordPress Plugin FormyChat versions = 2.15.7...

WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin SSL Zen versions = 4.7.43...

WordPress TrueBooker plugin <= 1.2.6 - Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter vulnerability

Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebookerwpuserid' Parameter vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin TrueBooker versions = 1.2.6...

WordPress Wholesale Market plugin <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via 'rolerequired' Parameter vulnerability discovered by SEONGWON CHO - Chung-ang University in WordPress Plugin Wholesale Market versions = 2.2.2...

WordPress KiviCare plugin <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter vulnerability

Authenticated Doctor+ SQL Injection via 'searchTerm' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin KiviCare versions = 4.5.1...

WordPress Groundhogg plugin <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter vulnerability

Authenticated Vendor+ SQL Injection via 'tagquery' Parameter vulnerability discovered by Jonathan Dersch - Jonathan Dersch - Bug Bounty in WordPress Plugin Groundhogg versions = 4.5.14...

WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'action' Parameter vulnerability discovered by Ivaylo in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...

WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values vulnerability

Authenticated Editor+ SQL Injection via Pattern JSON Keys/Values vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...

WordPress Invisible Anti-Spam & CAPTCHA plugin <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter vulnerability

Authenticated Editor+ SQL Injection via 'key' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant versions = 5.1...

WordPress Form Maker by 10Web plugin <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause vulnerability

Authenticated Subscriber+ SQL Injection via 'username' Placeholder in Dynamic-Choice Field WHERE Clause vulnerability discovered by R4mbb in WordPress Plugin Form Maker by 10Web versions = 1.15.44...

WordPress Hydra Booking plugin <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter vulnerability

Authenticated Host+ Stored Cross-Site Scripting via 'firstname' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Hydra Booking versions = 1.2.2...

WordPress Cookie Banner for GDPR / CCPA plugin <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.5...

WordPress Contest Gallery plugin <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' vulnerability

Authenticated Author+ Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Contest Gallery versions = 30.0.7...

WordPress Beaver Builder Page Builder plugin <= 2.10.2.2 - Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Button Module 'button' Parameter vulnerability discovered by a1batr0ss in WordPress Plugin Beaver Builder versions = 2.10.2.2...

WordPress Image Uploader for Welcart plugin <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter vulnerability

Authenticated Author+ SQL Injection via Attachment 'posttitle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Image Uploader for Welcart versions = 1.4.6...

WordPress Pinpoint Booking System plugin <= 2.9.9.6.8 - Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter vulnerability

Unauthenticated Improper Input Validation to Price Manipulation via 'cartdata' Parameter vulnerability discovered by WordFence in WordPress Plugin Pinpoint Booking System versions = 2.9.9.6.8...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action vulnerability

Missing Authorization to Unauthenticated Arbitrary Modification via wpdevartpayment AJAX Action vulnerability discovered by Raihan Adi Arba in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress Propovoice: All-in-One Client Management System plugin <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter vulnerability

Authenticated ndpvmanager+ Privilege Escalation via 'role' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Propovoice CRM versions = 1.7.8...

WordPress MaxUpload plugin <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter vulnerability discovered by JIWOONG LEE kimchunbok - Hyundai Red Team in WordPress Plugin MaxUpload versions = 1.4.0...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via REST API 'businessid' Parameter vulnerability discovered by MatilJ in WordPress Plugin Online Booking & Scheduling Calendar for WordPress by vcita versions = 4.6.0...

WordPress User Profile Builder plugin <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability

Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin Profile Builder versions = 3.16.4...

WordPress Object Sync for Salesforce plugin <= 2.2.13 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin Object Sync for Salesforce versions = 2.2.13...

WordPress 6Storage Rentals plugin <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter vulnerability

Unauthenticated Account Takeover via 'email' Parameter vulnerability discovered by WordFence in WordPress Plugin 6Storage Rentals versions = 2.27.0...

WordPress bLoyal: Loyalty & Promotions by bLoyal plugin <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings vulnerability

Authenticated Subscriber+ Privilege Escalation via Unprotected AJAX API URL Settings vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin bLoyal versions = 3.1.611.78...

WordPress RapiSafe plugin <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters vulnerability

Unauthenticated Arbitrary File Deletion via 'rsmfcf7session' and 'filename' Parameters vulnerability discovered by Spy0x7 in WordPress Plugin RapiSafe – Secure Multi File Upload for Contact Form 7 versions = 1.0.4...

WordPress User Session Synchronizer plugin <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters vulnerability

Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters vulnerability discovered by WordFence in WordPress Plugin User Session Synchronizer versions = 1.4.0...