WordPress Document Gallery plugin <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by 刀 妖 in WordPress Plugin Document Gallery versions = 5.1.1...

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Alz in WordPress Plugin Social Share Buttons & Analytics Plugin – GetSocial.io versions = 4.5...

WordPress AGE-GATE plugin <= 1.0 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Spy0x7 in WordPress Plugin AGE-GATE versions = 1.0...

WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Theme XStore versions 9.7.9...

WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Charles Vosburgh in WordPress Plugin WP Event Solution versions = 4.1.25...

WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mash in WordPress Plugin Download Monitor integration for WooCommerce versions = 1.0.3...

WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mohammed Dsleman in WordPress Plugin Premium Addons for Elementor versions = 4.11.110...

WordPress Countdown Timer – Widget Countdown plugin 3.0.0-3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Widget Countdown versions 3.0.0-3.0.1...

WordPress Avada (Fusion) Builder plugin <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter vulnerability

Unauthenticated Sensitive Information Exposure in 'argslinktarget' Parameter vulnerability discovered by Luke Eldridge system in WordPress Plugin Fusion Builder versions = 3.16.1...

WordPress AnyComment plugin <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kevin Whelan in WordPress Plugin AnyComment versions = 0.3.6...

WordPress WooCommerce Bookings plugin < 3.11.0 - Unauthenticated Denial of Service vulnerability

Unauthenticated Denial of Service vulnerability discovered by Mike Gozdiskowski in WordPress Plugin WooCommerce Bookings versions 3.11.0...

WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Bit Integrations versions = 2.10.6...

WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.8.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Taoufik El Adel in WordPress Plugin Abandoned Cart Pro for WooCommerce versions = 10.8.0...

WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.8.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by andrea bocchetti in WordPress Plugin Abandoned Cart Pro for WooCommerce versions = 10.8.0...

WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.8.0 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by andrea bocchetti in WordPress Plugin Abandoned Cart Pro for WooCommerce versions = 10.8.0...

WordPress Snazzy Social Media Feed plugin <= 2.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Abdualrhman Muzamil in WordPress Plugin Snazzy Social Media Feed versions = 2.5...

WordPress Database Addon for Contact Form 7 – CFDB7 plugin <= 1.4.1 - Unauthenticated Limited File Deletion vulnerability

Unauthenticated Limited File Deletion vulnerability discovered by Sawyer in WordPress Plugin Contact Form 7 Database Addon – CFDB7 versions = 1.4.1...

WordPress Printcart Store – Web to Print Product Designer for WooCommerce plugin <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution vulnerability

Unauthenticated Arbitrary File Upload to Remote Code Execution vulnerability discovered by Osman Hussein in WordPress Plugin Printcart Web to Print Product Designer for WooCommerce versions = 2.9.1...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Listing Deletion vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Directorist versions = 8.10.2.1...

WordPress BP Profile Search plugin <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution vulnerability

Unauthenticated Local File Inclusion to Remote Code Execution vulnerability discovered by snr in WordPress Plugin BP Profile Search versions = 5.9...

WordPress Click to Chat – HoliThemes plugin <= 4.44 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Click to Chat versions = 4.44...

WordPress Booking Package plugin <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by afei in WordPress Plugin Booking Package versions = 1.7.29...

WordPress WP-BusinessDirectory plugin <= 4.0.2 - Unauthenticated Arbitrary File Write vulnerability

Unauthenticated Arbitrary File Write vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP-BusinessDirectory versions = 4.0.2...

WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.10.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by crow in WordPress Plugin Bit Integrations versions = 2.10.6...

WordPress Membership & User Roles for WooCommerce (Automatic Role Changer) plugin <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache vulnerability

Authenticated Subscriber+ Privilege Escalation to Stale Foreign Role Cache vulnerability discovered by Azgnt in WordPress Plugin DFX Automatic Role Changer for WooCommerce versions = 20260828...

WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Ozisti versions = 1.1.10...

WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Preservation versions = 1.15...

WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Printy versions = 1.13.0...

WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Quirky versions = 1.23...

WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme RexCoin versions = 1.2.6...

WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tarcísio LuchesiPoystick in WordPress Plugin Link Whisper Free versions = 0.9.7...

WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin Link Whisper Free versions = 0.9.7...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Zein in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.13...

WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin YayMail versions = 4.4.6...

WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability

Content Injection vulnerability discovered by changsheng in WordPress Plugin Broken Link Checker versions = 2.4.14.1...

WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pr0f in WordPress Plugin User Registration versions = 5.2.8...

WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dzaku in WordPress Plugin Link Whisper Free versions = 0.9.7...

WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by HyeonMin Kim in WordPress Plugin Webba Booking versions = 6.5.2...

WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Prakrit in WordPress Plugin Social Share Buttons versions = 1.31...

WordPress Booking Package plugin <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Booking Package versions = 1.7.29...

WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by AndrewN in WordPress Plugin Mang Board WP versions = 2.4.4...

WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Anatoly Gorbounov x1will in WordPress Plugin User Registration versions = 5.2.8...

WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by SVO in WordPress Plugin Fluent CRM versions = 3.2.5...

WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by AndrewN in WordPress Plugin FluentCart versions = 1.7.1...

WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by AndrewN in WordPress Plugin Fluent CRM versions = 3.2.5...

WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin Everest Forms versions = 3.6.1...

WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability

SQL Injection vulnerability discovered by AndrewN in WordPress Plugin Amelia versions = 2.4.10...

WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Masaya Morita @mrtmyix in WordPress Plugin BSK PDF Manager versions = 3.8.1...

WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin MLS On The Fly versions = 1.8.1.5...

WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by John Ryan Albon in WordPress Plugin WP Crowdfunding versions = 2.2.2...