WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Taylsec in WordPress Plugin Booking Activities versions = 1.18.4...

WordPress Visitors Traffic Real Time Statistics plugin <= 8.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Plugin Visitors Traffic Real Time Statistics versions = 8.11...

WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by VanTastic in WordPress Plugin WP Event SOlution versions = 4.1.18...

WordPress Blog Floating Button plugin <= 1.4.20 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hivesec in WordPress Plugin Blog Floating Button versions = 1.4.20...

WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability

SQL Injection vulnerability discovered by daroo in WordPress Plugin CubeWP versions = 1.1.30...

WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by rajukani100 in WordPress Plugin InstaWP Connect versions = 0.1.3.7...

WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by daroo in WordPress Plugin OMGF Pro versions = 5.2.7...

WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by sequenceX0 in WordPress Plugin SAML SP Single Sign On versions = 5.4.3...

WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by etomixer in WordPress Plugin Mang Board WP versions = 2.3.4...

WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Taylsec in WordPress Plugin WPMobile.App versions = 11.77...

WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Service Finder Booking versions = 6.2...

WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jamaal ahmed in WordPress Plugin Service Finder Booking versions = 6.2...

WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Do Lasso versions = 358...

WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability

Path Traversal vulnerability discovered by luc in WordPress Plugin Do Lasso versions = 358...

WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability

SQL Injection vulnerability discovered by luc in WordPress Plugin Do Lasso versions = 358...

WordPress Eventin plugin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint vulnerability

Unauthenticated Account Creation via Waiting List Endpoint vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress KiviCare plugin < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability

Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.2...

WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by luc in WordPress Plugin Do Lasso versions = 358...

WordPress Eventin plugin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR vulnerability

Contributor+ Order Information Disclosure via IDOR vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress Eventin plugin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API vulnerability

Contributor+ Customer PII Disclosure via REST API vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress LearnPress plugin < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant vulnerability

Subscriber+ Sensitive Information Exposure via AI Assistant vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin LearnPress versions 4.4.4...

WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme theme <= 2.5 - Cross Site Scripting (XSS) vulnerability

WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme theme = 2.5 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Samex - Clean, Minimal Shop WooCommerce WordPress Theme versions = 2.5...

WordPress tourmaster plugin < 5.4.8 - Stored XSS vulnerability

Stored XSS vulnerability discovered by ? in WordPress Plugin Tourmaster versions 5.4.8...

WordPress WP Photo Album Plus plugin < 9.2.04.003 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Photo Album Plus versions 9.2.04.003...

WordPress CubeWP Framework plugin <= 1.1.30 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Louis Deschanel JeanJeanLeHaxor, Pascal SUN in WordPress Plugin CubeWP versions = 1.1.30...

WordPress Core <= 7.0.3 - Authenticated (Author+) File Type Confusion to Remote Code Execution vulnerability

Authenticated Author+ File Type Confusion to Remote Code Execution vulnerability discovered by pwn.ai in WordPress core versions = 7.0.3...

WordPress M.Anh theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme M.Anh versions = 1.7...

WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin GiveWP versions 4.16.6...

WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Lee chul woong in WordPress Plugin Revolut Gateway for WooCommerce versions 4.22.10...

WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by V1t in WordPress Plugin Secure Card Gateway for ePay Paycenter Piraeus Bank versions = 1.0.32...

WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Asim Alshaya in WordPress Plugin Headless Single Sign On versions = 1.6...

WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Asim Alshaya in WordPress Plugin Headless Single Sign On versions = 1.6...

WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Taylsec in WordPress Plugin Web Directory Free versions = 1.7.13...

WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Phat RiO in WordPress Plugin Car Rental Manager versions = 1.3.9...

WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin GiveWP versions 4.16.6...

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by tomcat102 in WordPress Plugin OAuth Single Sign On – SSO OAuth Client versions = 7.0.0...

WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MailChimp For WooCommerce versions 6.2...

WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Data Access versions = 5.5.79...

WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Minhyeok Lee in WordPress Plugin Business Directory versions = 6.4.25...

WordPress Maspik – Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Maspik – Spam blacklist versions = 2.9.1...

WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Booktics versions 1.0.22...

WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Jayant Kamble in WordPress Plugin WP Directory Kit versions = 1.5.4...

WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Featured Image from URL versions = 5.3.3...

WordPress Ninja Tables Pro plugin 5.2.11 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Ninja Tables Pro versions 5.2.11...

WordPress Fluent Forms Pro Add On Pack plugin 6.2.7 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Fluent Forms Pro Add On Pack versions 6.2.7...

WordPress Formidable Digital Signatures plugin <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field vulnerability

Unauthenticated Arbitrary File Deletion via Signature Field vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin Formidable Digital Signatures versions = 3.0.6...

WordPress Social Login, Passkeys, Magic Link & Email OTP - Passwordless Login by VentraConnect plugin <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback vulnerability

WordPress Social Login, Passkeys, Magic Link & Email OTP - Passwordless Login by VentraConnect plugin = 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback vulnerability discovered by Civitasmass in WordPress Plugin Passwordless Login by VentraConnect versions = 1.4.3...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token vulnerability

Authenticated Subscriber+ Arbitrary Password Reset via Encrypted Object Token vulnerability discovered by daroo in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.9...

WordPress Ray Enterprise Translation plugin <= 1.7.3 - Subscriber+ Language Addition and Deletion vulnerability

Subscriber+ Language Addition and Deletion vulnerability discovered by Akshat Parikh in WordPress Plugin Ray Enterprise Translation versions = 1.7.3...

WordPress GeoDirectory plugin <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via 'posttype' Parameter via Query-String Bypass in geodirsavepost + geodirdeleterevision vulnerability discovered by mak3bread in WordPress Plugin GeoDirectory versions = 2.8.169...