52703 matches found
WordPress Points and Rewards for WooCommerce plugin < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation vulnerability
Unauthenticated Arbitrary User Wallet & Points Manipulation vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin Points and Rewards for WooCommerce versions 2.10.1...
WordPress VikRentItems Flexible Rental Management System plugin <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin VikRentItems Flexible Rental Management System versions = 1.2.1...
WordPress Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability
Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Views versions = 3.9.1...
WordPress Udimi Tools plugin <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset vulnerability
Missing Authorization to Authenticated Subscriber+ Plugin Configuration Reset vulnerability discovered by Legion Hunter in WordPress Plugin Udimi Tools versions = 3.2...
WordPress Layouts for WPBakery plugin <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation vulnerability
Missing Authorization to Unauthenticated Template Cache Manipulation vulnerability discovered by murd0ck, Patricio Briones CyberDoomer in WordPress Plugin Layouts for WPBakery versions = 1.1.3...
WordPress Seraphinite Accelerator plugin <= 2.29.18 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Alireza in WordPress Plugin Seraphinite Accelerator versions = 2.29.18...
WordPress WP Travel Engine plugin < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update vulnerability
Unauthenticated Trip Difficulty Level Option Update vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Travel Engine versions 6.8.2...
WordPress Frontend Admin by DynamiApps plugin < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion vulnerability
Subscriber+ Taxonomy Term Creation/Modification/Deletion vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Frontend Admin by DynamiApps versions 3.29.7...
WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
Privilege Escalation vulnerability discovered by XBumbbleB33 in WordPress Plugin PublishPress Capabilities versions = 2.45.0...
WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Popup Maker versions = 1.23.0...
WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.8 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin FluentForm versions = 6.2.8...
WordPress WP Real IP-based Access Control plugin <= 1.3.1 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Abaid Ur Rehman in WordPress Plugin WP Real IP-based Access Control versions = 1.3.1...
WordPress Responsive Thumbnail Slider plugin < 1.1.53 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Thumbnail carousel slider versions 1.1.53...
WordPress MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by she11f in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...
WordPress Netroics Blog Posts Grid plugin <= 1.0 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability
Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by saitamang, syad, yunaranyancat in WordPress Plugin Netroics Blog Posts Grid versions = 1.0...
WordPress Subscriptions for WooCommerce plugin <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation vulnerability
Authenticated Contributor+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin Subscriptions for WooCommerce versions = 2.0.0...
WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability
Arbitrary File Upload vulnerability discovered by Bonds in WordPress Plugin Type Hub versions = 2.0.6...
WordPress Easy Property Listings plugin <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Easy Property Listings versions = 3.5.24...
WordPress Download Manager plugin < 3.3.66 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Download Manager versions 3.3.66...
WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin < 5.0.0 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by João Ramos Maciel in WordPress Plugin Dynamic Pricing With Discount Rules for WooCommerce versions 5.0.0...
WordPress Material Dashboard plugin <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability
Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Material Dashboard versions = 1.4.10...
WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Mercado Pago payments for WooCommerce versions = 8.9.0...
WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FiboSearch versions = 1.33.0...
WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Powerkit versions = 3.1.0...
WordPress WPFormify – Stripe Payments with Form and Checkout plugin <= 1.1.1 - Missing Authorization vulnerability
Missing Authorization vulnerability discovered by Legion Hunter in WordPress Plugin WPFormify – Stripe Payments with Form and Checkout versions = 1.1.1...
WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by timomangcut in WordPress Plugin Tracking Code Manager versions = 2.6.0...
WordPress VikAppointments Services Booking Calendar plugin <= 1.2.19 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.19...
WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Que Thanh Tuan in WordPress Plugin YITH WooCommerce Zoom Magnifier versions = 2.52.0...
WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability
Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...
WordPress Multi Uploader for Gravity Forms plugin <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability
Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability discovered by Riski Gana Prasetya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.8...
WordPress WP Activity Log Premium plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Levon Balyan in WordPress Plugin WP Activity Log Premium versions = 5.6.4...
WordPress Database Collation Fix plugin <= 1.2.10 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Nabil Irawan in WordPress Plugin Database Collation Fix versions = 1.2.10...
WordPress User Access Manager plugin <= 2.3.15 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Supakiad S. m3ez in WordPress Plugin User Access Manager versions = 2.3.15...
WordPress Participants Database plugin < 2.7.8.4 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by João Ramos Maciel in WordPress Plugin Participants Database versions 2.7.8.4...
WordPress Direct Payments for WooCommerce plugin < 2.5.3 - Unauthenticated Cross-Customer Order Tampering vulnerability
Unauthenticated Cross-Customer Order Tampering vulnerability discovered by Pedro Pinho in WordPress Plugin Direct Payments for WooCommerce versions 2.5.3...
WordPress Contact Form Extender for Divi – Submissions DB & Extra Fields plugin <= 1.0.6 - Unauthenticated Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion vulnerability discovered by KEVIN LEE crattack in WordPress Plugin Contact Form Extender for Divi Save Entries, File Upload & Country Code Field versions = 1.0.6...
WordPress Pronamic Pay plugin <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability
Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Afan, moonge in WordPress Plugin Pronamic Pay versions = 10.1.0...
WordPress Kali Forms — Contact Form & Drag-and-Drop Builder plugin <= 2.4.20 - Unauthenticated Remote Code Execution vulnerability
Unauthenticated Remote Code Execution vulnerability discovered by Wordfence PRISM in WordPress Plugin Kali Forms versions = 2.4.20...
WordPress Ultimate Member plugin < 2.12.1 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Haitam Lazaar in WordPress Plugin Ultimate Member versions 2.12.1...
WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.9.0 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by daroo in WordPress Plugin Bit Integrations versions = 2.9.0...
WordPress CubeWP Framework plugin <= 1.1.30 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Nhien Pham nhienit in WordPress Plugin CubeWP versions = 1.1.30...
WordPress WooCommerce - Social Login plugin <= 2.8.7 - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass vulnerability
WordPress WooCommerce - Social Login plugin = 2.8.7 - Social Login = 2.8.7 - Unauthenticated Authentication Bypass vulnerability discovered by Rafie Muhammad in WordPress Plugin WooCommerce Social Login versions = 2.8.7...
WordPress Single Sign On For TNG plugin <= 2.0.0 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by andrea bocchetti in WordPress Plugin Single Sign On For TNG versions = 2.0.0...
WordPress FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin <= 1.9.2 - FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion vulnerability
FormGent = 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin FormGent versions = 1.9.2...
WordPress MultiVendorX plugin < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion vulnerability
Store Owner+ Cross-Vendor Store Takeover and Deletion vulnerability discovered by Pedro Pinho in WordPress Plugin MultiVendorX versions 5.0.11...
WordPress Passster plugin < 4.3.6 - Unauthenticated Protected Content Disclosure vulnerability
Unauthenticated Protected Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...
NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature
NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature vulnerability discovered by ? in WordPress Npm ghost versions = 6.27.0, 6.44.0...
NPM: Ghost: Member existence leak via magic link sign-in response
NPM: Ghost: Member existence leak via magic link sign-in response vulnerability discovered by ? in WordPress Npm ghost versions = 5.18.0, 6.21.1...