47936 matches found
WordPress WP Real IP-based Access Control plugin <= 1.3.1 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Abaid Ur Rehman in WordPress Plugin WP Real IP-based Access Control versions = 1.3.1...
WordPress Responsive Thumbnail Slider plugin < 1.1.53 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Thumbnail carousel slider versions 1.1.53...
WordPress MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by she11f in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...
WordPress Netroics Blog Posts Grid plugin <= 1.0 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability
Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by saitamang, syad, yunaranyancat in WordPress Plugin Netroics Blog Posts Grid versions = 1.0...
WordPress Subscriptions for WooCommerce plugin <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation vulnerability
Authenticated Contributor+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin Subscriptions for WooCommerce versions = 2.0.0...
WordPress Easy Property Listings plugin <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Easy Property Listings versions = 3.5.24...
WordPress Download Manager plugin < 3.3.66 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Download Manager versions 3.3.66...
WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin < 5.0.0 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by João Ramos Maciel in WordPress Plugin Dynamic Pricing With Discount Rules for WooCommerce versions 5.0.0...
WordPress Material Dashboard plugin <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability
Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Material Dashboard versions = 1.4.10...
WordPress WPFormify – Stripe Payments with Form and Checkout plugin <= 1.1.1 - Missing Authorization vulnerability
Missing Authorization vulnerability discovered by Legion Hunter in WordPress Plugin WPFormify – Stripe Payments with Form and Checkout versions = 1.1.1...
WordPress VikAppointments Services Booking Calendar plugin <= 1.2.19 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.19...
WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability
Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...
WordPress Multi Uploader for Gravity Forms plugin <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability
Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability discovered by Riski Gana Prasetya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.8...
WordPress WP Activity Log Premium plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Levon Balyan in WordPress Plugin WP Activity Log Premium versions = 5.6.4...
WordPress Database Collation Fix plugin <= 1.2.10 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by Nabil Irawan in WordPress Plugin Database Collation Fix versions = 1.2.10...
WordPress User Access Manager plugin <= 2.3.15 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Supakiad S. m3ez in WordPress Plugin User Access Manager versions = 2.3.15...
WordPress Participants Database plugin < 2.7.8.4 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by João Ramos Maciel in WordPress Plugin Participants Database versions 2.7.8.4...
WordPress Direct Payments for WooCommerce plugin < 2.5.3 - Unauthenticated Cross-Customer Order Tampering vulnerability
Unauthenticated Cross-Customer Order Tampering vulnerability discovered by Pedro Pinho in WordPress Plugin Direct Payments for WooCommerce versions 2.5.3...
WordPress Contact Form Extender for Divi – Submissions DB & Extra Fields plugin <= 1.0.6 - Unauthenticated Arbitrary File Deletion vulnerability
Unauthenticated Arbitrary File Deletion vulnerability discovered by KEVIN LEE crattack in WordPress Plugin Contact Form Extender for Divi Save Entries, File Upload & Country Code Field versions = 1.0.6...
WordPress Pronamic Pay plugin <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability
Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Afan, moonge in WordPress Plugin Pronamic Pay versions = 10.1.0...
WordPress Kali Forms — Contact Form & Drag-and-Drop Builder plugin <= 2.4.20 - Unauthenticated Remote Code Execution vulnerability
Unauthenticated Remote Code Execution vulnerability discovered by Wordfence PRISM in WordPress Plugin Kali Forms versions = 2.4.20...
WordPress Ultimate Member plugin < 2.12.1 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Haitam Lazaar in WordPress Plugin Ultimate Member versions 2.12.1...
WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.9.0 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by daroo in WordPress Plugin Bit Integrations versions = 2.9.0...
WordPress CubeWP Framework plugin <= 1.1.30 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Nhien Pham nhienit in WordPress Plugin CubeWP versions = 1.1.30...
WordPress WooCommerce - Social Login plugin <= 2.8.7 - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass vulnerability
WordPress WooCommerce - Social Login plugin = 2.8.7 - Social Login = 2.8.7 - Unauthenticated Authentication Bypass vulnerability discovered by Rafie Muhammad in WordPress Plugin WooCommerce Social Login versions = 2.8.7...
WordPress Single Sign On For TNG plugin <= 2.0.0 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by andrea bocchetti in WordPress Plugin Single Sign On For TNG versions = 2.0.0...
WordPress FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin <= 1.9.2 - FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion vulnerability
FormGent = 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin FormGent versions = 1.9.2...
NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature
NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature vulnerability discovered by ? in WordPress Npm ghost versions = 6.27.0, 6.44.0...
NPM: Ghost: Member existence leak via magic link sign-in response
NPM: Ghost: Member existence leak via magic link sign-in response vulnerability discovered by ? in WordPress Npm ghost versions = 5.18.0, 6.21.1...
NPM: Ghost: Session Fixation in Ghost Admin
NPM: Ghost: Session Fixation in Ghost Admin vulnerability discovered by ? in WordPress Npm ghost versions = 2.2.0, 6.54.1...
NPM: Ghost: Theme Upload Path Traversal
NPM: Ghost: Theme Upload Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...
NPM: Ghost: Database Backup Path Traversal
NPM: Ghost: Database Backup Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 1.20.1, 6.54.1...
NPM: Ghost: Server-Side Request Forgery in Image Fetching
NPM: Ghost: Server-Side Request Forgery in Image Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...
NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API
NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions 6.54.1...
NPM: Ghost: Mobiledoc image-size fetch SSRF
NPM: Ghost: Mobiledoc image-size fetch SSRF vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...
NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling
NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, 6.21.1...
NPM: Ghost: Private IP filtering bypass to make server-side requests to internal services
NPM: Ghost: Private IP filtering bypass to make server-side requests to internal services vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, = 6.21.0...
NPM: Ghost: Archived Offers can be Redeemed
NPM: Ghost: Archived Offers can be Redeemed vulnerability discovered by ? in WordPress Npm ghost versions = 4.22.0, 6.54.1...
NPM: Ghost: File Upload Content-Type Spoofing
NPM: Ghost: File Upload Content-Type Spoofing vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...
NPM: Ghost: Cross-Site Scripting in Universal Import
NPM: Ghost: Cross-Site Scripting in Universal Import vulnerability discovered by ? in WordPress Npm ghost versions = 5.26.0, 6.54.1...
NPM: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
NPM: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
NPM: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
NPM: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.3...
NPM: Flowise: Missing Authorization on Execution Update Endpoint
NPM: Flowise: Missing Authorization on Execution Update Endpoint vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution vulnerability
Authenticated Administrator+ Arbitrary Function Execution vulnerability discovered by Itthidej Aramsri Boeing777, Waris Damkham, Teerachai Somprasong in WordPress Plugin ShopLentor versions = 3.3.7...
WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.5.2 - Insecure Direct Object Reference vulnerability
Insecure Direct Object Reference vulnerability discovered by Lucius-log in WordPress Plugin Groundhogg versions = 4.5.2...
WordPress DTX – Dynamic Text Extension for Contact Form 7 plugin <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability
Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by SATYARTH PRAKASH XoxoL33t in WordPress Plugin Contact Form 7 – Dynamic Text Extension versions = 5.0.5...