NPM: Electron: window.open features string controls some window options considered privileged

NPM: Electron: window.open features string controls some window options considered privileged vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

NPM: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session vulnerability discovered by ? in WordPress Npm electron versions = 40.0.0-alpha.1, 40.10.6...

NPM: Electron: HTTP redirect followed into local file loader

NPM: Electron: HTTP redirect followed into local file loader vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

NPM: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

NPM: Electron: Extension tab APIs operate across session boundaries

NPM: Electron: Extension tab APIs operate across session boundaries vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: shell.openPath path validation bypass via embedded null byte

NPM: Electron: shell.openPath path validation bypass via embedded null byte vulnerability discovered by ? in WordPress Npm electron versions 39.8.6...

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...

NPM: Electron: Cross-origin iframe can position native autofill popup

NPM: Electron: Cross-origin iframe can position native autofill popup vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin

NPM: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin vulnerability discovered by ? in WordPress Npm electron versions 39.8.7...

NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size

NPM: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size vulnerability discovered by ? in WordPress Npm electron versions 39.8.10...

NPM: Electron: Parent process code-sign check is spoofable

NPM: Electron: Parent process code-sign check is spoofable vulnerability discovered by ? in WordPress Npm electron versions 39.8.8...

NPM: Ghost Content API filter bypass reveals private fields

NPM: Ghost Content API filter bypass reveals private fields vulnerability discovered by ? in WordPress Npm ghost versions = 5.46.1, 6.21.2...

NPM: Ghost: Cross-Site Scripting in Feature Image Captions

NPM: Ghost: Cross-Site Scripting in Feature Image Captions vulnerability discovered by ? in WordPress Npm ghost versions = 4.9.0, 6.54.1...

NPM: Ghost: Server-Side Request Forgery Mitigation Issue

NPM: Ghost: Server-Side Request Forgery Mitigation Issue vulnerability discovered by ? in WordPress Npm ghost versions = 6.26.0, 6.54.1...

WordPress Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin <= 6.11.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Instagram Feed versions = 6.11.3...

WordPress Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin <=5.0.2-<=5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation vulnerability

Missing Authorization to Authenticated Vendor+ Privilege Escalation vulnerability discovered by kai63001 in WordPress Plugin Dokan versions =5.0.2-=5.0.2...

WordPress Points and Rewards for WooCommerce plugin < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation vulnerability

Unauthenticated Arbitrary User Wallet & Points Manipulation vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin Points and Rewards for WooCommerce versions 2.10.1...

WordPress VikRentItems Flexible Rental Management System plugin <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nthng in WordPress Plugin VikRentItems Flexible Rental Management System versions = 1.2.1...

WordPress Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Views versions = 3.9.1...

WordPress Udimi Tools plugin <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Configuration Reset vulnerability discovered by Legion Hunter in WordPress Plugin Udimi Tools versions = 3.2...

WordPress Layouts for WPBakery plugin <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation vulnerability

Missing Authorization to Unauthenticated Template Cache Manipulation vulnerability discovered by murd0ck, Patricio Briones CyberDoomer in WordPress Plugin Layouts for WPBakery versions = 1.1.3...

WordPress Seraphinite Accelerator plugin <= 2.29.18 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Alireza in WordPress Plugin Seraphinite Accelerator versions = 2.29.18...

WordPress WP Travel Engine plugin < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update vulnerability

Unauthenticated Trip Difficulty Level Option Update vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Travel Engine versions 6.8.2...

WordPress Frontend Admin by DynamiApps plugin < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion vulnerability

Subscriber+ Taxonomy Term Creation/Modification/Deletion vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Frontend Admin by DynamiApps versions 3.29.7...

WordPress Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin <= 6.2.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin FluentForm versions = 6.2.8...

WordPress WP Real IP-based Access Control plugin <= 1.3.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Abaid Ur Rehman in WordPress Plugin WP Real IP-based Access Control versions = 1.3.1...

WordPress Responsive Thumbnail Slider plugin < 1.1.53 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Thumbnail carousel slider versions 1.1.53...

WordPress MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by she11f in WordPress Plugin MailChimp Subscribe Forms versions = 4.3.3...

WordPress Netroics Blog Posts Grid plugin <= 1.0 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by saitamang, syad, yunaranyancat in WordPress Plugin Netroics Blog Posts Grid versions = 1.0...

WordPress Subscriptions for WooCommerce plugin <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation vulnerability

Authenticated Contributor+ Privilege Escalation vulnerability discovered by Wordfence PRISM in WordPress Plugin Subscriptions for WooCommerce versions = 2.0.0...

WordPress Easy Property Listings plugin <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Easy Property Listings versions = 3.5.24...

WordPress Download Manager plugin < 3.3.66 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Download Manager versions 3.3.66...

WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin < 5.0.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by João Ramos Maciel in WordPress Plugin Dynamic Pricing With Discount Rules for WooCommerce versions 5.0.0...

WordPress Material Dashboard plugin <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability

Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Material Dashboard versions = 1.4.10...

WordPress WPFormify – Stripe Payments with Form and Checkout plugin <= 1.1.1 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Legion Hunter in WordPress Plugin WPFormify – Stripe Payments with Form and Checkout versions = 1.1.1...

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.19 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.19...

WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Media Deletion vulnerability discovered by Riski Gana Prasetya in WordPress Plugin Multi Uploader for Gravity Forms versions = 1.1.8...

WordPress WP Activity Log Premium plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Levon Balyan in WordPress Plugin WP Activity Log Premium versions = 5.6.4...

WordPress Database Collation Fix plugin <= 1.2.10 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Nabil Irawan in WordPress Plugin Database Collation Fix versions = 1.2.10...

WordPress User Access Manager plugin <= 2.3.15 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Supakiad S. m3ez in WordPress Plugin User Access Manager versions = 2.3.15...

WordPress Participants Database plugin < 2.7.8.4 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by João Ramos Maciel in WordPress Plugin Participants Database versions 2.7.8.4...

WordPress Direct Payments for WooCommerce plugin < 2.5.3 - Unauthenticated Cross-Customer Order Tampering vulnerability

Unauthenticated Cross-Customer Order Tampering vulnerability discovered by Pedro Pinho in WordPress Plugin Direct Payments for WooCommerce versions 2.5.3...

WordPress Contact Form Extender for Divi – Submissions DB & Extra Fields plugin <= 1.0.6 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by KEVIN LEE crattack in WordPress Plugin Contact Form Extender for Divi Save Entries, File Upload & Country Code Field versions = 1.0.6...

WordPress Pronamic Pay plugin <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Afan, moonge in WordPress Plugin Pronamic Pay versions = 10.1.0...

WordPress Kali Forms — Contact Form & Drag-and-Drop Builder plugin <= 2.4.20 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Wordfence PRISM in WordPress Plugin Kali Forms versions = 2.4.20...

WordPress Ultimate Member plugin < 2.12.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Haitam Lazaar in WordPress Plugin Ultimate Member versions 2.12.1...

WordPress Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin <= 2.9.0 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by daroo in WordPress Plugin Bit Integrations versions = 2.9.0...

WordPress CubeWP Framework plugin <= 1.1.30 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Nhien Pham nhienit in WordPress Plugin CubeWP versions = 1.1.30...

WordPress WooCommerce - Social Login plugin <= 2.8.7 - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass vulnerability

WordPress WooCommerce - Social Login plugin = 2.8.7 - Social Login = 2.8.7 - Unauthenticated Authentication Bypass vulnerability discovered by Rafie Muhammad in WordPress Plugin WooCommerce Social Login versions = 2.8.7...