Form Maker by 10Web < 1.13.5 - Cross-Site Request Forgery (CSRF) to LFI

Form Maker by WD plugin suffers from a CSRF issue that could lead to an LFI attack...

article2pdf - Multiple Vulnerabilities

The article2pdf WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

Import users from CSV with meta <= 1.14.0.2 - XSS and CSRF

The Import and export users and customers WordPress plugin was affected by a XSS and CSRF security vulnerability...

WP Live Chat Support < 8.0.18 - Cross-Site Scripting (XSS)

The 3CX Live Chat WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WordPress <= 5.0 - Cross-Site Scripting (XSS) that could affect plugins

Description According to WordPress: "Tim Coen also discovered that specially crafted URL inputs could lead to a cross-site scripting vulnerability in some circumstances. WordPress itself was not affected, but plugins could be in some situations."...

Booking Calendar <= 2.2.2 - Parameters Tampering Allowing Arbitrary Prices Change

Note: It is unclear whether or not this issue has been remediated...

Tagregator <= 0.6 - Stored XSS

The Tagregator WordPress plugin was affected by a Stored XSS security vulnerability...

Form Maker by WD < 1.12.24 - CSV Injection

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin was affected by a CSV Injection security vulnerability...

WordPress File Upload <= 4.3.3 - Cross-Site Scripting (XSS)

The WordPress File Upload WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Newsletters Lite < 4.6.8.6 - PHP Object Injection

The Newsletters WordPress plugin was affected by a PHP Object Injection security vulnerability...

Ninja Forms < 3.2.15 - Parameter Tampering

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Parameter Tampering security vulnerability...

PropertyHive <= 1.4.14 - Cross-Site Scripting (XSS)

The PropertyHive WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Soundy Background Music <= 3.9 - Cross-Site Scripting (XSS)

The last time it was checked the plugin was still affected and had been closed...

Social Media Widget by Acurax <= 3.2.5 - Stored XSS & CSRF

The Social Media Widget by Acurax WordPress plugin was affected by a Stored XSS & CSRF security vulnerability...

Smart Google Code Inserter <= 3.4 - Unauthenticated Cross-Site Scripting (XSS)

The Smart Google Code Inserter WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability...

WordPress 4.4-4.8.1 - Path Traversal in Customizer

Description A path traversal vulnerability was discovered in the customizer. Reported by Weston Ruter of the WordPress Security Team...

Responsive Image Gallery, Gallery Album <= 1.2.0 - Authenticated SQL Injection

The Responsive Image Gallery, Gallery Album WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...

BackupGuard < 1.1.47 - Authenticated Cross-Site Scripting (XSS)

The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

Updraftplus < 1.13.5 - XSS

The UpdraftPlus WordPress Backup Plugin WordPress plugin was affected by a XSS security vulnerability...

Download Manager <= 2.9.50 - Open Redirect

The WordPress Download Manager WordPress plugin was affected by an Open Redirect security vulnerability...

Shortcodes Ultimate <= 4.9.9 - Authenticated Directory Traversal

The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin was affected by an Authenticated Directory Traversal security vulnerability...

WP Jobs <= 1.4 - Authenticated SQL Injection

The WP Jobs WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...

WordPress 3.4.0-4.7.4 - Customizer XSS & CSRF

...

Nelio Ab Testing < 4.6.4 - CSRF

The Nelio AB Testing WordPress plugin was affected by a CSRF security vulnerability...

Calendar by WD <= 1.5.51 - Authenticated Blind SQL Injection

The SpiderCalendar WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...

Invite Anyone <= 1.3.14 - Change of Email Invitation Content

The Invite Anyone WordPress plugin was affected by a Change of Email Invitation Content security vulnerability...

Membership Simplified <= 1.58 - Unauthenticated Arbitrary File Download

The plugin is still affected and has been closed...

Dtracker <= 1.5 - Unauthorised Contract Creation

Plugin is still affected and has been closed...

Wp2android 1.1.4 - Unauthenticated File Upload

Plugin is still affected and has been closed...

Kama Click Counter <= 3.4.9 - Authenticated Blind SQL Injection

The Kama Click Counter WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=kama-clic-counterby=linkname=ASC%2cselectfromselectsleep30a=1...

Democracy Poll < 5.4 - CSRF & XSS

The Democracy Poll WordPress plugin was affected by a CSRF & XSS security vulnerability...

Time Sheets < 1.5.2 - Multiple XSS

The Time Sheets WordPress plugin was affected by a Multiple XSS security vulnerability...

Neosense Theme < 1.8 - Unrestricted File Upload

Neosense is a commercial WordPress theme by dynamicpress. Version 1.7 and possibly earlier includes in its theme directory a copy of the "qquploader" ajax file uploader, which does not verify user authorization. Using this uploader, an attacker can upload any file to the site. The uploaded file i...

Total Security < 3.4.1 - XSS & Settings Change

The Total Security WordPress plugin was affected by a XSS & Settings Change security vulnerability...

Activity Log <= 2.3.1 - Stored Cross-Site Scripting (XSS)

The Activity Log WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

PeepSo <= 1.6.0 - Authenticated Privilege Escalation

Unfiltered input allows a logged in user to escalate their permissions to that of an Administrator...

WordPress 3.6-4.5.2 - Authenticated Revision History Information Disclosure

...

Echosign <= 1.1 - Reflected Cross-Site Scripting (XSS)

The Echo Sign WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

WPSOLR <= 8.6 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The WPSOLR - Elasticsearch and Solr search WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC...

GoCodes <= 1.3.5 - Authenticated XSS & Blind SQL Injection

The gocodes WordPress plugin was affected by an Authenticated XSS & Blind SQL Injection security vulnerability...

404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection

Description The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...

Payment Form for PayPal Pro <= 1.0.1 - Multiple Reflected Cross-Site Scripting (XSS)

The Payment Form for PayPal Pro WordPress plugin was affected by a Multiple Reflected Cross-Site Scripting XSS security vulnerability...

CP Reservation Calendar <= 1.1.6 - Unauthenticated SQL Injection

The CP Reservation Calendar WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...

Postmatic <= 1.4.5 - Cross-Site Scripting (XSS)

The Replyable – Subscribe to Comments and Reply by Email WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Anti-Spam by CleanTalk < 5.22 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...

Googmonify <= 0.5.1 - CSRF & XSS

The Googmonify WordPress plugin was affected by a CSRF & XSS security vulnerability...

Ultimate Member < 1.3.18 - Cross-Site Scripting (XSS)

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

NEX-Forms <= 4.0 - Unauthenticated Blind SQL Injection

The NEX-Forms – Ultimate Form Builder – Contact forms and much more WordPress plugin was affected by an Unauthenticated Blind SQL Injection security vulnerability...

ZoomSounds <= 2.0 - Remote File Upload

The dzs-zoomsounds WordPress plugin was affected by a Remote File Upload security vulnerability...

WP Smiley <= 1.4.1 - CSRF & Cross-Site Scripting (XSS)

Cross-Site scripting XSS in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php...