drp-coupon <= 2.1 - XSS in ZeroClipboard

The drp-coupon WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

bp-code-snippets <= 2.0 - XSS in ZeroClipboard

The bp-code-snippets WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

WP Clone by WP Academy <= 2.1.1 - XSS in ZeroClipboard

The Clone WordPress plugin was affected by a XSS in ZeroClipboard security vulnerability...

RLSWordPressSearch - register.php agentid Parameter SQL Injection

The RLSWordPressSearch WordPress plugin was affected by a register.php agentid Parameter SQL Injection security vulnerability...

Gallery - "load" Remote File Inclusion

The wordpress-gallery WordPress plugin was affected by a "load" Remote File Inclusion security vulnerability...

Vitamin 1.0 - minify.php path Parameter Traversal Arbitrary File Access

The vitamin WordPress plugin was affected by a minify.php path Parameter Traversal Arbitrary File Access security vulnerability...

WP-PostViews 1.62 - Setting Manipulation CSRF

The WP-PostViews WordPress plugin was affected by a Setting Manipulation CSRF security vulnerability...

WooCommerce 2.0.12 - index.php calc_shipping_state Parameter XSS

The WooCommerce WordPress plugin was affected by an index.php calcshippingstate Parameter XSS security vulnerability...

WP Super Cache 1.3 - trunk/plugins/badbehaviour.php URI XSS

The WP Super Cache WordPress plugin was affected by a trunk/plugins/badbehaviour.php URI XSS security vulnerability...

Category Grid View Gallery 2.3.1 - CatGridPost.php ID Parameter XSS

The category-grid-view-gallery WordPress plugin was affected by a CatGridPost.php ID Parameter XSS security vulnerability...

Buddypress <= 1.9.1 - Stored Cross-Site Scripting (XSS)

The BuddyPress WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

LeagueManager 3.8 - SQL Injection

The LeagueManager WordPress plugin was affected by a SQL Injection security vulnerability...

RBX Gallery 2.1 - uploader.php File Upload PHP Code Execution

The rbxgallery WordPress plugin was affected by an uploader.php File Upload PHP Code Execution security vulnerability...

WordPress 2.0 - 3.0.1 Multiple Cross-Site Scripting (XSS) in request_filesystem_credentials()

...

adminimize 1.7.21 - 'page' Parameter Cross Site Scripting

The Adminimize WordPress plugin was affected by a 'page' Parameter Cross Site Scripting security vulnerability...

Sahifa 2.4.0 - Multiple Full Path Disclosure

The sahifa WordPress theme was affected by a Multiple Full Path Disclosure security vulnerability...

PictPress <= 0.91 - Remote File Disclosure

The pictpress WordPress plugin was affected by a Remote File Disclosure security vulnerability...

NextCellent Gallery < 1.9.18 - Multiple Stored XSS

The NextCellent Gallery – NextGEN Legacy WordPress plugin was affected by a Multiple Stored XSS security vulnerability...

WordPress 2.9 - Failure to Restrict URL Access

Description When WordPress implemented the new Trash feature they failed to change the permissions granted when the post is in the trash. This means that an unauthenticated user cannot see the post, however an authenticated user can, no matter what privileges they have, even ‘subscriber’. See...

Featured Comments 1.2.1 - wp-admin/admin-ajax.php Comment Status Manipulation CSRF

The Featured Comments WordPress plugin was affected by a wp-admin/admin-ajax.php Comment Status Manipulation CSRF security vulnerability...

Download Manager 0.2 - Arbitrary File Upload Exploit

The downloads-manager WordPress plugin was affected by an Arbitrary File Upload Exploit security vulnerability...

wpStoreCart 2.5.27-2.5.29 - Arbitrary File Upload

The wpstorecart WordPress plugin was affected by an Arbitrary File Upload security vulnerability...

plugin wordTube <= 1.43 - (wpPATH) RFI

The wordtube WordPress plugin was affected by a wpPATH RFI security vulnerability...

myLDlinker - SQL Injection

The myLinksDump WordPress plugin was affected by a SQL Injection security vulnerability...

R&om Banner 1.1.2.1 - Cross-Site Scripting (XSS)

The Random Banner WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Easy Career Opening <= 0.4 - Cross-Site Scripting (XSS)

The last time it was checked the plugin was still affected and had been closed...

TinyMCE Color Picker 1.1 - tinymce-colorpicker.php Missing edit_others_posts Capability Check

The TinyMCE Color Picker WordPress plugin was affected by a tinymce-colorpicker.php Missing editothersposts Capability Check security vulnerability...

Ooorl <= 1.0.0 - XSS

Plugin is still affected and has been closed...

Backupbuddy - importbuddy.php Direct Request Remote Backup File Disclosure

The backupbuddy WordPress plugin was affected by an importbuddy.php Direct Request Remote Backup File Disclosure security vulnerability...

Survey And Quiz Tool <= 2.9.2 - Cross Site Scripting

The wp-survey-and-quiz-tool WordPress plugin was affected by a Cross Site Scripting security vulnerability...

AllWebMenus 1.1.3 - Remote File Inclusion

The AllWebMenus WordPress Menu Plugin WordPress plugin was affected by a Remote File Inclusion security vulnerability...

Google Analyticator < 5.2.1 - XSS

The Google Analyticator WordPress plugin was affected by a XSS security vulnerability...

WordPress 0.7 - SQL Injection

...

WP < 7.0.3 - Unauthenticated Blind SSRF

Description WordPress does not block requests to all reserved and internal IP address ranges, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services a blind Server-Side Request Forgery...

3D viewer – Embed 3D Models < 1.8.6 - Missing Authorization

Description The 3D viewer – Embed 3D Models plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.8.5. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an...

1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload

Description The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'startrestore' function in all versions up to, and including, 2.2. This makes it possible for...

PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render

Description The PDF Viewer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the render function in all versions up to, and including, 2.9.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Simple Sitemap < 3.5.14 - Cross-Site Request Forgery via admin_notices

Description The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the 'adminnotices' hook found in class-settings.php. This makes ...

Rife Free < 2.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Rife Free theme for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-leve...

ElasticPress < 5.1.2 - Data Sync via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the dosync function. This makes it possible for unauthenticated attackers to sync data via a forged request granted they can trick a site administrator into performing an action such...

BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness

Description The BuddyForms plugin for WordPress is vulnerable to Email Verification Bypass in all versions up to, and including, 2.8.9 via the use of an insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification...

Rank Math SEO < 1.0.219 - Authenticated Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow users with access to the General Settings by default admin, however such access can be given to lower roles via the Role Manager feature of the plugin to perform Stored Cross-Site Scripting attacks even wh...

Save as PDF Plugin by Pdfcrowd < 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

Simple COD Fees for WooCommerce <= 2.0.2 - Missing Authorization

Description The Simple COD Fees for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Update

Description The Login/Signup Popup Inline Form + Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'importsettings' function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with...

Colibri Page Builder < 1.0.277 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Cowidgets – Elementor Addons <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion

Description The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1 via the 'itemstyle' and 'style' parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to include a...

Themesflat Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags

Description The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widget tags in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Easy Digital Downloads – Recent Purchases <= 1.0.2 - Unauthenticated Remote File Inclusion

Description The Easy Digital Downloads – Recent Purchases plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 1.0.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files hosted on external server,s allowing the...

LearnPress – WordPress LMS Plugin < 4.2.6.8.1 - Basic Information Disclosure via JSON API

Description The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of getitemspermissionscheck function. This makes it possible for unauthenticated attackers to extrac...