LeagueManager 3.8 - SQL Injection

The LeagueManager WordPress plugin was affected by a SQL Injection security vulnerability...

RBX Gallery 2.1 - uploader.php File Upload PHP Code Execution

The rbxgallery WordPress plugin was affected by an uploader.php File Upload PHP Code Execution security vulnerability...

VideoWhisper Live Streaming Integration <= 4.25.3 - Cross-Site Scripting (XSS)

The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WordPress 1.5 template-functions-post.php Multiple Field XSS

...

WordPress 2.0 - 3.0.1 Multiple Cross-Site Scripting (XSS) in request_filesystem_credentials()

...

PictPress <= 0.91 - Remote File Disclosure

The pictpress WordPress plugin was affected by a Remote File Disclosure security vulnerability...

Sahifa 2.4.0 - Multiple Full Path Disclosure

The sahifa WordPress theme was affected by a Multiple Full Path Disclosure security vulnerability...

Wordpress 2.5 - Cookie Integrity Protection

...

Wordpress <= 1.5.1.3 - Remote Code Execution

...

R&om Banner 1.1.2.1 - Cross-Site Scripting (XSS)

The Random Banner WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

WP Tmkm Amazon <= 1.5b - XSS

The wp-tmkm-amazon WordPress plugin was affected by a XSS security vulnerability...

Oleggo Livestream <= 0.2.6 - XSS

Plugin is still affected and has been closed...

TinyMCE Color Picker 1.1 - tinymce-colorpicker.php Missing edit_others_posts Capability Check

The TinyMCE Color Picker WordPress plugin was affected by a tinymce-colorpicker.php Missing editothersposts Capability Check security vulnerability...

Ooorl <= 1.0.0 - XSS

Plugin is still affected and has been closed...

Pay Per Media Player <= 1.24 - Multiple XSS

Plugin is still affected and has been closed...

WP e-Commerce Swipe <= 3.1.0 - Multiple XSS Issues

The last time it was checked the plugin was still affected and had been closed. PoC...

Nextend Facebook Connect <= 1.4.59 - Cross-Site Scripting (XSS)

The Nextend Social Login and Register WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Media File Renamer <= 1.7.0 - Stored Cross-Site Scripting (XSS)

The Media File Renamer – Auto & Manual Rename WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

FormCraft - form.php id Parameter SQL Injection

The formcraft WordPress plugin was affected by a form.php id Parameter SQL Injection security vulnerability...

Chat <= 1.0.8 - Cross-Site Scripting (XSS) in 'message' Parameter

The chat WordPress plugin was affected by a Cross-Site Scripting XSS in 'message' Parameter security vulnerability...

Backupbuddy - importbuddy.php Direct Request Remote Backup File Disclosure

The backupbuddy WordPress plugin was affected by an importbuddy.php Direct Request Remote Backup File Disclosure security vulnerability...

White Label CMS - Cross-Site Request Forgery

The White Label CMS WordPress plugin was affected by a Cross-Site Request Forgery security vulnerability...

Events Manager < 5.1.7 - Cross-Site Scripting (XSS)

The Events Manager WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Buddypress <= 1.5.4 - SQL Injection

The BuddyPress WordPress plugin was affected by a SQL Injection security vulnerability...

FCChat 2.2.11-2.2.13 - Upload.php Arbitrary File Upload

The FCChat Widget WordPress plugin was affected by an Upload.php Arbitrary File Upload security vulnerability...

Atahualpa < 3.6.8 - XSS

The Atahualpa WordPress theme was affected by a XSS security vulnerability...

Google Analyticator < 5.2.1 - XSS

The Google Analyticator WordPress plugin was affected by a XSS security vulnerability...

Dating <= 11.2.0 - Cross-Site Request Forgery

Description The Dating theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 11.2.0. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged...

WP < 6.8.3 - Contributor+ Sensitive Data Disclosure

Description WordPress is affected by a data exposure issue which could allow contributor and above roles to access some restricted content...

17TRACK for WooCommerce <= 1.2.10 - Reflected Cross-Site Scripting

Description The 17TRACK for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

3D Photo Gallery <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Description The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-leve...

1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation

Description The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancelactions function. This makes it possible...

12 Step Meeting List < 3.16.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion

Description The 12 Step Meeting List plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpajaxtsmldelete function in all versions up to, and including, 3.16.5. This makes it possible for authenticated attackers, with Contributor-level access a...

LatePoint <= 4.9.91 - Cross-Site Request Forgery

Description The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.9.91. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a...

MJ Update History <= 1.0.4 - Missing Authorization

Description The MJ Update History plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an...

Popup Builder – Create highly converting, mobile friendly marketing popups < 4.3.2 - Missing Authorization and Nonce Exposure

Description The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. While some functions contain a...

ElementsKit Elementor addons and Templates Library < 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets

Description The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode

Description The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the display function. This makes it possible for authenticated attackers, with contributor access and higher, to...

tagDiv Composer < 4.9 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta

Description The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'single' module in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

YITH WooCommerce Product Add-Ons < 4.9.3 - Unauthenticated Content Injection

Description The YITH WooCommerce Product Add-Ons plugin for WordPress is vulnerable to Content Injection in all versions up to, and including, 4.9.2. This is due to the plugin not properly validating a field that can be updated. This makes it possible for unauthenticated attackers to inject...

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) < 1.5.110 - Authenticated (Contributor+) Information Exposure

Description The Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.109 due to missing restrictions on the getPostDataByObj function. This makes it possible for authenticate...

ElementsKit PRO < 3.6.3 - Authenticated (Contributor+) Server-Side Request Forgery

Description The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.6.2 via the 'renderraw' function. This can allow authenticated attackers, with contributor-level permissions and above, to make web requests to arbitrary locations...

Kenta Blocks – Responsive Blocks and block templates library < 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Kenta Blocks – Responsive Blocks and block templates library plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

Himer - Social Questions and Answers < 2.1.1 - Multiple CSRF on the Group Section

Description The theme does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. These include declining and accepting group invitations or leaving a group PoC The PoC will be displayed on June 26, 2024, to give users t...

Tickera < 3.5.2.7 - Missing Authorization

Description The Tickera plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generateticketpreview function in versions up to, and including, 3.5.2.6. This makes it possible for authenticated attackers, with contributor-level access and above,...

Slider Responsive Slideshow – Image slider, Gallery slideshow < 1.4.2 - Missing Authorization

Description The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxslideresponsive and srsavesettings functions in versions up to, and including, 1.4.0. This makes it...

Strategery Migrations <= 1.0 - Unauthenticated Arbitrary File Deletion

Description The Strategery Migrations plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to delete arbitrary files on the server which can lead to remote code execution...

12 Step Meeting List < 3.14.34 - Reflected Cross-Site Scripting

Description The 12 Step Meeting List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 3.14.33 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

Eduma < 5.4.8 - Reflected Cross-Site Scripting

Description The Eduma plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 5.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery < 1.4.6 - Missing Authorization

Description The Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaximagegallery and igsavesettings functions in versions up to, and including, 1.4.5. This...