WooCommerce PDF Invoices < 4.3.0 - Shop Manager+ Arbitrary Options Update

Description The plugin does not have proper authorisation in its JSON import feature, which could allow Shop Manager and above roles to update arbitrary blog options...

Everest Backup < 2.2.0 - Sensitive Information Exposure via Log File

Description The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 2.2.0 exclusive via the plugin's log file. This makes it possible for unauthenticated attackers to extract...

Pre* Party Resource Hints < 1.8.20 - Admin+ SQLi

Description The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

If-So Dynamic Content Personalization < 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

TerraClassifieds <= 2.0.3 Unauthenticated Arbitrary File Upload

Description The TerraClassifieds – Simple Classifieds Plugin plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 2.0.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote...

WPC Product Bundles for WooCommerce < 7.3.2 - Cross-Site Request Forgery

Description The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.3.1. This is due to missing or incorrect nonce validation on several functions in /includes/class-woosb.php. This makes it possible for...

Easy Video Player < 1.2.2.11 - Contributor+ Stored XSS

Description The plugin does not validate and escape the ratiocode attribute of its evpembedvideo shortcode before outputting it back in a page where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Calculated Fields Form < 1.2.29 - Contributor+ Open Redirect

Description The plugin does not validate a shortcode attribute, which could allow Contributor and above role to perform Open Redirect attack...

404 Solution < 2.33.1 - Sensitive Information Exposure via Log File

Description The 404 Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.33.0 via the plugin's log file. This makes it possible for unauthenticated attackers to extract sensitive data including plugin configuration and debug data...

ZeroBounce Email Verification & Validation < 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The ZeroBounce Email Verification & Validation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

FastDup < 2.1.8 - Sensitive Information Exposure via Log File

Description The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.7 via the plugin's log file. This makes it possible for unauthenticated attackers to extract sensitive data including...

Events Shortcodes & Templates For The Events Calendar < 2.3.2 - Authenticated (Contributor+) SQL Injection via shortcode

Description The Events Shortcodes & Templates For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 2.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

JS Help Desk < 2.8.2 - Unauthenticated SQL Injection via email and trackingid

Description The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

HTML Forms < 1.3.30 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Sensei LMS < 4.18.0 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its block attributes before outputting them back in a page/post where the block is rendered, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Republish Old Posts < 1.27 - Cross-Site Request Forgery via rop_options_page

Description The Republish Old Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.21. This is due to missing or incorrect nonce validation on the ropoptionspage function. This makes it possible for unauthenticated attackers to modify the...

WebinarIgnition < 3.05.1 - Authenticated (Subscriber+) PHP Object Injection

Description The Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.05.0 via deserialization of untrusted input. This makes it possible for...

WP Adminify < 3.1.7 - Authenticated(Administrator+) SQL Injection

Description The WP Adminify plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 3.1.7 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

White Label < 2.9.1 - Cross-Site Request Forgery via white_label_reset_wl_admins

Description The White Label plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.0. This is due to missing or incorrect nonce validation on the whitelabelresetwladmins function. This makes it possible for unauthenticated attackers to reset plugin...

Login Lockdown < 2.07 - Admin+ SQLi

Description The plugin does not properly sanitise and escape the iDisplayStart parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

Checkout Mestres WP < 7.1.9.8 - Unauthenticated SQL Injection

Description The Checkout Mestres WP plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to, and including, 7.1.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

Checkout Mestres WP < 7.1.9.8 - Authentication Bypass via Password Reset

Description The plugin is vulnerable to authentication bypass due to a weak password reset functionality, allowing unauthenticated attackers to reset the password of arbitrary users to a guessable value based on the current time...

Google Photos Gallery with Shortcodes < 4.0.3 - Reflected Cross-Site Scripting

Description The Google Photos Gallery with Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

Welcart e-Commerce < 2.9.4 - Authenticated(Editor+) SQL Injection

Description The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 2.9.4 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

Booking Manager < 2.1.6 - Authenticated(Contributor+) SQL Injection via Shortcode

Description The Booking Manager plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode attributes in all versions up to 2.1.6 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

Most And Least Read Posts Widget <=2.5.16 - Authenticated(Contributor+) SQL Injection via Widget settings

Description The Most And Least Read Posts Widget plugin for WordPress is vulnerable to SQL Injection via the widget settings in all versions up to 2.5.17 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

Auto Amazon Links < 5.1.2 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user...

Booking for Appointments and Events Calendar – Amelia < 1.0.86 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Simply Schedule Appointments < 1.6.6.1 - Authenticated(Administrator+) SQL Injection

Description The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 1.6.6.1 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient...

WP Affiliate Disclosure < 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via $id

Description The WP Affiliate Disclosure plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the $id variable in versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Easy PayPal Buy Now Button < 1.8.2 - Cross-Site Request Forgery

Description The Easy PayPal Buy Now Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this...

WP Simple Booking Calendar < 2.0.8.5 - Cross-Site Request Forgery

Description The WP Simple Booking Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.8.4. This is due to missing or incorrect nonce validation on the wpsbcrefreshcalendareditor function. This makes it possible for unauthenticated...

WP User Profile Avatar < 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The WP User Profile Avatar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, t...

WS Form LITE < 1.9.171 - Authenticated(Administrator+) SQL Injection

Description The WS Form LITE – Drag & Drop Contact Form Builder for WordPress plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 1.9.171 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

Profile Builder < 3.10.8 - Contributor+ User Metadata Disclosure

Description The plugin is vulnerable to unauthorized access of data due to a missing capability check on the wppbtoolboxusermetahandler function allowing authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata...

WooPayments < 6.7.0 - Unauthenticated Order Deletion via IDOR

Description The plugin does not validate orders ownership which could allow unauthenticated attacker to delete orders by knowing the order ID and cart hash i.e. they would have to create a cart that matches the items in the order they are trying to delete. Furthermore, only stores running on lega...

WP Optin Wheel < 1.4.3 - Sensitive Information Exposure via Log File

Description The WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the plugin's debug log file. This makes it possible for unauthenticated attackers...

Oxygen Builder < 4.8.1 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via a custom field due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execut...

Active Products Tables for WooCommerce < 1.0.6.1 - Unauthenticated PHP Object Injection

Description The Active Products Tables for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.6 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is...

Brave Popup Builder < 0.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping...

GeoDirectory < 2.3.29 - Authenticated(Administrator+) SQL Injection

Description The GeoDirectory – WordPress Business Directory Plugin, or Classified Directory plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in all versions up to 2.3.29 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient...

WebinarIgnition < 3.05.1 - Missing Authorization to Unauthenticated Privilege Escalation

Description The Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.05.0. This makes it possible...

Zoho Forms < 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The Zoho Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

Split Test For Elementor < 1.7.0 - Cross-Site Request Forgery

Description The Split Test For Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.9. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an...

WP Crowdfunding < 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions...

WP Review Slider < 12.8 - Authenticated (Administrator+) Stored Cross-Site Scripting

Description The WP Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

WP MLM <= 4.0 - Unauthenticated Arbitrary File Upload

Description The WP MLM SOFTWARE PLUGIN plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 4.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may...

Recipe Maker For Your Food Blog from Zip Recipes < 8.1.1 - Authenticated(Contributor+) SQL Injection

Description The Recipe Maker For Your Food Blog from Zip Recipes plugin for WordPress is vulnerable to SQL Injection via the ‘order’ and 'orderby' parameters in all versions up to 8.1.1 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

Local Delivery Drivers for WooCommerce < 1.9.1 - Missing Authorization to Driver Account Takeover

Description The Local Delivery Drivers for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'lddfweditdriverservice' function in all versions up to, and including, 1.9.0. This makes it possible for...

Uncode Core < 2.8.9 - Authenticated (Subscriber+) Arbitrary File Deletion

Description The uncode-core plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers with subscriber level access or higher to delete arbitrary files on the site...