CVEs

Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.

Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

Subscriber SQL Injection in Woffice <= 5.4.35 versions.

Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.

Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.

Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.

Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.

Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.

Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.

Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.

Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.

Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.

Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.

Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as…

Memory corruption while processing service requests.

Memory Corruption when executing system service routines due to improper handling of user input buffers.

Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.