WordPress

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it…

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including…

The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing…

The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators,…

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass…

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users…

DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO…

Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.

Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.

Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with…

Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.

Unauthenticated Local File Inclusion in Etude <= 1.6 versions.

Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.

Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.

Unauthenticated Local File Inclusion in Granola <= 1.13 versions.

Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.

Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.

Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.

Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.

Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.

Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.

Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.

Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions.

Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions.

Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

Unauthenticated Local File Inclusion in Malmö <= 2.2 versions.

Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.

Unauthenticated Local File Inclusion in Getaway < 1.8 versions.

Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.