WordPress

Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.

Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.

Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.

Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.

Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions.

Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.

The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter…

Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.

Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.

Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Path Traversal. This issue affects Conversational Forms for ChatBot: from n/a through 1.1.8.

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent…

Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.

Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.

Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.

Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.

Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.

Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.

Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.

Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.

Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.

Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.

Subscriber Sensitive Data Exposure in Coupon Affiliates <= 7.8.1 versions.

Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.

Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.

Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.

Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.

Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions.

Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.

Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.

Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.

Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.

Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.

Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.

Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions.

Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.

Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.

Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions.

Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.

Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.

Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.

Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.

Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.

Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.