WordPress

Subscriber Broken Access Control in Genemy <= 1.6.6 versions.

Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data. This issue affects Widget Options: from n/a through 4.0.1.

Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.

Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1.

Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.

Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.

Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.

Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.

Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.

Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions.

Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.

Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions.

Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.

Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.

Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.

Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions.

Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions.

Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.

Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.

Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.

Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions.

Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions.

Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.

Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions.

Subscriber Broken Access Control in Amelia <= 2.2 versions.

Subscriber Broken Access Control in myCred <= 3.0.3 versions.

Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.

Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.

Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.

Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.

Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.

Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.

Subscriber Broken Access Control in Motors < 1.4.107 versions.

Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.

Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions.

Subscriber Broken Access Control in Bookify <= 1.1.1 versions.

Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.

Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions.

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects MasterStudy LMS Pro: from n/a before 4.7.16.

WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters.…

The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPress's `posts_request` filter with `wp_ticket_com_posts_request()`, which calls…

Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST route ftf/media-proxy (includes/Media_Proxy.php) with permission_callback => __return_true that accepted a base64-encoded URL and forwarded it…

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL…

The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping.…

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widget Setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multiple parameters in all versions up to, and including, 4.2.6 due to insufficient input sanitization and…