WordPress

Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.

Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.

Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.

Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.

Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.

Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.

Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.

Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.

Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.

Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.

Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9.

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers…

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.

Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.

Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler…

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary…

Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.

Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.

Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.

Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

Unauthenticated SQL Injection in JetEngine <= 3.8.9.1 versions.

Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.

Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.

Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions.

Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions.

Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.

Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.

Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.

Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.

Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.

Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.

Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.

Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.

Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.

Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.

Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.

Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.

Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.

Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.