WordPress

Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.

Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.

Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.

Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.

Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.

Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.

Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.

Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions.

Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.

Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions.

Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.

Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.

Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.

Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.

Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.

Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.

Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.

Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions.

Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.

Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.

Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data…

The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone…

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers…

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete…

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write…

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an…

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can…

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an…