WordPress

Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.

Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.

Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.

Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.

Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.

Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.

Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.

Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.

Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.

Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.

Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions.

Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.

Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.

Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.

Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.

Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.

Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.

Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.

Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.

Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.

Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.

Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.

Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.8.

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks in the…

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the Frontend…

The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal…

The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public…

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through 2.4.8 is vulnerable to path traversal which makes it possible for the attacker to retrieve the directory listing for arbitrary directories on the server.

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient…

Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This issue affects OMGF Pro: from n/a through 5.2.6.

Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.

Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.

Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.

Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18.

Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.

Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.

Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Master Slider <= 3.11.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.

Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.

Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions.

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.

Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.