WordPress

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.

Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.

Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.

Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary…

Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.

Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

Contributor SQL Injection in WPBulky <= 1.2.2 versions.

Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.

Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.

Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.

Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.

Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.

Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.

Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.

Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.

Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.

Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on…

Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

Subscriber SQL Injection in Reviewer <= 3.14.2 versions.

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

Subscriber SQL Injection in CubeWP <= 1.1.30 versions.

Subscriber SQL Injection in Do Lasso <= 358 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.

Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.

Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3.

Subscriber SQL Injection in Unicamp <= 2.2.2 versions.

Subscriber SQL Injection in Cornerstone < 7.8.8 versions.

Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3.

Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.

Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.

Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.

Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.

Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.

Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions.

Subscriber SQL Injection in GamiPress <= 7.8.7 versions.

Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur Duplicate Page and Post allows Blind SQL Injection. This issue affects Duplicate Page and Post: from n/a through 2.9.5.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This issue affects Xpro Elementor Addons: from n/a through <= 1.5.1.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.1.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/a through <= 3.4.6.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms allows Blind SQL Injection.This issue affects Ninja Forms…