wesley

RTMKit <= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter

• Нарушение контроля доступа (IDOR)

rometheme · rtmkit16 июн. 2026 г.

Newsletters <= 4.13 - Unauthenticated SQL Injection via wpmlsubscriber_id Parameter

• Без аутентификации
• SQL-инъекция

contrid · newsletters10 июн. 2026 г.

W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header

• Без аутентификации
• Утечка информации

boldgrid · w3 total cache2 апр. 2026 г.

WP-WebAuthn <= 1.3.4 - Unauthenticated Stored Cross-Site Scripting

• Без аутентификации
• XSS

axton · wp-webauthn21 мар. 2026 г.

WPCOM Member <= 1.7.16 - Authentication Bypass via Weak OTP

• Без аутентификации
• Обход аутентификации

whyun · wpcom member16 дек. 2025 г.

GSheetConnector For Gravity Forms <= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

• RCE
• Нарушение контроля доступа (IDOR)

westerndeal · gsheetconnector for gravity forms – send gravity forms entries to google sheets in real-time11 окт. 2025 г.

GSheetConnector For Gravity Forms <= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation

• CSRF

westerndeal · gsheetconnector for gravity forms – send gravity forms entries to google sheets in real-time11 окт. 2025 г.

WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion

• pre-auth RCE

wptravelengine · wp travel engine – tour booking plugin – tour operator software9 окт. 2025 г.

WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming

• pre-auth RCE
• Обход пути

wptravelengine · wp travel engine – tour booking plugin – tour operator software9 окт. 2025 г.

LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function

• Без аутентификации
• CSRF

latepoint · latepoint – calendar booking plugin for appointments and events30 сент. 2025 г.

LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function

• Без аутентификации
• Обход аутентификации

latepoint · latepoint – calendar booking plugin for appointments and events30 сент. 2025 г.

Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation

• Нарушение контроля доступа (IDOR)

extendthemes · kubio ai page builder19 сент. 2025 г.

Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitr

• Нарушение контроля доступа (IDOR)

wplegalpages · privacy policy generator – wplp legal pages18 сент. 2025 г.

Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install

• Нарушение контроля доступа (IDOR)

blazethemes · blaze demo importer16 сент. 2025 г.

Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery

• Без аутентификации
• CSRF

mdimran41 · blog designer for elementor – post slider, post carousel, post grid11 сент. 2025 г.

Zoho Flow <= 2.14.1 - Cross-Site Request Forgery

• Без аутентификации
• CSRF

zohoflow · zoho flow – integrate 100+ plugins with 1000+ business apps, no-code workflow automation11 сент. 2025 г.

LWSCache <= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function

• Нарушение контроля доступа (IDOR)

aurelienlws · lwscache29 авг. 2025 г.

Xagio SEO <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files

• Без аутентификации
• Утечка информации

xagio · xagio seo – ai powered seo28 авг. 2025 г.

WP ULike Pro <= 1.9.3 - Unauthenticated Limited Arbitrary File Upload

• Без аутентификации
• Загрузка файлов
• XSS

wp ulike · wp ulike pro28 авг. 2025 г.

Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions

• Без аутентификации
• CSRF

smub · easy digital downloads – ecommerce payments and subscriptions made easy20 авг. 2025 г.

Multiple Plugins By FunnelKit <= (Various Versions) - Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library

• Утечка информации

amans2k · funnelkit automations – email marketing automation and crm for wordpress & woocommerce19 авг. 2025 г.

Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion

• Нарушение контроля доступа (IDOR)
• Отказ в обслуживании

dglingren · media library assistant19 авг. 2025 г.

B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery

• SSRF

bplugins · bslider – create responsive image, post, product, and video sliders14 авг. 2025 г.

B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure

• Утечка информации

bplugins · bslider – create responsive image, post, product, and video sliders14 авг. 2025 г.

B Slider- Gutenberg Slider Block for WP <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation

• RCE
• Нарушение контроля доступа (IDOR)

bplugins · bslider – create responsive image, post, product, and video sliders12 авг. 2025 г.