CVE Feed

Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.

Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.

Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.

Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.

Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.

Author SQL Injection in WP ERP <= 1.17.9 versions.

Administrator SQL Injection in Estatik <= 4.3.5 versions.

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.

Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.

Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

Subscriber Broken Access Control in FormGent <= 1.12.2 versions.

Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.

Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.

Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.

Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

Author SQL Injection in Quiz Cat <= 3.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.

Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.