CVE Feed

Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.

Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.

Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.

Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.20.

Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.

Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.

Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.

Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.

Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.

Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63.

Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5.

Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.

Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.

Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.

Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.

Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0.

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 (the "idna" codec) and the in_table_b2() function of the "stringprep" module. This only affects domain names containing characters that were not previously registered or had their Unicode attributes such as case-folding behavior updated since Unicode 3.2.0.