CVE Database

Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.

Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.

Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.

Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.

Customer Path Traversal in Tax Exempt for WooCommerce <= 1.9.3 versions.

Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.

Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.

Unauthenticated Broken Access Control in Motors <= 5.6.80 versions.

Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.

Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.

Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.

Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.

Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions.

Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.

Contributor PHP Object Injection in ARMember Premium <= 7.0 versions.

u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components

An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. …

Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.

Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.

Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions.

Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.

Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions.

Subscriber SQL Injection in Unicamp <= 2.2.2 versions.

Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions.

Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.

In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step …

liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If …

The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all …

The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to …

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up …

A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included) There is a possible …

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up …