Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Smart Forms <= 2.6.104 versions.
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.
Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.
A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be in...
A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploit h...
Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.
Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
Subscriber Broken Access Control in Delete All Comments of wordpress <= 7.1 versions.
Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.
Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data.
This issue affects Motors: from n/a through 1.4.124.
Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerability by decompiling the distributed application package and extracting the embedded credentials and c...
A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a c...
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where tha...
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site...
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being ta...
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well a...