💥 WP Product Review < 3.7.6 - Unauthenticated Stored Cross-Site Scripting (XSS)
✅ 3.7.6
🔗 https://wordpress.org/plugins/wp-product-review/
ℹ️ https://labs.sucuri.net/unauthenticated-stored-cross-site-scripting-in-wp-support-review/
✅ 3.7.6
🔗 https://wordpress.org/plugins/wp-product-review/
ℹ️ https://labs.sucuri.net/unauthenticated-stored-cross-site-scripting-in-wp-support-review/
WordPress.org
WP Product Review Lite
Easily turn your basic posts into in-depth reviews with ratings, pros and cons, affiliate links, rich snippets and user reviews.
💥 Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection
✅ 1.5.55
🔗 https://wordpress.org/plugins/photo-gallery/
ℹ️ https://plugins.trac.wordpress.org/changeset/2304193
✅ 1.5.55
🔗 https://wordpress.org/plugins/photo-gallery/
ℹ️ https://plugins.trac.wordpress.org/changeset/2304193
WordPress.org
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Photo Gallery is a powerful image gallery plugin with a list of advanced options for creating responsive image galleries with beautiful lightbox.
💥 Team Members < 5.0.4 - Authenticated Stored Cross-Site Scripting (XSS)
✅ 5.0.4
🔗 https://wordpress.org/plugins/team-members/
✅ 5.0.4
🔗 https://wordpress.org/plugins/team-members/
WordPress.org
Team Members
A responsive and clean way to display your team. Create members, add their positions, bios (and more...) and copy-paste the shortcode anywhere.
💥 Visual Composer < 27.0 - Multiple Authenticated Cross-Site Scripting Issues
✅ 27.0
🔗 https://wordpress.org/plugins/visualcomposer/
ℹ️ https://blog.nintechnet.com/multiple-xss-vulnerabilities-fixed-in-wordpress-visual-composer-plugin/
✅ 27.0
🔗 https://wordpress.org/plugins/visualcomposer/
ℹ️ https://blog.nintechnet.com/multiple-xss-vulnerabilities-fixed-in-wordpress-visual-composer-plugin/
WordPress.org
Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages
[New] Easy drag and drop page builder that gives the freedom to design WordPress websites, landing pages, custom themes, maintenance mode & coming …
💥 Ajax Load More <= 5.3.1 - Authenticated SQL Injection
🔗 https://wordpress.org/plugins/ajax-load-more/
ℹ️ https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A1-Injection
🔗 https://wordpress.org/plugins/ajax-load-more/
ℹ️ https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A1-Injection
WordPress.org
WordPress Infinite Scroll – Ajax Load More
The ultimate infinite scroll and lazy load solution for your WordPress powered website.
💥 Paid Memberships Pro < 2.3.3 - Authenticated SQL Injection
✅ 2.3.3
🔗 https://wordpress.org/plugins/paid-memberships-pro/
ℹ️ https://jvn.jp/en/jp/JVN20248858/
✅ 2.3.3
🔗 https://wordpress.org/plugins/paid-memberships-pro/
ℹ️ https://jvn.jp/en/jp/JVN20248858/
WordPress.org
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
Build a membership site that grows with you: user registration, member profiles, 28 protected content types, free or paid subscriptions.
💥 Ajax Load More < 5.3.2 - Authenticated SQL Injection
✅ 5.3.2
🔗 https://wordpress.org/plugins/ajax-load-more/
✅ 5.3.2
🔗 https://wordpress.org/plugins/ajax-load-more/
WordPress.org
WordPress Infinite Scroll – Ajax Load More
The ultimate infinite scroll and lazy load solution for your WordPress powered website.
💥 WP Frontend Profile < 1.2.2 - CSRF Check Incorrectly Implemented
✅ 1.2.2
🔗 https://wordpress.org/plugins/wp-front-end-profile/
ℹ️ https://github.com/glowlogix/wp-frontend-profile/issues/52
✅ 1.2.2
🔗 https://wordpress.org/plugins/wp-front-end-profile/
ℹ️ https://github.com/glowlogix/wp-frontend-profile/issues/52
WordPress.org
WP Frontend Profile
WP Frontend Profile allows users to edit/view their profile and register/login without going into the dashboard to do so.
💥 Add-on SweetAlert Contact Form 7 < 1.0.8 - Authenticated Stored Cross-Site Scripting (XSS)
✅ 1.0.8
🔗 https://wordpress.org/plugins/addon-sweetalert-contact-form-7/
✅ 1.0.8
🔗 https://wordpress.org/plugins/addon-sweetalert-contact-form-7/
WordPress.org
Add-on SweetAlert Contact Form 7
Add SweetAlert2 script into Contact Form 7 submission process.
💥 ThirstyAffiliates < 3.9.3 - Authenticated Stored XSS
✅ 3.9.3
🔗 https://wordpress.org/plugins/thirstyaffiliates/
ℹ️ https://plugins.trac.wordpress.org/changeset/2310320/thirstyaffiliates
✅ 3.9.3
🔗 https://wordpress.org/plugins/thirstyaffiliates/
ℹ️ https://plugins.trac.wordpress.org/changeset/2310320/thirstyaffiliates
WordPress.org
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
🔗 Affiliate link management & cloaker tool. Easily manage, shrink and track your affiliate links in WordPress. 🔥
💥 Official MailerLite Sign Up Forms <= 1.4.4 - Multiple CSRF Issues
✅ 1.4.5
🔗 https://wordpress.org/plugins/official-mailerlite-sign-up-forms/
ℹ️ https://www.webarxsecurity.com/sql-injection-csrf-vulnerabilities-in-mailerlite-sign-up-forms-plugin/
✅ 1.4.5
🔗 https://wordpress.org/plugins/official-mailerlite-sign-up-forms/
ℹ️ https://www.webarxsecurity.com/sql-injection-csrf-vulnerabilities-in-mailerlite-sign-up-forms-plugin/
WordPress.org
MailerLite – Signup forms (official)
Add newsletter signup forms to your WordPress site. Subscribers will be saved directly to your MailerLite account. Super easy to set up!
💥 Form Maker by 10Web <= 1.13.35 - Authenticated SQL Injection
🔗 https://wordpress.org/plugins/form-maker/
🔗 https://wordpress.org/plugins/form-maker/
WordPress.org
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Form Maker is a user-friendly contact form builder that allows to create forms for any purpose, from a simple contact form to multi page survey forms
💥 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.3.3 - Unauthenticated File Upload Bypass
✅ 1.3.3.3
🔗 https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-contact-form-7/
ℹ️ https://www.exploit-db.com/exploits/48520
✅ 1.3.3.3
🔗 https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-contact-form-7/
ℹ️ https://www.exploit-db.com/exploits/48520
WordPress.org
Drag and Drop Multiple File Upload – Contact Form 7
This simple plugin create Drag & Drop or choose Multiple File upload in your Confact Form 7 Forms.
💥 Page Builder: PageLayer - Drag and Drop website builder < 1.1.2 Unprotected AJAX's leading to XSS
💥 Page Builder: PageLayer - Drag and Drop website builder < 1.1.2 CSRF leading to XSS
✅ 1.1.2
🔗 https://wordpress.org/plugins/pagelayer/https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-contact-form-7/
ℹ️ https://www.wordfence.com/blog/2020/05/high-severity-vulnerabilities-in-pagelayer-plugin-affect-over-200000-wordpress-sites/
💥 Page Builder: PageLayer - Drag and Drop website builder < 1.1.2 CSRF leading to XSS
✅ 1.1.2
🔗 https://wordpress.org/plugins/pagelayer/https://wordpress.org/plugins/drag-and-drop-multiple-file-upload-contact-form-7/
ℹ️ https://www.wordfence.com/blog/2020/05/high-severity-vulnerabilities-in-pagelayer-plugin-affect-over-200000-wordpress-sites/
WordPress.org
Page Builder: PageLayer – Drag and Drop website builder
The most advanced frontend drag & drop page builder. PageLayer is a light weight but extremely powerful Website Builder.
💥 Final Tiles Gallery < 3.4.19 - Authenticated Stored Cross-Site Scripting (XSS)
✅ 3.4.19
🔗 https://wordpress.org/plugins/final-tiles-grid-gallery-lite/
ℹ️ https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A7-Cross-Site_Scripting_(XSS)
✅ 3.4.19
🔗 https://wordpress.org/plugins/final-tiles-grid-gallery-lite/
ℹ️ https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A7-Cross-Site_Scripting_(XSS)
WordPress.org
Image Photo Gallery Final Tiles Grid
Image Gallery + Photo Gallery + Portfolio Gallery + Tiled Gallery in 1 plugin. Includes lightbox and hover effects. It supports Pinterest (masonry) ph …
💥 bbPress < 2.6.5 - Authenticated Stored Cross-Site Scripting via the forums list table
💥 bbPress 2.6-2.6.5 - Authenticated Privilege Escalation via the Super Moderator feature
💥 bbPress < 2.6.5 - Unauthenticated Privilege Escalation when New User Registration enabled
✅ 2.6.5
🔗 https://wordpress.org/plugins/bbpress/
ℹ️ https://bbpress.org/blog/2020/05/bbpress-2-6-5-is-out/
💥 bbPress 2.6-2.6.5 - Authenticated Privilege Escalation via the Super Moderator feature
💥 bbPress < 2.6.5 - Unauthenticated Privilege Escalation when New User Registration enabled
✅ 2.6.5
🔗 https://wordpress.org/plugins/bbpress/
ℹ️ https://bbpress.org/blog/2020/05/bbpress-2-6-5-is-out/
WordPress.org
bbPress
bbPress is forum software for WordPress.
💥Multi Scheduler <= 1.0.0 - Arbitrary Record Deletion via CSRF
🔗 https://wordpress.org/plugins/multi-scheduler/
ℹ️ https://www.exploit-db.com/exploits/48532
🔗 https://wordpress.org/plugins/multi-scheduler/
ℹ️ https://www.exploit-db.com/exploits/48532
WordPress.org
multi Scheduler
Multi Scheduler – Appointment Booking and Schedule Plugin Easy schedule
💥 MapPress Maps < 2.54.6 - Improper Capability Checks in AJAX Calls
✅ 2.54.6
🔗 https://wordpress.org/plugins/mappress-google-maps-for-wordpress/
ℹ️ https://blog.alertlogic.com/alert-logic-threat-research-team-identifies-new-vulnerability-cve-2020-12675-in-mappress-plugin-for-wordpress/
✅ 2.54.6
🔗 https://wordpress.org/plugins/mappress-google-maps-for-wordpress/
ℹ️ https://blog.alertlogic.com/alert-logic-threat-research-team-identifies-new-vulnerability-cve-2020-12675-in-mappress-plugin-for-wordpress/
WordPress.org
MapPress Maps for WordPress
MapPress is the easiest way to add unlimited interactive Google and Leaflet maps to WordPress.
💥 AdRotate < 5.8.4 - Authenticated SQL Injection
✅ 5.8.4
🔗 https://wordpress.org/plugins/adrotate/
ℹ️ https://ajdg.solutions/blog/adrotate-5-8-4-security-update/
✅ 5.8.4
🔗 https://wordpress.org/plugins/adrotate/
ℹ️ https://ajdg.solutions/blog/adrotate-5-8-4-security-update/
WordPress.org
AdRotate Banner Manager – The only ad manager you'll need
Advertising made easy. Manage all your ads including Google Ads, Amazon banners and many more from your dashboard.
💥 Simple File List < 4.2.8 - Authenticated Arbitrary File Deletion
✅ 4.2.8
🔗 https://wordpress.org/plugins/simple-file-list/
ℹ️ https://ctulhu.me/2020/05/16/cve-2020-12832/
✅ 4.2.8
🔗 https://wordpress.org/plugins/simple-file-list/
ℹ️ https://ctulhu.me/2020/05/16/cve-2020-12832/
WordPress.org
Simple File List
Simple File List gives your WordPress website a list of your files which allows your users to open and download them.