The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.7 via the ‘qode_wishlist_for_woocommerce_wishlist_table_item_callback’ function due to missing validation on a user...

The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘order_by’ parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This...

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19.12.0. This is due to missing or insufficient...

The StaffList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible...

The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ’email-text’ parameter in all versions up to, and including, 4.6.1 due to insufficient input sanitization and output...

The SKT PayPal for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 1.4. This is due to the plugin only enforcing client side controls instead of...

Cleartext Storage of Sensitive Information Vulnerability in GX Works2 all versions allows an attacker to disclose credential information stored in plaintext from project files. As a result, the attacker may be able to open...

The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to update the user role through the...

The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the ‘paypal-submit.php’ file not restricting what user roles a user can register...

The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the ‘tiare_membership_init_rest_api_register’ function not restricting what user roles a user can...

The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data...

The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the ‘findall_listing_user_registration_additional_params’ function not restricting what user roles a user can...

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (uFE0F,...

The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘portfolio_name’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes...