Dave Jong (Patchstack)

Plugin

Ninja Popups <= 4.7.5 Unauth. Open Redirect vulnerability

Theme

RealHomes <= 4.0.2 Broken Access Control vulnerability

Theme

RealHomes <= 4.0.2 Broken Access Control vulnerability

Theme

Consulting <= 6.5.6 Local File Inclusion

Theme

WPLMS < 4.900 CrossSite Request Forgery (CSRF) vulnerability

Plugin

Houzez CRM <= 1.3.4 SQL Injection

Theme

The7 <= 11.7.3 CrossSite Request Forgery (CSRF)

Theme

HashOne <= 1.3.0 Broken Access Control Vulnerability

Theme

Viral <= 1.8.0 Broken Access Control vulnerability

Theme

Viral News <= 1.4.5 Broken Access Control

Theme

MetroStore <= 1.3.2 Broken Access Control

Theme

BuzzStore <= 1.3.6 Broken Access Control

Theme

SparkleStore <= 1.5.9 Broken Access Control

Theme

Medical Heed <= 1.1.4 Broken Access Control

Theme

Kingcabs <= 1.1.5 Broken Access Control

Theme

Craft Blog <= 1.0.7 Broken Access Control

Theme

Fitness Park <= 1.0.6 Broken Access Control

Theme

Online eStore <= 1.0.9 Broken Access Control

Theme

Kathmag <= 1.0.6 Broken Access Control

Theme

Appzend <= 1.2.1 Broken Access Control

Theme

SpiderMag <= 1.1.7 Broken Access Control

Plugin

Easing Slider <= 3.0.8 Plugin Settings Reset Vulnerability

Theme

WoodMart <= 7.2.1 CrossSite Scripting (XSS) vulnerability

Theme

WoodMart <= 7.2.1 Broken Access Control vulnerability

Plugin

Woodmart Core <= 1.0.36 PHP Object Injection

Plugin

Woodmart Core <= 1.0.36 Privilege Escalation

Plugin

YITH WooCommerce Gift Cards Premium <= 3.23.1 Unauth. Gift Card Creation Leading to Stored XSS vulnerability

Plugin

Points and Rewards for WooCommerce <= 1.5.0 Broken Access Control vulnerability

Plugin

Points and Rewards for WooCommerce <= 1.5.0 Settings Change vulnerability

Plugin

Community by PeepSo <= 6.0.9.0 Server Information Disclosure

Theme

TheGem < 5.8.1.1 Broken Access Control vulnerability

Theme

TheGem < 5.8.1.1 Broken Access Control vulnerability

Theme

TheGem < 5.8.1.1 Auth. Stored CrossSite Scripting (XSS) vulnerability

Theme

TheGem < 5.8.1.1 Auth. Stored CrossSite Scripting (XSS) Vulnerability

Theme

Editorialmag <= 1.1.9 Authenticated Arbitrary Plugin Activation

Plugin

CM Pop-Up banners <= 1.5.10 Up banners for WordPress plugin <= 1.5.10 SQL Injection vulnerability

Theme

Educenter <= 1.5.1 Broken Access Control

Theme

Square <= 2.0.0 Broken Access Control

Theme

Blogger Buzz <= 1.2.1 Broken Access Control vulnerability

Theme

Houzez < 2.8.3 Unauth. SQL Injection (SQLi) vulnerability

Theme

Viral Mag <= 1.0.9 Authenticated Arbitrary Plugin Activation Vulnerability

Plugin

HappyFiles Pro <= 1.8.1 Broken Access Control

Plugin

HappyFiles Pro <= 1.8.1 Broken Access Control vulnerability

Theme

Resoto <= 1.0.8 Broken Access Control to Arbitrary Plugin Activation

Theme

Real Estate Directory <= 1.0.5 Authenticated Arbitrary Plugin Activation

Theme

Chankhe <= 1.0.5 Authenticated Arbitrary Plugin Activation

Theme

Mediciti Lite <= 1.3.0 Reflected Cross Site Scripting (XSS) vulnerability

Theme

Brilliance <= 1.3.1 Reflected CrossSite Scripting (XSS) vulnerability

Theme

Intrepidity <= 1.5.1 Cross Site Request Forgery (CSRF)

Theme

Regina Lite <= 2.0.7 Reflected Cross Site Scripting (XSS)

Plugin

Montonio for WooCommerce <= 6.0.1 Server Side Request Forgery (SSRF)

Theme

Big Store <= 1.9.3 CrossSite Request Forgery (CSRF) vulnerability

Plugin

Wpopal Core Features <= 1.5.8 Server Side Request Forgery (SSRF)

Plugin

AMO for WP – Membership Management <= 4.6.6 Server Side Request Forgery (SSRF)

Plugin

WooVirtualWallet – A virtual wallet for WooCommerce <= 2.2.1 Server Side Request Forgery (SSRF)

Plugin

WooVIP – Membership plugin for WordPress and WooCommerce <= 1.4.4 Server Side Request Forgery (SSRF)

Plugin

WooSupply – Suppliers, Supply Orders and Stock Management <= 1.2.2 Server Side Request Forgery (SSRF)

Plugin

Theme Minifier <= 2.0 Server Side Request Forgery (SSRF)

Plugin

Styles <= 1.2.3 Server Side Request Forgery (SSRF)

Plugin

WordPress Page Builder – Qards <= 1.0.5 Qards plugin <= 1.0.5 Server Side Request Forgery (SSRF)

Plugin

PHPFreeChat <= 0.2.8 Server Side Request Forgery (SSRF)

Plugin

Custom Login Admin Front-end CSS <= 1.4.1 end CSS plugin <= 1.4.1 Server Side Request Forgery (SSRF)

Plugin

CSS Adder By Agence-Press <= 1.5.0 Press plugin <= 1.5.0 Server Side Request Forgery (SSRF)

Plugin

Confirm Data <= 1.0.7 Unauth. ServerSide Request Forgery (SSRF) vulnerability

Plugin

AMP Toolbox <= 2.1.1 Server Side Request Forgery (SSRF)

Plugin

Admin CSS MU <= 2.6 ServerSide Request Forgery (SSRF) vulnerability

Plugin

Types <= 3.4.17 Authenticated Arbitrary File Upload Vulnerability

Theme

Total <= 2.1.19 Authenticated Arbitrary Plugin Activation

Plugin

Wholesale Suite <= 2.1.5 Auth. Broken Access Control vulnerability

Theme

Houzez <= 2.7.1 Privilege Escalation

Plugin

Zendrop – Global Dropshipping <= 1.0.0 Arbitrary SQL Query Execution Vulnerability

Plugin

Zendrop – Global Dropshipping <= 1.0.0 Arbitrary File Upload

Plugin

Houzez Login Register <= 2.6.3 Privilege Escalation

Plugin

WatchTowerHQ <= 3.6.16 Privilege Escalation

Plugin

GamiPress <= 2.5.7 Unauthenticated SQL Injection vulnerability

Plugin

GamiPress <= 2.5.6 CSRF Leading to Settings Change Vulnerability

Plugin

GamiPress <= 2.5.6 Missing Authorization Leading to Points Manipulation Vulnerability

Theme

ColorWay <= 4.2.3 CSRF Leading to Arbitrary Plugin Activation

Theme

Magazine Edge <= 1.13 Authenticated Arbitrary Plugin Activation

Plugin

Spectra <= 2.3.0 Contributor+ reCAPTCHA Settings Change Vulnerability

Plugin

Spectra <= 2.3.0 Captcha Bypass Vulnerability

Plugin

Spectra <= 2.3.0 Unauthenticated Email HTML Injection Vulnerability

Plugin

Spectra <= 2.3.0 Unauthenticated Email Spoofing Vulnerability

Theme

Corsa <= 1.5 Arbitrary File Upload

Theme

Upfrontwp <= 1.1 Reflected CrossSite Scripting (XSS) vulnerability

Plugin

MainWP Broken Links Checker Extension <= 4.0 Unauthenticated SQL Injection Vulnerability

Plugin

MainWP Broken Links Checker Extension <= 4.0 Subscriber+ Arbitrary Plugin Activation Vulnerability

Plugin

MainWP Boilerplate Extension <= 4.1 Subscriber+ Plugin Settings Change Vulnerability

Plugin

MainWP Boilerplate Extension <= 4.1 Subscriber+ Post/Page Deletion Vulnerability

Plugin

MainWP Article Uploader Extension <= 4.0.2 Subscriber+ Arbitrary File Deletion Vulnerability

Plugin

MainWP Article Uploader Extension <= 4.0.2 Subscriber+ Post/Page Deletion Vulnerability

Plugin

MainWP BlogVault Backup Extension <= 1.3 Subscriber+ Arbitrary Plugin Installation Vulnerability

Plugin

MainWP Favorites Extension <= 4.0.10 Subscriber+ Arbitrary Plugin Installation Vulnerability

Plugin

MainWP Favorites Extension <= 4.0.10 Subscriber+ Arbitrary File Deletion Vulnerability

Plugin

MainWP White Label Extension <= 4.1.1 Subscriber+ Plugin Settings Change Vulnerability

Plugin

MainWP Buddy Extension <= 4.0.1 Subscriber+ Arbitrary Plugin Activation Vulnerability

Plugin

MainWP WordPress SEO Extension <= 4.0.1 Subscriber+ Arbitrary Plugin Activation Vulnerability

Plugin

MainWP UpdraftPlus Extension <= 4.0.6 Subscriber+ Arbitrary Plugin Activation Vulnerability

Plugin

MainWP Staging Extension <= 4.0.3 Subscriber+ Arbitrary Plugin Activation Vulnerability

Plugin

MainWP Page Speed Extension <= 4.0.2 Subscriber+ Arbitrary Plugin Activation Vulnerability

Plugin

MainWP iThemes Security Extension <= 4.1.1 Subscriber+ Arbitrary Plugin Activation Vulnerability

Plugin

MainWP Clone Extension <= 4.0.2 Subscriber+ Plugin Settings Change Vulnerability

Plugin

MainWP Code Snippets Extension <= 4.0.2 Subscriber+ Arbitrary PHP Code Injection/Execution Vulnerability

Plugin

MainWP Code Snippets Extension <= 4.0.2 Subscriber+ Stored CrossSite Scripting Vulnerability

Plugin

MainWP Links Manager Extension <= 2.1 Unauthenticated PHP Object Injection Vulnerability

Plugin

MainWP Code Snippets Extension <= 4.0.2 Subscriber+ Plugin Settings Change Vulnerability

Plugin

MainWP Comments Extension <= 4.0.6 Subscriber+ Arbitrary Comment Removal/Trash/Approval/Restoration Vulnerability

Plugin

MainWP File Uploader Extension <= 4.1 Subscriber+ Arbitrary File Deletion Vulnerability

Plugin

MainWP Rocket Extension <= 4.0.3 Subscriber+ Arbitrary Plugin Activation Vulnerability

Plugin

MainWP UpdraftPlus Extension <= 4.0.6 Unauthenticated Plugin Settings Change Vulnerability

Plugin

MainWP File Uploader Extension <= 4.1 Unauthenticated Arbitrary File Upload Vulnerability

Plugin

MainWP Google Analytics Extension <= 4.0.4 Subscriber+ Plugin Settings Change Vulnerability

Plugin

MainWP Google Analytics Extension <= 4.0.4 Subscriber+ SQL Injection Vulnerability

Plugin

MainWP Maintenance Extension <= 4.1.1 Subscriber+ SQL Injection Vulnerability

Plugin

MainWP Maintenance Extension <= 4.1.1 Subscriber+ Plugin Settings Change Vulnerability

Plugin

MainWP Matomo Extension <= 4.0.4 CSRF Leading To Plugin Settings Change Vulnerability

Plugin

MainWP Post Dripper Extension <= 4.0.4 Subscriber+ Post/Page Deletion Vulnerability

Plugin

MainWP Post Plus Extension <= 4.0.3 Subscriber+ Post/Page Deletion Vulnerability

Plugin

MainWP Rocket Extension <= 4.0.3 Subscriber+ Plugin Settings Change Vulnerability

Plugin

MainWP Wordfence Extension <= 4.0.7 Subscriber+ Plugin Settings Change Vulnerability

Plugin

MainWP Wordfence Extension <= 4.0.7 Subscriber+ Arbitrary Plugin Activation Vulnerability

Plugin

Wp Social <= 1.9.0 Auth. Sensitive Information Disclosure vulnerability

Theme

Attorney <= 3 Unauth. Arbitrary Content Deletion vulnerability

Plugin

ARMember Premium <= 5.5.1 Unauth. Privilege Escalation vulnerability

Plugin

Wholesale Suite <= 2.1.5 Auth. Stored CrossSite Scripting (XSS) vulnerability

Plugin

Smart Slider 3 <= 3.5.1.9 Auth. PHP Object Injection vulnerability

Plugin

Image Map Pro < 5.6.9 Multiple CrossSite Request Forgery (CSRF) vulnerabilities

Plugin

Image Map Pro < 5.6.9 CrossSite Request Forgery (CSRF) leading to Stored CrossSite Scripting (XSS)

Plugin

ShareThis Dashboard for Google Analytics <= 3.1.4 Broken Access Control vulnerability

Plugin

YITH WooCommerce Gift Cards Premium <= 3.19.0 Unauth. Arbitrary File Upload vulnerability

Theme

Betheme <= 26.6.1 Broken Access Control vulnerability

Theme

Betheme <= 26.6.1 Broken Access Control vulnerability

Theme

Betheme <= 26.6.1 Broken Access Control vulnerability

Theme

Betheme <= 26.6.1 Broken Access Control vulnerability

Theme

Betheme <= 26.6.1 Broken Access Control vulnerability

Theme

Betheme <= 26.6.1 Auth. Stored CrossSite Scripting (XSS) vulnerability

Theme

Betheme <= 26.5.1.4 Auth. PHP Object Injection vulnerability

Plugin

Multilingual CMS <= 4.5.13 CrossSite Request Forgery (CSRF) vulnerability

Plugin

Multilingual CMS <= 4.5.13 CrossSite Request Forgery (CSRF) vulnerability

Plugin

Multilingual CMS <= 4.5.10 Broken Access Control vulnerability

Plugin

Multilingual CMS <= 4.5.10 Broken Access Control vulnerability

Plugin

WatchTowerHQ <= 3.6.15 Unauth. Arbitrary File Deletion vulnerability

Plugin

WatchTowerHQ <= 3.6.15 Unauth. Arbitrary File Download vulnerability

Theme

Soledad <= 8.2.5 Broken Access Control vulnerability

Theme

Soledad <= 8.2.5 Auth. CrossSite Scripting (XSS) vulnerability

Plugin

Api2Cart Bridge Connector <= 1.1.0 Arbitrary File Upload vulnerability

Plugin

Api2Cart Bridge Connector <= 1.1.0 Arbitrary Code Execution vulnerability

Plugin

SearchWP <= 4.2.5 Broken Authentication vulnerability

Theme

Avada <= 7.8.1 CrossSite Request Forgery (CSRF) vulnerability

Plugin

Shortcodes Ultimate <= 5.12.0 CSRF vulnerability leading to Stored XSS

Plugin

ALD - AliExpress Dropshipping and Fulfillment for WooCommerce <= 1.1.0 Sensitive Data Exposure vulnerability

Plugin

Shortcodes Ultimate <= 5.12.0 CrossSite Request Forgery (CSRF) vulnerability

Plugin

Beaver Builder <= 2.5.4.3 Broken Access Control vulnerability

Plugin

Breeze <= 2.0.2 Plugin Settings Change leading to CrossSite Scripting (XSS) vulnerability

Plugin

Responsive Menu <= 4.1.7 Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability

Plugin

Rearrange Woocommerce Products <= 4.0.2 SQL Injection (SQLi) vulnerability

Plugin

Perfect Brands for WooCommerce <= 2.0.4 Set Featured Brand vulnerability

Plugin

Perfect Brands for WooCommerce <= 2.0.4 Server Information Exposure vulnerability

Plugin

Hide My WP <= 6.2.3 Unauthenticated SQL injection (SQLi) vulnerability

Plugin

Hide My WP <= 6.2.3 Unauthenticated Plugin Deactivation vulnerability

Plugin

WP Reset <= 5.98 Authenticated Database Reset vulnerability

Plugin

WP Reset <= 5.98 CrossSite Request Forgery (CSRF) vulnerability leading to Database Reset

Plugin

Popup Builder <= 3.71 Authenticated Local File Inclusion (LFI) vulnerability

Plugin

Popup Builder <= 3.71 Authenticated Deleting/Importing Subscribers vulnerability

Plugin

Popup Builder <= 3.71 Authenticated Newsletter Send With Custom Content And Sender vulnerability

Plugin

ThemeGrill Demo Importer <= 1.6.2 Bypass and Database Wipe vulnerability

Plugin

Discount Rules for WooCommerce <= 2.0.2 Multiple (XSS, SQLi) Vulnerabilities

Plugin

MailerLite – Signup forms <= 1.4.3 Unauthenticated SQL Injection (SQLi) vulnerability

Plugin

MailerLite – Signup forms <= 1.4.4 Multiple CrossSite Request Forgery (CSRF) vulnerabilities

Plugin

WPvivid Backup and Migration <= 0.9.35 Missing Authorization vulnerability leading to Database Leak

Plugin

wpCentral <= 1.4.7 Privilege escalation vulnerability

Plugin

InfiniteWP Client <= 1.9.4.4 Authentication Bypass vulnerability

Plugin

Backup and Staging by WP Time Capsule <= 1.21.15 Authentication Bypass vulnerability

Plugin

Theme Editor <= 2.1 Multiple vulnerabilities

Plugin

File Manager <= 4.8 Multiple Vulnerabilities